Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

Microsoft Teams App data storage on iOS and Android [closed]

A client has asked us to have a look into their DLP (data loss prevention) policies implemented in their Teams app. I am doing various exfiltration tests etc but I was also considering checking if ...
0
votes
0answers
55 views

Is it possible to achieve persistence in Windows through using WinLogon without touching userinit, notify, or shell keys?

I am interested in finding out if it is possible to achieve persistence through winlogon without using one of those 3 mentioned keys. I am trying to determine if it's safe to ignore registry key ...
0
votes
0answers
39 views

How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND [bad sources]

How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND calls from disreputable (NON-'A' attestation) service providers/carriers/sources. I'm ...
2
votes
2answers
64 views

Why is the first step for an attacker to get Reverse Shell after getting RCE?

If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell? Even though I can run system commands, then why do I ...
0
votes
0answers
25 views

What is the best way to use nmap anonymously in kali? [duplicate]

so I use proxychains for a lot of scanning and enumeration tools. However, nmap does not function well with proxychains. I always get this error: nmap: netutil.cc:1319: int collect_dnet_interfaces(...
0
votes
1answer
55 views

how to do a pentest to /assets/js/login.js [closed]

Hey guys this is my first question in this kind of platform. I made a pentest a vulnerable machine this is like a web page video content there are not much target vectors. In my attack a detect only ...
0
votes
0answers
45 views

Is it possible to know the keep-alive time supported by a web server?

I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
0
votes
0answers
43 views

MQTT - Man in The Middle Attack

I'm trying to perform a MiTM attack using Ettercap. where i'm trying to publish a message to topic "A" and using ettercap trying to replace topic "A" to topic "B". MQTT ...
0
votes
0answers
32 views

Pentest methodology for industrial solutions PLC/DCS/Control Servers

which methodology of pentesting for industrial soltions (DCS/SCADA/PLC/Cotroler Servers network with OPC connectivity) would you recommend to apply?
0
votes
2answers
78 views

When can I start security test in an agile environment? [closed]

I have a web application and we are working in an agile environment, and the QC team working and need to run security testing. When I can run the security test? I searched for this topic and can't ...
20
votes
3answers
4k views

How can we safely allow a client to perform penetration testing?

A potential client is planning to do penetration testing on our SaaS. Is it standard or fair for us to request things like the following? An NDA from the pen tester Details on who is performing the ...
0
votes
0answers
69 views

Angular Expression/XSS-Payload without Quotes or “$”

I am really trying hard to exploit a Client Side Template Injection vulnerability in a webapp I am currently pentesting. Im so close to getting the payload to be executed, but I am stuck at the last ...
1
vote
1answer
47 views

Should we build a generic security unit test suite

as part of our secure SDLC we are delivering security as security requirements directly into the backlog of an application team. The security requirements will directly correlate to the functional ...
1
vote
1answer
60 views

Safe sharing source code with 3rd party for security review?

I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
2
votes
2answers
122 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
1
vote
0answers
41 views

GraphQL endpoint security testing

I am working with a team who is developing a mobile app for which they are using GraphQL. So as part of performing security testing it, they only shared the graphql endpoint and nothing else. Not even ...
0
votes
1answer
50 views

.local domain any possible ways in getting the extension

I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host. ...
0
votes
4answers
101 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
2
votes
0answers
28 views

Java - Ultra Light Client (ULC traffic inspection)

I'm working on security assessment of thick client application created using ULC. It is black box approach. Based on wiki (wiki.c2.com): "Ultra Light Client (ULC) for Java is a widget set that ...
1
vote
1answer
44 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
0
votes
0answers
42 views

Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]

Background In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
0
votes
3answers
109 views

How to share penetration tests results + remediation plan to third party companies without exposing one's self

We are integrating our services with 3rd party companies (ie customers are able to buy the products of third party companies on our platform). These companies are asking us to provide to their ...
0
votes
0answers
57 views

How to obtain PRGA file using aireplay-ng chopchop or fragmentation attack

I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0 X (by x i mean the number of channel AP is ...
-1
votes
1answer
90 views

OWASP ZAP: How to Test on AWS + Magento? Which guidelines must be observed? [closed]

I am supposed to do a test for AWS. But since AWS has limitations, probably also in the direction of DDoS and other points, what does a corresponding test scenario look like? It is about a Magento ...
1
vote
1answer
69 views

Is nonce useless when user input is reflected within an inline script?

I stumbled upon a web app which is accepting user input and putting it into a variable within script tag. The script tag does have a nonce attribute. As am working on bypassing the XSS filter, I had ...
0
votes
1answer
63 views

windows 10 showing me that bWAPP contains a reverse shell

i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that....
2
votes
1answer
843 views

Connect msfvenom reverse shell without metasploit

For most reverse shell here, I can simply use netcat to connect: nc -nlvp 1234 But for reverse shell created by msfvenom, for example: msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.7 ...
0
votes
1answer
49 views

Error on Content Security Policy while testing for Clickjacking

I was recently testing for Clickjacking and when I opened developer tools, I was warning Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source ...
0
votes
0answers
94 views

Bypass ASLR in buffer overflow

Iam new in buffer overflow and i have some questions : Is all dll files in windows are loaded at memory or some of them only , If some of them , Who tell windows to load this and leave this How an ....
5
votes
1answer
143 views

What questions are useful to scope a mobile app pen test?

When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation. ...
0
votes
1answer
138 views

Pentesting : what should one do if nothing is returned from Vulnerability Assessment

A typicall pentesting activity has the following step : 1 - information gathering + enumeration 2 - vulnerability assessment (vulnerability scanning) 3 - exploitation 4 - post exploitation ...
1
vote
0answers
101 views

Collaboration tools [closed]

Is there any good alternatives to the lair-framework. I think that was an awesome platform, and unfortunately its not maintained anymore and no more updates to it. But i have tried all other kinds of ...
0
votes
1answer
60 views

What happens when attacker scan a IP that is used by multiple devices? [duplicate]

Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
2
votes
3answers
117 views

Should the pentester seek features to test by himself?

Imagine we have a dev team developers team lead scrum master ... When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it ...
0
votes
0answers
97 views

OpenVPN: test security from external point of view

How would I test an OpenVPN environment from external, kind of black box pentest. I have the public server-IP (port 1194, udp, tun). I have found NO online ressources on how to do that, or whether ...
0
votes
0answers
236 views

Not able to capture 4 way handshake using airodump-ng

I am not able capture 4 way handshake, I also tried manually disconnecting and reconnecting my device to the network in hope that airodump-ng will capture the handshake but no luck. I checked the ...
1
vote
1answer
329 views

Bypass frontend ampersand encoding and perform XSS

I just started learning something about web app pentesting and I was trying my hand on a website (which I'm allowed to test on). I found this potential stored XSS: <div title="hello">hello</...
0
votes
1answer
452 views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
0
votes
1answer
72 views

Difference between Web App Pentesting and Web App Security Audit

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit. For instance, OWASP Testing Guide could be used for both of those cases. Let's say the pentester and ...
0
votes
2answers
159 views

Nmap scanning with and without proxychains has different behaviour

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
11
votes
3answers
969 views

Why are there different pentest phases/stages/methodologies?

Why are there different pentest phases/stages/methodologies? Which one should be used? Why don't we come out with standard one? E.g. Wikipedia / Cybrary.it Reconnaissance Scanning Gaining ...
1
vote
1answer
122 views

precautions before conducting a penetration test

According to me, The key here is to use virtualization. This is a main precaution that allows safe handling (isolation) of systems that could otherwise be exploited and leveraged as jump points into ...
0
votes
1answer
100 views

Pentesting Webserver Dead End (MySQL White Listing Bypass)

I am currently pentesting a webserver running MySQL, managed to obtain its db configuration (w/ login credentials) but the hostname is in a Local Area Network. The server has white listing enabled, so ...
0
votes
0answers
340 views

Bypassing SSL pinning Using Frida issue

I am a penetration tester, and I was doing some SSL pinning bypass using Frida. I have pushed all the required files and certificates, and burp is intercepting traffic from the Android Studio ...
35
votes
6answers
15k views

As a company, how can we prevent penetration testers from compromising our system?

What tools or techniques can companies use to prevent penetration testers from behaving maliciously and exfiltrating data or compromising the system? I cannot imagine that the only protections ...
0
votes
2answers
234 views

First step into pentesting Vaadin web application framework

I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration ...
1
vote
1answer
2k views

Calculate Content-Length (HTTP Request Smuggling)

I am trying to understand more about HTTP Request Smuggling and I have been reading this article (https://portswigger.net/web-security/request-smuggling). Content-Length represents the length of the ...
4
votes
1answer
67 views

Exploitation of client_id in OAuth

We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
0answers
13 views

Session Hijacking with remote server [duplicate]

Session cookie can help to bypass 2FA. Suppose victim and attacker are on same network without firewall. Attacker wants to steal victims login session. So attacker sends original login page over ...
0
votes
1answer
85 views

How to pentest RMI

I have a Swing client that communicates through T3 protocol (RMI) with a Server. Now I want to capture the requests and modify them (like HTTP in Burp or OWASP ZAP). Is there any attack proxy for RMI/...

1
2 3 4 5
25