Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
2
votes
1answer
41 views
How do you test buffer overflows in the lab?
I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
1
vote
0answers
22 views
OWASP Testing Guide Equivalent for Desktop Applications [on hold]
I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications?
I had no luck searching the Internet.
I am looking for something ...
-1
votes
0answers
40 views
What will happend if I change the SYSname SNMP? [on hold]
I want to learn about SNMP pentesting. I have downloaded VyOS virtual machine. Next I downloaded the snmpwalk tool to pentest the SNMP protocol.
I have learned that if someone guesses/bruteforces the ...
1
vote
1answer
18 views
Kerberos unconstrained delegation for user
I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
1
vote
1answer
28 views
POST Method Anti-CSRF Help With Burp Suite
I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
0
votes
0answers
19 views
Cross Origin Resource Sharing null vs wildcard?
I am testing an application that uses widget. These widgets are placed in the customer websites to use as some sort of tracking clicks device and returns some data too, therefore it is necessary to ...
0
votes
0answers
23 views
How to run Metasploit WMAP on site that requires SNI
Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
0
votes
0answers
31 views
MITMf not working on, no internet and only message is push.bitdefender.net
I have recently started learning hacking and have come across a problem when performing man-in-the-middle attacks with MITMf. When I use it with this command below:
mitmf --arp --spoof --gateway 192....
0
votes
0answers
32 views
GetSimple CMS file upload vulnerability [on hold]
I am still learning Metasploit Framework and I have came across a problem while pentesting a vulnerable GetSimple CMS lab, version 3.3.10. I have set options and selected payload.
Logged in as an ...
0
votes
0answers
37 views
How to run command as privileged Windows service account against Active Directory domain controller?
I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test).
Since the account is a service account, it cannot be ...
0
votes
0answers
40 views
Local Group Administrator Account shared across network?
I am a bit confused on the local group administrator account role. I managed to obtain domain administrator on a recent pentest but looking back at my results I am somewhat confused the actual ...
-2
votes
1answer
36 views
Penetration testing or Malware analysis?
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
0answers
32 views
What other things should i talk about in the attack technique research report?
I will be taking a few challenges on "PentestLab" to demonstrate particular penetration techniques used by pen tester to their targets.
A report will be created for that
Report contents are:
the ...
0
votes
0answers
40 views
Metasploit - How to abort (CTRL+C) a running process and not terminate the channel?
Say, I get a meterpreter shell and enter the shell command.
There are two scenarios:
Backgrounding a process
Aborting a process
For the first one, adding an "&" at the end of the commands ...
0
votes
0answers
40 views
Wifi Pineapple - How would Karma or PineAP silently log probes from individual clients, *without* broadcasting beacons?
With the intention of silently gathering information about a client's environment, how would one utilize Karma and PineAP to log probes but not broadcast / reply with beacon packets?
In the test lab, ...
0
votes
0answers
80 views
THC-Hydra Issue-Giving false positive passwords
I'm having some trouble using hydra to crack my website login. Below is my command.
hydra -L userdummy.txt -P passdummy.txt -vV 104.20.113.15 https-post-form "/website.com/sign-in:email=^USER^&...
0
votes
2answers
83 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
1
vote
2answers
71 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
2answers
118 views
Pen testing - How to use credentials without remote desktop?
I'm a junior penetration tester, working in a place that does not give much guidance and I kind of just had to dive in. I'm pretty good, in that I can normally still obtain domain admin on networks I ...
0
votes
1answer
71 views
How is my employer accessing my router when employer's laptop is wirelessly connected to my home network
I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0
votes
2answers
35 views
/cron path found when testing site
I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
0
votes
0answers
17 views
wifi hacking: evil twins WPA2-PSK phishing [duplicate]
I have created a Rouge access point using dnsmasq and hostapd with WPA2 configuration with the same SSID as my wifi network. It works fine and clients can connect to my Rouge AP.
The question is: Is ...
0
votes
0answers
46 views
Planning a large time-bound pentest
I have let's say 15000 IP of my x.com client.
I need to perform network pentest in 7 days only. The client has provided ranges of IPs and not specific IPs. It is a large company and it has third ...
-6
votes
1answer
118 views
How to disconnect a client from my AP in Kali Linux? [closed]
I want to disconnect a client from my Access Point and I am using Kali Linux, Is there any way to do this?
-3
votes
2answers
179 views
Pen testing wifi networks [closed]
What are the different attack vectors on wifi networks? Regarding recent research I have done, the most common are DOS, MITM, ARP poisoning.
Which tools can I use and steps to follow for conducting ...
0
votes
0answers
19 views
Unspecified form action - HTTP parameter pollution
Security scanner OWASP ZAP for form without specified action returns information that this results in vulnerability named HTTP parameter pollution.
I've read about testing for this vulnerability
...
-3
votes
2answers
164 views
How to be a better ethical hacker? [closed]
I've been trying to learn ethical hacking for more than that two years thus far, I did a lot of practice on things like DVWA, hackthissite.org, metasploitable and some more similar apps and sites. Yet ...
0
votes
0answers
24 views
?, / or ; in input query string are causing errors. What does that mean?
I am currently testing a website and realized that if I put ; and/or % into the input for a search query it causes a 505 Internal Error.
Putting a ? in causes a 404 Page not found.
The URL for the ...
0
votes
0answers
25 views
Mimikatz /rc4 argument for pass-the-ticket?
I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets.
The command usually takes the form (Golden tickets):
kerberos::golden /sid:SID /domain:DOMAIN /...
1
vote
1answer
40 views
CSRF Testing. Validation Error 422. Locale Required
So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
3
votes
5answers
210 views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
2
votes
2answers
301 views
Penetration Testing List
I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For ...
0
votes
0answers
124 views
Scanning pages using wapiti with login details
I am using Wapiti to scan my web application. All URLs in the login page gets scanned and report gets generated. But, pages that require login credentials do not get scanned. What is the command that ...
0
votes
0answers
106 views
CORS returning two Access-Control-Allow-Origin headers?
I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
3
votes
1answer
63 views
Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github
I have been working on a code review of a project. The source code is publicly available on Github.
I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
-1
votes
1answer
122 views
Malware Testing on a Virtual Box
I would like to test some malware on a virtual box but I can not seem to figure out a safe way to get the malware on the virtual machine.
I was thinking maybe I could download it while I am on the ...
6
votes
1answer
434 views
Find Security Flaws in My Payment Page
I've done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment ...
9
votes
3answers
452 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
2
votes
0answers
91 views
Guideline/Standards for Valid Penetration Testing
I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid ...
0
votes
1answer
152 views
Import Wireshark Cookies into Firefox?
I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies.
Greasemonkey and ...
0
votes
0answers
26 views
Suggestion for intercepting traffic with android app [duplicate]
Are there any tools that I can use to intercept the traffic of android app? I tried Charles proxy and Burp suite but they only support HTTP/HTTPS traffic.
I have to pentest a game, basically it's ...
1
vote
1answer
54 views
How to add a cookies parameter to Dotdotpwn script [closed]
Do you know how I can add a specific cookie parameter like "access token" to dotdotpwn script?
Without this, I have that output "Web server (xxxx) didn't respond !"
1
vote
1answer
112 views
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it:
The ...
6
votes
1answer
521 views
Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)
I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
2
votes
1answer
302 views
Use netcat to Pivot
So I have a shell into machine A which doesn't have ssh installed and I can't get a tty shell on (I've tried all of the tty cheat sheets, I think this is intentional)
Through machine A I can see ...
8
votes
1answer
857 views
How to report unsuccessful attacks to the source network admins? [duplicate]
I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic.
I have set up a web store via WordPress using WooCommerce and ...
1
vote
1answer
107 views
How does Client-Side-Exploitation get the System-level-shell in Metasploit?
For example, if my client is using a vulnerable Internet Explorer which was vulnerable to the Aurora Vulnerability (I know its old and patch, but for now, let's assume) then I use Metasploit Client-...
1
vote
0answers
32 views
Is it possible to circumvent (ignore) routing table without root permissions?
The local host is configured to send all non-local traffic to a restrictive firewall VM configured in the routing table (route).
Preliminary scanning shows that other routers are available on the ...
1
vote
2answers
51 views
How to scan allowed outbound (destination) ports on the local host?
Without access to firewall rules, I want to scan allowed outbound (destination) ports on the local machine.
I would take too long to start a netcat listener for each of the destination ports on a ...
3
votes
1answer
157 views
Is it a good idea to test a live company website as part of an interview process?
I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
