Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1,201
questions
1
vote
4answers
63 views
Adding to the query string via input
I have a form that takes multiple input fields and makes an API request via GET.
The fields are not properly sanitizing input and I am able to add arbitrary parameters to the query string by ...
0
votes
0answers
27 views
Aireplay-ng works fine from command line but can't deauth from inside Fern Wifi Cracker
I have Kali Linux 2019.4 ARM-64 installed on a Raspberry Pi 3B.
I have installed the Fern Wifi Cracker software. When I launch the "Wifi Attack" from inside Fern, I can see Aireplay-ng sending Deauth ...
1
vote
1answer
70 views
Security in web sockets
Scope: penetration testing of web server with critical information in it (user management).
I had an argument with my college about security in web sockets and I got stuck with him in one topic, ...
0
votes
0answers
38 views
How can Lingering Object Liquidator be used on a penetration test
How can Microsoft's Lingering Object Liquidator be used as part of a penetration test? I am a junior penetration tester, and saw a discussion between more senior pentesters discussing using LOL to get ...
5
votes
3answers
123 views
What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?
I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
2
votes
2answers
82 views
Is there practical risk to having UDP ports open?
I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports
Suppose you're pentesting some small organisation and you found a couple of ...
1
vote
0answers
77 views
Is Social Engineering out of scope unless explicitly requested? [closed]
I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
0
votes
1answer
81 views
Penetration testing from a phone
Suppose that I use a smartphone with an external WiFi adapter to cover up my real MAC address and on top of that I use a no-log VPN. In what way could I still be identified? I have heard a lot of talk ...
1
vote
1answer
37 views
Should we do request manipulation or network packet manipulation for SDN vulnerability analysis? [closed]
I am planning to do vulnerability analysis of a Software Defined Network. Since the connection between the business apps and the controller of the SDN would be done over the application layer, I would ...
1
vote
1answer
132 views
Is an OS more vulnerable while it is being updated?
Are there any additional attack vectors that apply when an OS is being updated? For example, would the services that are being updated be unstable?
An OS is generally more secure after being updated, ...
0
votes
1answer
101 views
What is next step after nmap + metasploit? [closed]
When I'm working on hack boxes, what I do (if not using Armitage) is:
nmap the box to discover running services version
search metasploit to find a working exploit for that version
Now I'm stuck. ...
0
votes
1answer
50 views
Is RFI still a viable attack vector?
So, I know Remote File Inclusion bugs are practically dead within modern PHP applications since register_globals and allow_url_includes are disabled by default in php.ini (ever since php5x I believe?) ...
0
votes
1answer
54 views
How to prevent Directory Enumeration Attacks (DirB or Directory Buster)
I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
0
votes
1answer
67 views
OWASP ZAP submit forms
I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:
I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
0
votes
1answer
79 views
Command Injection DVWA (1.0.7 iso version) High Security level
I am practising on an older version of DVWA (1.0.7 iso image). In High Security settings, I am trying to perform command injection and this is the source code snippet I saw
$target = stripslashes( $...
2
votes
0answers
86 views
Where is the line drawn for ethical hackers using stolen credentials in their paid services? [closed]
When “ethical” hackers/pen testers harvest repositories of stolen credentials to then use them in pen testing for paying clients, what ethical boundaries are broken?
If a lazy hacker leaves their ...
2
votes
1answer
146 views
What do I do if I catch someone doing a physical pentest? [duplicate]
This question was primarily inspired by this (related) question, but is about the other side of the equation.
I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
-2
votes
1answer
71 views
Can employees' personal properties be part of the scope? [closed]
Let's assume the customer (target) wants to have a full physical pentest done.
(I'm a student and have 0 exp in actual Pentesting and Red Teaming
Properties of topic:
Cars (in the car park)
...
1
vote
0answers
125 views
SQL Injection only with OR
I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening.
The following behaviours is what I noticed:
Entering ' OR '1' = '1 shows all the results.
...
37
votes
2answers
12k views
Should I present forged documents in a Penetration Test/Red team engagement?
A previous question of mine lead to this discussion which mentioned the subject of Document forgery.
I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...
1
vote
0answers
55 views
Blogs and stories on Pentesting and Red Team engagements [closed]
I'm learning and thriving to be a Red Teamer. I'd like suggestions for stories and blogs to read on real Red Team/Pentest engagements (or just realistic one) such as this.
The subject can be in any ...
34
votes
1answer
5k views
How to deal with third parties in physical pentests?
From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
129
votes
2answers
21k views
What to do if caught in a physical pentest?
I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement".
Red Teams are ...
1
vote
2answers
90 views
Monitoring the HTTP(S) calls being made from android App
I want to test for security vulnerabilities in an Android App and hence want to monitor all HTTP(S) calls being made from an Android App.
I have setup BurpSuit in my Laptop and have also set up the ...
8
votes
1answer
562 views
Some doubts about SQL Injection examples, how exactly works?
I am a software developer starting studying application security and I have the following doubt related SQL injection.
I am following a video course and there are these two examples:
I have an ...
2
votes
1answer
270 views
Active Directory Pentesting Methodologies
I would like to ask about steps and methodologies for Active Directory pentesting. I used tools like responder, powerview, pingcastle and mimikatz, but maybe there are other methods that are useful.
44
votes
9answers
8k views
I have just 4 hours a month to security check a cloud based application - How to use my time?
I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month.
I essentially have half a workday to secure this application / keep it secure. What is an ...
0
votes
0answers
22 views
Exploiting Weak Permissions on OU in Active Directory?
I created an environment, where I allowed a user named demop with these four permissions
CreateChild
ListChildren
ReadProperty
GenericWrite
on an OU named VulnerableOU? And, I have Meterpreter ...
0
votes
1answer
55 views
can you have reflective xss through a POST parameter?
While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
0
votes
0answers
77 views
What is the best practice to run Openvas on Azure?
I have created a Kali VM on Azure to use for my pentesting engagement. I was able to access Openvas GM from my desktop, however I could not log in the GM even though I reset my GM password again and ...
0
votes
1answer
220 views
nmap: Same IP, different domain names, different results?
I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return ...
1
vote
1answer
151 views
SMS not received and read by somebody else (no SIM swap)?
A friend of mine was phished for his credit card details and driving license. Very foolish, I know. The criminals then bought bitcoin. The fact is his card is VbV. He claims not to have received any ...
1
vote
1answer
79 views
Is sending an object created via intent.getSerializableExtra to handler.postDelayed leading to Code Execution?
I'm new to android pentesting and I would like to know :
if sending an object created via the result of intent.getSerializableExtra("EXTRA_TEST");
to handler.postDelayed(TheObject,500) could lead ...
1
vote
1answer
340 views
HTTP request smuggling, basic TE.CL vulnerability
Im trying to learn about http request smuggling and Im trying out the labs for burp suite. Im stuck on the TE.CL vulnerability, Ive clicked on the solution (see below:https://portswigger.net/web-...
-1
votes
1answer
75 views
What is “Map Execution Paths Through Application”?
I am reading the OWASP Test Guide v4 to learn how to pentest a web application. In the documentation, there is a section called "Map execution paths through application (OTG-INFO-007)".
I'm not sure ...
1
vote
1answer
207 views
Is it possible to gain RCE from Arbitrary file write by an unprivileged user?
I am pentesting a PHP website running on Apache in a Ubuntu server.
I found a vulnerability that allows me to write files to the target system.
I know it's possible to write a php shell to the HTTP ...
1
vote
1answer
39 views
Test the XSRF patch on a GWT application
We have a huge GWT application, which was never tested for security and now we would like to patch it with some of the "best practices" we have found on the GWT website.
One of those patches is ...
0
votes
1answer
322 views
“I hacked my way into this interview”: Is this a good idea for getting a job? [closed]
There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec.
If I somehow find a "...
1
vote
0answers
87 views
Regex DoS: Is OWASP's characterization of “evil regexes” complete?
OWASP defines "evil regex" (here) as follows:
Evil Regexes
A Regex is called "evil" if it can stuck on crafted input.
Evil Regex pattern contains:
Grouping with repetition
...
0
votes
1answer
100 views
How to get gain the knowledge to be a beginner penetration tester on my own? [closed]
I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer.
I started to work with Burpsuite, ZAP, ...
1
vote
0answers
66 views
Security aspect in the API gateway area
I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level.
Scanning REST APIs
(see http://docs.w3af....
39
votes
5answers
9k views
Pen test results for web application include a file from a forbidden directory that is not even used or referenced
In a recent pen test of a web application one of the issues found was a 'backup file'. This was a javascript file that was renamed to filename.js1 when an updated version of filename.js was uploaded.
...
1
vote
2answers
167 views
Terminate a javascript without “continuous” < and / [closed]
So I am testing a website and found out I can inject most characters, here is what I have found:
" is always escaped with \"
< and > are not escaped
Interestingly, / is only escaped with / if < ...
0
votes
1answer
112 views
Free/online penetration testing tools [closed]
My employer has used an external consultant for penetration testing. The web development team not involved in the pentesting itself and we only received the results and suggestions on how to improve ...
0
votes
1answer
57 views
How to check vulnerable component and its version in any APK?
I have given an app to test, on which I ran a quick scan in composition tool like Protecode, It shows all component (like okhttp, protobuf,okhttp etc.) used and existing vulnerability.
My question is,...
1
vote
1answer
518 views
Path Manipulation Vulnerability
Currently I am working in code review process.
I have few doubts regrading Path Manipulation Vulnerability.
Some portion of the Path is already hard coded and with extension
public class ReadFile {
...
4
votes
1answer
178 views
ActiveDirectory PenTest Help [closed]
I'm popped in the middle of the domain with what appears to be a VERY solid network. Good policy, good security, a lot of the usual tactics won't work. I cant pass-the-hash, find any SYSVOL loot, or ...
0
votes
1answer
63 views
Security test within a staging environment. Is SOAPUI sufficient as a test tool?
Currently I am working on a project in which I am supposed to define the following aspects as a test manager:
Conception of a penetration test for a test staging environment
Planning security ...
-1
votes
1answer
42 views
Sack team_id leaking in source code [closed]
I found slack team_id in vdp source code, is it a sensitive token if yes how can I use it for a PoC?
0
votes
1answer
99 views
Adding Floating point operations to fuzzing?
During analysing a software testing paper I read
We plan to add floating-point operations in order to extend fuzz testing capability.
What kind of benefits I can expect from adding floating point ...
