Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
0answers
14 views
What are some accredited security product testing and validation firms? [on hold]
I'm looking for someone like NSSLabs, Synack, Tevora, but obviously not these companies.
0
votes
1answer
16 views
XMAS Scan vs Inverse TCP
Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing?
XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
2answers
37 views
How do i extract data from response and use it in url for next request in Burp Intruder?
The URL is https://www.example.com/send?session=abcabcabc.
When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
0
votes
1answer
31 views
Metasploit Bruteforce Errors [closed]
I use metasploit pro for penetration testing. For one of the servers, i was running bruteforce check. While checking, i received these errors. Can anyone tell me if someone has come across such errors ...
0
votes
2answers
33 views
AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation
I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture.
We are using components such as AWS Lambda, AWS ...
0
votes
2answers
37 views
Australia's Legal Do's and Don'ts of Hacking [closed]
Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
5
votes
2answers
286 views
How do I monitor what a penetration tester is doing?
Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep ...
1
vote
1answer
57 views
How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?
I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
-1
votes
0answers
33 views
Is it safe to output logs in Logcat and if not then how is it vulnerable?
I am pentesting an android app that is storing user credentials in itself for further uses.
Suppose I submit the "credit card no" using submit button, it is showing up in logcat in clear text. Is it ...
2
votes
1answer
151 views
Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?
From this Quora answer:
Years ago when I was in China I was getting updated on cyber security
from one of our partnerships.
We were going over everything from basic hacks a 9 year old could ...
2
votes
0answers
50 views
How to identify the communication protocol used in a wireless device?
I really hope that this is the right place to ask.
I need to analyze a baby monitor for any security or privacy weaknesses.
The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
-1
votes
1answer
44 views
msfvenom produces different op codes when format is given with 'c' instead of 'python'
I still do not understand the msfvenom format ( -f ) parameter regarding the resulting op codes. I do not understand why a payload consists of different op codes when the format ( -f ) is different, ...
0
votes
2answers
57 views
PHP Code Injection vulnerability exists even after recommended hardening
Using Burp to intercept traffic and inject code we have identified
remote code execution vulnerability in a website. After entering data
in input fields on the form and clicking submit the traffic ...
1
vote
0answers
15 views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
1
vote
0answers
87 views
Custom payload SQLMap from OWASP Zap vulnerability report
I ran OWASP Zap over my site.
In the vulnerability report I read that there is an SQL injection problem:
Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment)
(see img for ...
1
vote
0answers
42 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
0
votes
1answer
78 views
What information should I provide to third party pen testers - (black box penetration)
I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
0
votes
1answer
91 views
Why it best to do security testing on a copy on a Virtual Machine rather than on than the live server? [closed]
Why is it better for a security tester to take a copy of a server e.g. eBay server and test it on a virtual machine rather than on than the real eBay server?
E.g. doing security testing on the live ...
1
vote
1answer
113 views
Reverse PHP shell disconnecting when netcat listener
Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565
Rather than rely on Metasploit or Meterpreter to ...
-4
votes
1answer
177 views
How does testing on a Virtual Machine prevent the security tester from breaching the misuse act? [closed]
Why is it better for a security tester to test a virtual copy of a server e.g. eBay server and test it on a virtual machine rather than on the real eBay server?
E.g. Doing security on the real server ...
1
vote
1answer
95 views
SQL injection with an auto-incrementing parameter
I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.
...
0
votes
1answer
124 views
What all test cases/vulnerabilities we need to try in REST API Pen testing?
I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API.
I have gone through the OWASP resources ...
0
votes
1answer
47 views
Testing Package Leakage at the Router [closed]
I'm home learning a course/certificate for pen-testing and security analysis. I came into a part in the process of pen-testing Perimeter Devices, specifically at testing the Router.
At this point I'm ...
0
votes
2answers
79 views
XSS alert not working with concatenated string
I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:
<img src=0 onerror=alert(document.domain+": "+Date.now())>
This doesn't prompt an alert box. ...
2
votes
0answers
43 views
Pentest website available through per app VPN
I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
0
votes
2answers
72 views
How can pentest reports contribute to structural solutions for vulnerabilities?
When you do a pentest what is your recommendation to the client on how to handle/interpret the report?
What I frequently see is that identified issues - especially issues related to self developed ...
0
votes
2answers
78 views
Web App or Web Services testing?
I am trying to clear up a doubt on security testing.
If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
1
vote
2answers
139 views
A computer on the public network I was using was penetrated at a codejam. Am I at risk?
I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
0
votes
2answers
194 views
I couldn't deauth any devices using aireplay-ng command in kali linux
I am using Kali linux. I've updated all tools and services by apt-get update and apt-get upgrade.
I was using aircrack-ng for pentesting my wlan network.
I wanted to deauth any device connected to my ...
2
votes
1answer
62 views
Can't log in dvwa with a simple python program, even though login credentials are good
import requests
target_url = "http://127.0.0.1/dvwa/login.php"
data_dict = {"csrfmiddlewaretoken": "bbbfeed6e1aea50f14a51a331054022c", "username": "admin", "password": "password", "Login": "Submit"}
...
0
votes
0answers
51 views
Pentesting web application with WebRTC video chat feature
I'm pentesting a web-application that uses peer-to-peer WebRTC for video chatting. I haven't come across this yet, so I'm a tad lost as of how to tackle this.
How can I verify the WebRTC ...
1
vote
0answers
42 views
What might an attacker do with email address as login name?
This might have been asked before, but I've looked for a few hours and can't find much.
I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
2
votes
2answers
56 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
-1
votes
3answers
74 views
Introduction Ethical Hacking [closed]
0 knowledge on ANYTHING, square 1 basically. Where can someone start and lead into the general direction to start off a career in this profession.
-1
votes
2answers
87 views
How can i access any useful information in a wordpress site?
While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here:
https://www.exploit-db.com/exploits/45439/
I used it and ...
2
votes
1answer
55 views
How do you test buffer overflows in the lab?
I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
2
votes
0answers
82 views
OWASP Testing Guide Equivalent for Desktop Applications [closed]
I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications?
I had no luck searching the Internet.
I am looking for something ...
2
votes
2answers
87 views
Kerberos unconstrained delegation for user
I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
1
vote
2answers
134 views
POST Method Anti-CSRF Help With Burp Suite
I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
-1
votes
0answers
37 views
Cross Origin Resource Sharing null vs wildcard?
I am testing an application that uses widget. These widgets are placed in the customer websites to use as some sort of tracking clicks device and returns some data too, therefore it is necessary to ...
1
vote
0answers
100 views
How to run Metasploit WMAP on site that requires SNI
Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
0
votes
0answers
46 views
How to run command as privileged Windows service account against Active Directory domain controller?
I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test).
Since the account is a service account, it cannot be ...
-1
votes
0answers
47 views
Local Group Administrator Account shared across network?
I am a bit confused on the local group administrator account role. I managed to obtain domain administrator on a recent pentest but looking back at my results I am somewhat confused the actual ...
-2
votes
1answer
55 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
0answers
71 views
Wifi Pineapple - How would Karma or PineAP silently log probes from individual clients, *without* broadcasting beacons?
With the intention of silently gathering information about a client's environment, how would one utilize Karma and PineAP to log probes but not broadcast / reply with beacon packets?
In the test lab, ...
0
votes
2answers
96 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
1
vote
2answers
212 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
3answers
298 views
Pen testing - How to use credentials without remote desktop?
I'm a junior penetration tester, working in a place that does not give much guidance and I kind of just had to dive in. I'm pretty good, in that I can normally still obtain domain admin on networks I ...
0
votes
1answer
84 views
How is my employer accessing my router when employer's laptop is wirelessly connected to my home network
I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0
votes
2answers
40 views
/cron path found when testing site
I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
