The process of collecting information about an intended target of a malicious hack by probing the target system.

learn more… | top users | synonyms

2
votes
3answers
98 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
4
votes
4answers
114 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
3
votes
2answers
167 views

How to map a network passively with wireshark dumps?

I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information -...
3
votes
2answers
81 views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
77
votes
6answers
9k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
6
votes
4answers
516 views

How to identify a company's public network address range?

Which tools or websites can I use to identify a company's public network address range(s)?
0
votes
1answer
295 views

How to find Windows version from the file on a remote system

I need to find out what Windows and Service Pack system is currently running. All I have is ftp access, it means I cannot run any the software. Is there a way to determine what version of Windows, ...
0
votes
2answers
103 views

Is there a tool to detect what technologies a website uses? [closed]

I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site. For example that the site is running Apache, using ...
3
votes
0answers
75 views

Extra p0f v3 fingerprints files?

p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the ...
1
vote
1answer
58 views

Is using a website copier considered active reconnaissance in penetration testing?

New to PT and would like to test recon skills. First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
4
votes
2answers
1k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
6
votes
1answer
197 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
3
votes
2answers
198 views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
1
vote
2answers
135 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
0
votes
2answers
76 views

Deniable discussions online [closed]

Consider this scenario: Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
1
vote
0answers
93 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
1answer
76 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
2
votes
1answer
184 views

Does OpenSSL leave any traces that a server uses it?

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL? -- Clarification: Speaking in terms ...
1
vote
1answer
232 views

Does shodan JSON API use my IP address?

I want to find out if shodan uses my ip adresse to query the target after sending this HTTP request: https://api.shodan.io/shodan/host/{target_ip}?key={MY_API_KEY} so is shodan API a passive or ...
1
vote
1answer
1k views

Spoofing OS during browsing

I am using http://www.mybrowserinfo.com/ to gather some info about me while browsing. I want to change my OS to appear that its a Windows Xp machine.(No VM solutions please:D) If you have any ...
3
votes
1answer
1k views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
2
votes
1answer
819 views

OS fingerprinting protection - why not by default?

This article describes how to fool nmap in it's OS fingerprinting detection. In short, nmap sends malformed packets to open and closed ports and listens to the responses. Because every OS implements ...
7
votes
3answers
6k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
21
votes
5answers
29k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...