16

Email accounts are not private, so there is little risk to discover a certain address. The same thing could be accomplished by sending an email to random accounts and see what bounces back. Email account enumeration is not the risk as much as true user enumeration is.


15

Let me give you an example of a hypothetical yet very plausible scenario. There is an aspiring hacker named Bob. One fine sunny morning, Bob found an SQL injection flaw in a popular social networking site named HandBook. Using said SQL injection flaw, Bob managed to dump the a list of email addresses and passwords of accounts registered with HandBook. Given ...


14

I think you might be assuming that the kits are more complicated than they are. A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best exploit. It can just attempt to exploit what it is designed to exploit. Some kits will attempt one method after another in series until something works. For ...


11

Based on the MSRPC DCE-RPC IFIDs from the first command output you posted, the target appears potentially vulnerable to MS00-070, CVE-2000-0544, CVE-2001-0662, CVE-2002-1561, CVE-2003-0533, CVE-2003-0818, CVE-2004-0894, CVE-2005-1984 (Nessus 19406 and 19407 as well as CANVAS ms05_043 and CORE IMPACT MSRPC SPOOLSS Buffer Overflow), CVE-2005-2119, CVE-2006-...


9

This is old lore. In older times, people were using mainframes and very poor passwords, so protecting account names was "important": if an attacker knew the name of an actual user, then he could try passwords, and, at that time, trying a few dozen passwords tended to work. Of course, this was unsatisfactory, because user names are not really secret ...


8

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these. You can use BuiltWith.com. Here are some examples of it is use: Joomla.org being positively identified as Joomla Wordpress.org being ...


8

This is current best practice, as recommended by OWASP. One thing often overlooked though is that the return values should be identical - the layout and underlying HTML code for a page should be the same for each. It's not enough just to provide the same message if you can open the page source and see a comment <!-- Failed password --> or <!-- ...


7

Unless the site now has access controls on the URLs (requiring that you first authenticate - prove your identity - and then that the server checks whether your identity is authorized to view that URL), no, it is not safe. Obvious problems include people sharing links through a site like this (without redacting the domain), browsers remembering the URL in ...


6

My personal experience with ReCAPTCHA (widely regarded as being one of the best) is that it took about a week after we added it before the spammers we were trying to prevent figured out how to solve them. They don't solve 100% of the presented images correctly but they don't have to. Even getting one in every ten correct would be fine for them and they are ...


5

Check this out. An attacker can see what services are running on the machine. This information can be very useful for planning and launching an attack.


5

If you insist on talking HTTP through telnet, a proper HTTP server won't answer you before you're sent two consecutive line feeds, effectively ending your request: GET / HTTP/1.0 <empty line> If the service starts answering you before sending the empty line, it's not speaking proper HTTP, and may be something else entirely. I'd suggest using a tool ...


4

Math.random() is usually seeded from the current time of day. Therefore there is a chance that collisions will happen for objects that are generated around the same time each day. From a security perspective, this means that these "random" values will be predictable by an attacker. Even if seeded with something else, a non cryptographically secure pseudo ...


4

Yes, but not efficient user enumeration if they rate limit requests, require evidence of humanity, or lie with increasing probability after a number of requests. Besides, most large webmail systems rely on heuristic spam filters instead of the unguessability of email addresses to limit the amount of spam that reaches your inbox.


4

First, have a look at http://dnsviz.net/d/gggg.icann.org/WVLgMg/dnssec/ it may help to have things displayed graphically and over your mouse on top of the NSEC3 record at bottom to see all details. NSEC3 is far more complicated than NSEC (and NSEC5 is far more complicated - but not yet deployed anyway - than NSEC3), and the behaviour will not be the same. ...


4

I believe the kind of tool you are looking for is called a "web fuzzer." A quick search turned up an open source tool called wfuzz, which contains a folder called wordlist which has lists that seem to be pretty close to what you describe.


3

Thanks guys for your help ! Stranegly I was able to identify what is running on that port just by opening this netcat connection "nc -nvv x.x.x.x 25" and waiting for a while without any interaction with the victim. After doing this, the banner popped up and it was running Sendmail. It seems that it has been configured to slow the response to prevent ...


3

If an attacker is doing a social engineering attack. The attacker could put a victim email address inside the login form. Then we will be able to know if the victim is registered or not under a specific email. If the victim is registered to a web site, the attacker would create an account on that web site and he would try a social engineering attack. I don't ...


3

From a DNS perspective, if Zone Transfers are not allowed the main ways to get similar information (i.e. information about valid hosts in the domain) would be either reconnaissance in search engines or using brute-force attacks to guess valid host names. The search engine piece is relatively self explanatory. You search for information relating to the ...


3

Check out DirBuster where you can feed wordlists and it'll try to brute force file and directory names. Nikto also checks for commonly used folder and file names on a web server. It is not possible to check every file and folder name, however running the above tools will give you a decent amount of enumeration.


3

You are performing a SYN scan or TCP connect scan (depending on your account permissions). With those scan types, you can receive the following port states based on the results of the TCP handshake: open: An ACK packet was received, indicating that the connection was accepted. closed: A RST packet was received from the host or firewall, rejecting the ...


3

Yes. A crytographically secure RNG is necessary to accomplish all the things you listed. I don't know how Math.random works, but think of a TERRIBLE RNG we'll call 2bitRNG that's seeded with just 2 bits, but produces 128 bit numbers. I seed 2bitRNG with my 2 bits of entropy, and then produce 10,000 random numbers with it. Since I've only seeded it with 2 ...


3

There are a lot of possibilities for that: 1- No ports are really open other than 80. 2- Firewall is not blocking your IP but it might be evade your results and this only with advanced firewall. 3- NMAP by default scans only 1000 TCP ports and there are other open ports so make sure to scan full TCP & UDP port range.... namp -sU -Pn -p 1-65535 will ...


3

Strongly consider converting to 2FA emails for first-time computer registration. "Dear Andy Savage, we've noticed this is the first time you've used this browser to log in to our service. To help keep your account safe, we've sent an email to your registered email address at a****e@g****.com. Please click the link in the email to confirm this really is ...


2

tl;dr: That depends, if you can, use a CSPRNG. While often UUIDs are used which are not (bound to be) from a CSPRNG, this might not be a good idea in cases the (not CS)-PRNG is not re-seeded regularly (as in long-living server processes) If the algorithm you use to create such identifiers is known, and it's input can be estimated with a few samples (as it'...


2

Your assessment of the risk is correct: leaking this data could facilitate an attack by helping the attacker collect information. So even if there is no direct risk, it could speed up the information gathering phase of an attack. If you have any concern, the usual solution is to sanitise your responses as needed - you could replace those 403's with 404's ...


2

When I try to pentest I like to use hping3, which you can install it very easily: apt-get install hping3 Then for bypassing firewall: hping3 -S 192.168.1.1 -c 80 -p ++1 If port 25, 53 or 80 is opened, it will give you result as this one: len=46 ip=192.168.1.1 ttl=54 DF id=0 sport=25 flags=SA seq=24 win=29200 len=46 ip=192.168.1.1 ttl=54 DF id=0 sport=...


2

Basically you just need to force a user on that network to disassociate with the wifi, then when it reconnects, the ssid will be transmitted in plain text. Check out this guide. http://www.thelinuxgeek.com/content/find-hidden-ssids


2

During procurement, have Finance and/or Internal Audit create and maintain a formal asset-registration process. All people managers must receive all procured devices/software and each approved vendor must provide a list of inventory services. Gaps in the inventory services automatically provided from the VARs must be filled in by the people managers using a ...


2

From the outside, there's no generic method. A site can have as many (possibly obfuscated) endpoints as they wish. You could, however, get lucky if there is an automatically generated site-map; it might just include a list of endpoints. From the inside, it's possible. It can be labor-intensive, depending on how the site works. If you have access to the web ...


Only top voted, non community-wiki answers of a minimum length are eligible