36
Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...
26
Kali linux is a distribution designed for penetration testing and computer forensics, both which involve password cracking. So you are right in thinking that word lists are involved in password cracking, however it's not brute force.
Brute force attacks try every combination of characters in order to find a password, while word lists are used in dictionary ...
26
Any time you execute code acquired from someone that you haven't fully reviewed and it runs on an Internet connected system, there is a risk that the person who wrote or deployed that code could transmit data about your usage to another system. That's true regardless of the OS. So yes it's possible.
The question then becomes "has this happened in the past",...
16
I have been using Backtrack for 2 years and I have heard no news of any spyware or 'phoning home'.
Also, have you seen the photos of the NSA using Backtrack?
Metasploit and w3af actively work with the curators of Backtrack, which shows some level of confidence in the distribution.
Also, with the number of people running packet sniffers attached to ...
16
Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code:
This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically.
An academic paper ...
15
To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often.
To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes.
The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...
14
When in NAT mode the network subsystem of the hypervisor operates by modifying the packets as they leave the host. Assuming TCP/IP over ethernet, the components definitely changed are:
source address
source MAC
usually the TTL
often the source port
Sometimes other TCP flags will get modified as well such as DF, Window size, etc.
In a well behaved network,...
12
The split into one or several partitions is not really a problem of security but of reliability. The idea is that if one of your partitions is crashed, then you lose the contents of that partition, but the other partitions are fine. Also, if you fill up that partition, then other partitions are unaffected. Each partition can have its own filesystem, and not ...
12
In typical pentesting, Kali is just another tool, it's insecure by default, and is never recommended to be run as your primary OS without some serious baseline hardening. It's typically launched (as a virtual machine) when needed and "paused" or "stopped" when not. This helps keep your host (and files) protected.
Additionally, Kali is known to have bugs ...
12
You must install some stuff. The same happened to me. But you can work with new hashcat 3.x and CPU in your vm, no problem on that:
apt-get install libhwloc-dev ocl-icd-dev ocl-icd-opencl-dev
And
apt-get install pocl-opencl-icd
This worked for me. I found it here. What I suggested It's a little different because you can install pocl with apt-get instead ...
10
Pen testing is a delicate and potentially fraught undertaking, and not the sort of thing to teach yourself on-the-job.
Beyond just leaving footprints, I'd also be worried about accidentally leaving destruction behind, or accidentally overstepping the limits of your target set.
Rather than being afraid of your peers, you ask them to assist on your first ...
9
Quick side-note: BT5 is no longer the latest - you should look into Kali Linux.
There is no "best" OS for testing. You should always choose the tool that's most appropriate for the job.
A few thoughts:
The OSes designed for penetration testing are usually laden with tools, which is nice and convenient, but tend not to be designed for long-term stability.
...
8
What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple.
The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each ...
8
One of the better basic wordlists in Kali is /usr/share/wordlists/rockyou.txt.gz. To unzip simply run gzip -d /usr/share/wordlists/rockyou.txt.gz.
Be sure to add "known weak" passwords that are used by the organization you are testing. I like to add these "additional" custom passwords to the top so they are tested first.
8
The process you've described should result in handshake packets, assuming that the deauth packets are successful in forcing the device to re-attach to the network. A couple of suggestions.
I'm guessing that placement of all the devices is ok (e.g they're quite near to each other physically). If the device in monitor mode is further away there's always a ...
8
#/etc/init.d/postgresql
service --status-all
service postgresql start
service postgresql status
#/usr/bin/msfconsole
msfdb init
msfconsole
msf > db_status
8
Shikata Ga Nai isn't a payload, but an encoder. The payload is the reverse shell.
Metasploit offers several encoders, Shikata Ga Nai being one of them. An encoder attempts to overcome detection by AV, network intrusion detection, and keep characters that can cause a crash of the victim out of the payload, like null bytes.
7
Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...
7
The main reason is because you need the adapter to support monitoring mode.
This mode allows the adapter to not only sniff all packets coming from the AP to the clients but also from sniff the data from the clients to the AP.
Can I use my WiFi USB adapter as a WiFi interface in my Kali VM ?
You can use it to get WiFi access but it will not work with ...
7
This is perfectly normal. ocsp.digicert.com is the server used to verify if an SSL certificate issued by DigiCert got revoked. This is done using the OCSP protocol.
For example the certificates for mozilla.org or addons.mozilla.org are currently issued by DigiCert. This means it will likely check at startup for extension updates and/or browser updates by ...
6
Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit.
In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...
6
In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.
6
At this point you've achieved the basics of a compromise on the system and you're on to the common phase two of exploitation which is privilege escalation.
Exactly how you can achieve that depends very much on the system in question, what code is installed on it and how it's configured. Some options for things to look for to get privilege escalation on a ...
6
More or less, yes. Some things that might be different:
You will not be able to use layer 2 scans (like ARP scans).
If I would give you my public IP address, that would be the address of my router, and not my PC. Depending on the port forwarding settings on my router, you will most probably not be able to scan my PC directly, but only my router. That would ...
6
As a developer of Kali, I can attest that this answer is very wrong. Kali is not insecure by default, and has the same security standards as Debian in a default installation. Kali is a Linux distribution aimed at Penetration Testing - as opposed to casual browsing or day-to-day computer activities - which is why some people prefer running it as a virtual ...
6
Kali is a community-built distro full of security tools from both organisations and individuals. It is not designed to be used as a day-to-day operating system. It's a quick-start, throw-away distro for security testing.
Metasploit and Kali Linux are entirely different things. In fact, Metasploit is installed on Kali by default. I suggest you read up on ...
6
Using a dictionary isn't going to increase your rate of attempted cracking, as the program still has to take the input, apply whatever hashing algorithm is required, and then compare with the password to be cracked.
The use of a dictionary is that if the password is the same as one in the dictionary (or similar if you're using mangling rules), you'll find ...
6
Kali is mainly for pentesting. It is not supposed to be used as "desktop distro". As far as I know, there is no antivirus and because of tons of exploits built-in you would destroy the whole distro by just installing it.
I would recommend to used it like:
Install, Update, Setup, Image then
Do a pentest / reimage,
Update, Image if updated
do a pentest ...
6
As stated by @RoyceWilliams, it does not seem to use CUDA. For this purpose, you might want to look at Pyrit, since it leverages CPUs and GPUs on the cracking process.
NB: I wanted to leave this as a comment but I still don't have enough reputation.
6
Whether booting from a USB thumb drive might hurt your system is off topic here - (and no).
You should not use Kali as your day to day operating system. That is not what is meant to be. From a security standpoint, it is a horrible idea to use Kali (which on the live version has only a root user and outdated software that has no security fixes applied unless ...
Only top voted, non community-wiki answers of a minimum length are eligible
