152
There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues:
File extensions: login.php is most likely a PHP script.
HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page ...
39
Your first question is really a legal one, and you seem to be assuming two things:
The attacker is a government of some sort.
That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys.
Neither of those assumptions are necessarily true. For all you know, some random ...
35
The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...
26
The easiest way would be using several databases. Tools like KeePass allow you to store passwords in different files. You could for instance opt to store your passwords in seperate databases based on client or purpose.
22
There are automated and manual approaches.
For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions.
For manual - you could build a threat model of your app and run it through OWASP ASVS checklist starting from it's most critical parts. If there is file deletion in your ...
20
You either do it yourself or trust someone else
As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and being competent enough to properly perform the task.
For example, you could file your taxes yourself or trust a tax adviser to do so (who not only should not ...
19
You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...
19
For guessing the programming language, you can follow the three steps approach detailed below:
STEP 1 - Search evidences on the site itself
Manually...
Search on a site page at the bottom for phrases like:
-> "Powered by XXX"
-> "Proudly Powered by XXX"
-> "Running on XXX"
-> ...
Search on the site if it will attend any conference where they ...
19
You want to increase signal and reduce noise during a pen test?
Great! Here are some things to ponder on:
For answers to the questions you have -- are they already answered somewhere else? For example, does Nmap data from a previous pen test provide an accurate-enough view of the data you would expect today? Would csrecon or similar provide that data? If ...
17
It's simple. Add Wapplyzer extension available for Chrome as well as Firefox.
It tells about programming language, server, analytics tool or about CMS & Frameworks on which website is built.
Give it a try, you will love it.
14
Using nmap:
sudo nmap -O <target>
Or if they block your ping probes you can do:
sudo nmap -O <target> -Pn
Sometimes you still get fake results and you should try doing an aggressive scan (can be detected and blocked by the firewall).
sudo nmap -A <target>
13
What you are trying to do will be... difficult. The main point is that at the end of the handshake, client and server send each other Finished messages, under the protection of the just-negotiated algorithms and keys; and the contents of these messages are hash values computed over all the previous handshake messages, including the ClientHello and ...
13
You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a decent speed. If you want to avoid detection, you must either make fewer requests, or make them more slowly.
Have you tried running tools like Snort, Bro, or ...
12
For your exact use case, I personally use Lastpass. The killer features of Lastpass include the ability to compartmentalize and separate each client's passwords from each other and from my own. They also have in my opinion the best browser addon integration and the data can be stored and used offline as well.
I like to increase the password PBKDF2 ...
9
Most access control / authorization flaws would never be found by a (generic) tool, because it does not have the understanding of what is supposed to be accessible and what not. (Having said that, experienced pentesters probably know that quite a lot of applications also don't have this documented...) So that is an example of a whole class of problems.
Any ...
8
Besides the Wappalizer browser extension, there are several sites that detect what technologies power a given website:
http://builtwith.com/
http://onlinewebtool.com/cmsdetector.php - for CMS detection
http://guess.scritch.org/ - Detect CMS, web framework
8
Several reasons:
reduce testing time
automation
clear methodology
consistency of testing and results
repeatability of testing
Tools are never needed to break something. But you are providing a testing service, and in order to provide value to your clients, you do well to act more like a QA tester instead of a smart person who can break things. No one cares ...
7
What you want here is not "non-repudiation". Non-repudiation is about preventing the true author of a document from later on claiming that he was not, in fact, the author, and cannot be held responsible for the document contents.
No, what you seek is quite the contrary: you want to prevent non-authors from claiming that they are the true author. You want to ...
7
This looks like a classical Canary Trap. Basicly I would suggest to hide encrypted information about the user in different ways:
obvious QR-Code (as suggested by slugster)
different colors (as suggested by Nick Wilde)
page viewed as username - footer on each page
replacing certain words with synonyms
code information in spaces and interpunction within the ...
5
Is it noticeable? Very much so: hundreds or thousands of rapid-fire requests from a single address will stick out in the logs, and may trigger anti-DoS or anti-crawler measures.
Is it bad? Depends on the site, the rate of copying, and many other factors. Rapidly crawling a website hosted on someone's home server could easily overload their connection and ...
5
Your assumptions in 1 are just false in many places. In the US, you cannot be forced to hand over encryption keys. That is not generally the case; in the UK, the Regulation of Investigatory Powers Act makes it a criminal offense to not surrender encryption keys when asked. Assuming "just because they know I encrypt my data doesn't mean they think I'm ...
5
You could use use the -T4 option together with the -A. No sudo is required (Tested on Ubuntu).
$ nmap -T4 -A 192.168.0.0/24
Would return for instance:
Nmap scan report for 192.168.0.95
Host is up (0.00060s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1 (protocol 2.0)
| ssh-hostkey: ...
5
This is not a collision attack, but a preimage attack
With a collision attack, the attacker has control over both inputs to the hash function, say x and y, and they want to find x and y such that x ≠ y but h(x) = h(y).
With a first preimage attack, the attacker knows h(x) but not x, and they want to find y such that h(y) = h(x). Importantly, the attacker ...
5
Watching your system and kernel log seem appropriate.
On linux:
tail -f /var/log/kern.log /var/log/syslog
before inserting device, then look output when inserting USB device... Care to stay watching for some minutes after plug.
When USB device is plugged, logs show what kind of device is recognized. Required drivers will be loaded, if needed.
If usb ...
4
There was no need for anything beyond CVE-2012-9999 to be issued, as the last CVE ID issued for 2012 was CVE-2012-6700.
Since then, MITRE has determined that a situation such as you propose would be handled simply by adding digits to the end of the ID when needed. See my answer on the linked duplicate for more details.
4
To search for an exploit, use search.
search name:[name of exploit, e.g smb/rpc/http] type:[exploit/payload/auxillary] platform:[windows/linux etc.]
For example:
msf> search name:smb type:exploit platform:windows
4
The main issue is that these tools induce suspicious behaviors (suspicious network activity, suspicious files, suspicious process behavior, etc.). From a network monitoring perspective, how would you then reliably detect an actual attacker if its activity is just blending in background noise of "normal" suspicious behavior affecting your network and systems?
...
4
If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are taken in preparation for the intrusion, the attacker will be able to circumvent it, as they already have access to the machine. Making it more difficult to use ...
4
Testssl.sh can detect bad ciphers and a lot of other things regarding SSL security.
Edit:
Even testssl.sh depends on OpenSSL for the ciphers it tests. It ships with its own OpenSSL libary that has many depracted ciphers enabled. You should use testssl.sh with that OpenSSL library, not with your system's library.
However, even testssl's OpenSSL library ...
4
There's quite a bit on this out of there - there's a general principle that physical access equates to full access on a system. There are methods that are designed to limit this - starting with full disk encryption, moving to Trusted Platform Module (TPM) systems in CPUs and support hardware that attempt to validate the firmware that is running and which ...
Only top voted, non community-wiki answers of a minimum length are eligible