Hot answers tagged

148

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues: File extensions: login.php is most likely a PHP script. HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page ...


42

Updated: For HTTP you can use Burp Suite's proxy (Java), or mitmproxy. tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...


36

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some random ...


34

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


26

The easiest way would be using several databases. Tools like KeePass allow you to store passwords in different files. You could for instance opt to store your passwords in seperate databases based on client or purpose.


22

There are automated and manual approaches. For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions. For manual - you could build a threat model of your app and run it through OWASP ASVS checklist starting from it's most critical parts. If there is file deletion in your ...


21

You should use * in your URI, creating URI injection point(s). So instead of using: sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2" use: sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" See sqlmap wiki for more usage options. From that page: URI injection point There are special cases when injection point is ...


20

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections vulnerabilities. ...


20

You either do it yourself or trust someone else As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and being competent enough to properly perform the task. For example, you could file your taxes yourself or trust a tax adviser to do so (who not only should not ...


19

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


19

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For example, does Nmap data from a previous pen test provide an accurate-enough view of the data you would expect today? Would csrecon or similar provide that data? If ...


18

Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it. Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...


17

For guessing the programming language, you can follow the three steps approach detailed below: STEP 1 - Search evidences on the site itself Manually... Search on a site page at the bottom for phrases like: -> "Powered by XXX" -> "Proudly Powered by XXX" -> "Running on XXX" -> ... Search on the site if it will attend any conference where they ...


16

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ASP....


16

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


16

It's simple. Add Wapplyzer extension available for Chrome as well as Firefox. It tells about programming language, server, analytics tool or about CMS & Frameworks on which website is built. Give it a try, you will love it.


14

For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick. Example of Get-FileHash usage: C:\Windows&...


13

Yes, there is, it's called metasploit unleashed. It is an official metasploit wiki with lots of information. It is structured kind of as a tutorial/course, and it gets upgraded and updated regularly. It is probably the best place to start.


13

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...


13

What you are trying to do will be... difficult. The main point is that at the end of the handshake, client and server send each other Finished messages, under the protection of the just-negotiated algorithms and keys; and the contents of these messages are hash values computed over all the previous handshake messages, including the ClientHello and ...


12

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf /usr/bin/curl....


12

Truecrypt is appraised and widely used, but most of its usage is for disk encryption. As you are more interested on single files, I would either research how to effectivley use Truecrypt for single files or another option is GnuPG. "GnuPG is a volume and individual file encryption tool with support for a dozen encryption schemes, paired keys, and expiring ...


12

The Common Vulnerability and Exposures system is maintained by Mitre. The Mitre corporation manages the CVE list and serves as an organizer for the CVE community. At the start of the year Mitre will allocate blocks of CVE numbers to various CVE Numbering authorities out of the full 9998 available (0001-9999). As a result, all CVE numbers issued to an ...


12

For your exact use case, I personally use Lastpass. The killer features of Lastpass include the ability to compartmentalize and separate each client's passwords from each other and from my own. They also have in my opinion the best browser addon integration and the data can be stored and used offline as well. I like to increase the password PBKDF2 ...


12

You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a decent speed. If you want to avoid detection, you must either make fewer requests, or make them more slowly. Have you tried running tools like Snort, Bro, or ...


11

A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures: Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget) Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); ...


11

how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap? There are three basic methods: multiple copies, error correction, and enhanced detection. A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...


Only top voted, non community-wiki answers of a minimum length are eligible