148
There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues:
File extensions: login.php is most likely a PHP script.
HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page ...
42
Updated:
For HTTP you can use Burp Suite's proxy (Java), or mitmproxy.
tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...
36
Your first question is really a legal one, and you seem to be assuming two things:
The attacker is a government of some sort.
That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys.
Neither of those assumptions are necessarily true. For all you know, some random ...
35
The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...
26
The easiest way would be using several databases. Tools like KeePass allow you to store passwords in different files. You could for instance opt to store your passwords in seperate databases based on client or purpose.
22
There are automated and manual approaches.
For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions.
For manual - you could build a threat model of your app and run it through OWASP ASVS checklist starting from it's most critical parts. If there is file deletion in your ...
20
There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version.
use Owasp ZAP or Webscarab for their proxy functionality.
use Nikto and W3AF to scan web applications.
use SQLMap to exploit SQL injections vulnerabilities.
...
20
You either do it yourself or trust someone else
As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and being competent enough to properly perform the task.
For example, you could file your taxes yourself or trust a tax adviser to do so (who not only should not ...
19
You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...
19
You want to increase signal and reduce noise during a pen test?
Great! Here are some things to ponder on:
For answers to the questions you have -- are they already answered somewhere else? For example, does Nmap data from a previous pen test provide an accurate-enough view of the data you would expect today? Would csrecon or similar provide that data? If ...
18
Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it.
Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...
17
It's simple. Add Wapplyzer extension available for Chrome as well as Firefox.
It tells about programming language, server, analytics tool or about CMS & Frameworks on which website is built.
Give it a try, you will love it.
17
For guessing the programming language, you can follow the three steps approach detailed below:
STEP 1 - Search evidences on the site itself
Manually...
Search on a site page at the bottom for phrases like:
-> "Powered by XXX"
-> "Proudly Powered by XXX"
-> "Running on XXX"
-> ...
Search on the site if it will attend any conference where they ...
14
For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick.
Example of Get-FileHash usage:
C:\Windows&...
13
What you are trying to do will be... difficult. The main point is that at the end of the handshake, client and server send each other Finished messages, under the protection of the just-negotiated algorithms and keys; and the contents of these messages are hash values computed over all the previous handshake messages, including the ClientHello and ...
13
You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a decent speed. If you want to avoid detection, you must either make fewer requests, or make them more slowly.
Have you tried running tools like Snort, Bro, or ...
12
Truecrypt is appraised and widely used, but most of its usage is for disk encryption. As you are more interested on single files, I would either research how to effectivley use Truecrypt for single files or another option is GnuPG.
"GnuPG is a volume and individual file encryption tool with support for a dozen encryption schemes, paired keys, and expiring ...
12
sudo cp /usr/bin/curl /usr/bin/curl.bin
sudo vim /usr/bin/curl.wrapper
here is the wrapper:
#!/bin/sh
date >> /var/tmp/curl_ppid.log
ps -f -p $PPID >> /var/tmp/curl_ppid.log
exec curl.bin "$@"
and then:
sudo chmod 755 /usr/bin/curl.wrapper
sudo touch /var/tmp/curl_ppid.log
sudo chmod a+w /var/tmp/curl_ppid.log
sudo ln -sf /usr/bin/curl....
12
The Common Vulnerability and Exposures system is maintained by Mitre. The Mitre corporation manages the CVE list and serves as an organizer for the CVE community.
At the start of the year Mitre will allocate blocks of CVE numbers to various CVE Numbering authorities out of the full 9998 available (0001-9999). As a result, all CVE numbers issued to an ...
12
For your exact use case, I personally use Lastpass. The killer features of Lastpass include the ability to compartmentalize and separate each client's passwords from each other and from my own. They also have in my opinion the best browser addon integration and the data can be stored and used offline as well.
I like to increase the password PBKDF2 ...
12
Using nmap:
sudo nmap -O <target>
Or if they block your ping probes you can do:
sudo nmap -O <target> -Pn
Sometimes you still get fake results and you should try doing an aggressive scan (can be detected and blocked by the firewall).
sudo nmap -A <target>
11
A recent test of Nessus and OpenVAS shows the benefits in using multiple scanners due to the difference in the signatures:
Nessus, OpenVAS and Nexpose VS Metasploitable (blog post by Peter at HackerTarget)
Out of 15 known security holes in the system used for the test, 4 were spotted by all four tested tools (Nessus, OpenVAS, Nexpose and some Nmap scripts); ...
11
Here is a post from my blog involving using SSLStrip in a MITM attack with a Raspberry Pi - had to take it down as Google Blogger didn't like it, so this content is pasted from Evernote :)
As part of a security awareness demonstration, I set up my 3g Pi Wireless AP to strip SSL from secure websites and harvest the login details. You may be familiar with ...
10
You don't "fix" SQL injection problems. Well, people do, but that's wrong. What you must do is not to allow them to happen in the first place. The main tool for that is, as @TerryChia points out, parameterized SQL statements. Parameterized SQL statements are very effective at preventing SQL injection attacks, by being a generic and thorough solution; this is ...
9
For file encryption, use GPG. It is well-vetted by cryptographers and is in some sense a gold standard for file encryption.
You can control the process for generating a cryptographic key from the passphrase, using --s2k-count N, where N is the number of times you want the passphrase hashing to be repeated. I suggest trying a few different values, timing ...
9
Bottom line, anything that does not use HTTPS for all connections is vulnerable to Firesheep.
I can imagine that a lot of the original handler scripts no longer work because a large number of sites have fixed their sites to use HTTPS. Or if they were really lazy they just modified things slightly to obscure things.
I tried out Firesheep when it was ...
9
Well, it's not really a tool, but it'll get you started. This RegEx matches many kinds of comments (# comments, HTML comments, JavaScript comments, and VBScript comments).
(<!--(.*?)-->)|(/\*([^*]|[\r\n]|(\*+([^*/]|[\r\n])))*\*+/)|(//.*)|(^'.*$)|(^#.*$)
And here's a demo
Note: Be sure to set the g and m flags
Update: I thought it'd be a good idea ...
9
There is a cookie option in sqlmap :
--cookie=COOKIE HTTP Cookie header
So you just need to paste your cookie and you will be able to use sqlmap as if you were logged.
If you need the list of all the options : https://github.com/sqlmapproject/sqlmap/wiki/Usage
Only top voted, non community-wiki answers of a minimum length are eligible
