Skip to main content
21 votes
Accepted

How should source code security be checked?

There are automated and manual approaches. For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions. For manual - ...
odo's user avatar
  • 682
20 votes
Accepted

Reduce Noise when Penetration Testing

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For ...
atdre's user avatar
  • 19.1k
19 votes

How should source code security be checked?

You either do it yourself or trust someone else As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and ...
Ángel's user avatar
  • 18.9k
13 votes

Reduce Noise when Penetration Testing

You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a ...
David's user avatar
  • 16.1k
9 votes
Accepted

Human vs. Vulnerability Scanners

Most access control / authorization flaws would never be found by a (generic) tool, because it does not have the understanding of what is supposed to be accessible and what not. (Having said that, ...
Gabor Lengyel's user avatar
6 votes

Why use tools such as BurpSuite, nmap or SQLmap?

Several reasons: reduce testing time automation clear methodology consistency of testing and results repeatability of testing Tools are never needed to break something. But you are providing a ...
schroeder's user avatar
  • 131k
6 votes
Accepted

Tools to produce an MD5 collision?

This is not a collision attack, but a preimage attack With a collision attack, the attacker has control over both inputs to the hash function, say x and y, and they want to find x and y such that x ≠ ...
AndrolGenhald's user avatar
6 votes
Accepted

How to check if USB device isn't malicious?

Watching your system and kernel log seem appropriate. On linux: tail -f /var/log/kern.log /var/log/syslog before inserting device, then look output when inserting USB device... Care to stay ...
F. Hauri  - Give Up GitHub's user avatar
6 votes
Accepted

Where to find complete Kali image for docker with all the tools?

Use Kali Linux Metapackages after setting up a Kali Linux Docker Image. In 2019.3 there was a Major Metapackage Makeover, changing the names. To combine this information: apt-get update && apt-...
Esa Jokinen's user avatar
4 votes

Is there any tools out there to attack an unloaded system (on disk)

There's quite a bit on this out of there - there's a general principle that physical access equates to full access on a system. There are methods that are designed to limit this - starting with full ...
crovers's user avatar
  • 6,381
4 votes
Accepted

How to deal with administration tools such as ipscanners and PSTools?

If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are ...
Patrick Bell's user avatar
4 votes

How can I detect the remote operating system?

You could use use the -T4 option together with the -A. No sudo is required (Tested on Ubuntu). $ nmap -T4 -A 192.168.0.0/24 Would return for instance: Nmap scan report for 192.168.0.95 Host is ...
user9869932's user avatar
4 votes
Accepted

Is there a tool to test whether a server supports any cipher suite?

Testssl.sh can detect bad ciphers and a lot of other things regarding SSL security. Edit: Even testssl.sh depends on OpenSSL for the ciphers it tests. It ships with its own OpenSSL libary that has ...
Sjoerd's user avatar
  • 30.9k
4 votes

Getting started with sn1per scanning

The first step to becoming an "elite pentester" - as you phrase it - is to be able to read error messages. The error message you see is that it says "Unknown scan option security....
Stéfan's user avatar
  • 41
3 votes
Accepted

How deauth attack works in mkd3

mdk3 is not included in aircrack-ng suite at the moment, but it seems they started to collaborate some time ago. Look at this: https://svn.mdk3.aircrack-ng.org/mdk3/docs/Documentation_incomplete.html ...
OscarAkaElvis's user avatar
3 votes
Accepted

How to detect the OS running on IoT device?

There is an -O option on nmap that will try to detect what OS the device is running, it is by no means perfect. It analyzes the TCP/IP stack's behavior. https://nmap.org/ If the device has port 22 (...
Oskar Skog's user avatar
3 votes

Reduce Noise when Penetration Testing

Without going too much into specifics (as they're very dependent on the circumstances of the test), you could think about things like this. How do SOCs find attackers? Well there's a couple of ways, ...
Rory McCune's user avatar
  • 62.4k
3 votes

Creating portable bash terminal & cmd to USB

The idea is fundamentally flawed, and cannot be salvaged. To start with the first problem: plugging in an USB "stick" (mass storage device) in a computer will cause that computer to configure its USB ...
MSalters's user avatar
  • 2,689
3 votes
Accepted

Kali Linux and Cell Phone Security

Kali Linux has tools under the category: Hardware Hacking. smali, apktool and android-sdk. These tools are specifically intended to target Android. Although, your question was more around the idea of ...
safesploit's user avatar
  • 1,867
3 votes

Why use tools such as BurpSuite, nmap or SQLmap?

Among other things, Burp allows you to get a good look of the layout of a web app through spidering- exposing source code and dependencies, directory layout, even API methods that are being called, ...
jonroethke's user avatar
  • 1,044
3 votes

How to check if USB device isn't malicious?

You cannot scan a device until you have access to it's storage or memory. Ideally, USB/IoT devices comprise of flash based microcontrollers. In other cases, let's assume there's some sort of ...
r0x0t's user avatar
  • 84
3 votes

How does a hacker reach a back-end file to exploit it?

"Hackers" don't really do (or need to do) what you are describing. In some cases, a misconfiguration may allow for a remote user to view the text content of a PHP script file (e.g. maybe a ...
multithr3at3d's user avatar
2 votes

What CVE identifier will follow after CVE-2012-9999?

So as of now we have larger CVEs (the DWF project https://distributedweaknessfiling.org/ has been assigned CVE-YEAR-1000000 through CVE-YEAR-1999999). I just assigned CVE-2016-1000000 to an issue ...
Kurt's user avatar
  • 266
2 votes

Why can't scanners usually detect stored XSS? Is there a way to automate the detection of stored (persistent) xss,?

Here are a few problems with what you are looking for and why they are virtually non-existent. Tools find reflected XSS by searching for the injected script snippet in the HTML source of the ...
hax's user avatar
  • 3,941
2 votes

How deauth attack works in mkd3

md3 does not belong to the aircrack-ng suite but rather it is an autonomous tool for wireless pen-testing. It supports several modes of operation (attacks) one of which is deauthentication (amok ...
dr.doom's user avatar
  • 151
2 votes
Accepted

sbd uses "default phrase to use for encryption"

It uses the default passphrase "roses are red, violets are blue." which can be overridden at compile time by defining SHARED_SECRET or at runtime using the command line switch you mention in the ...
CodesInChaos's user avatar
  • 12.1k
2 votes

What benefits does Nessus have over OpenVAS?

Though Nessus comes at a hefty price whereas OpenVAS is free and open-source but Nessus has a larger range of common vulnerabilities and exposures (CVE) coverage. Nessus even has better server-side ...
MichaelF823's user avatar
2 votes
Accepted

Are there tracking methods for targeted ads from regular cell phone use, and how can one monitor that?

The tracking methods are not all located in your phone. For example, Verizon has been adding their own custom header, X-UIDH, to cell phone HTTP requests that pass through their network; and are ...
John Deters's user avatar
  • 34.2k
2 votes

Can I detect a firmware toolkit like NightSkies on my iPhone?

The only real way to compare if a firmware image has been modified is to be able to take the firmware from the device, take a hash of it, and compare it to the hash of a known good copy. The image ...
Dan Landberg's user avatar
  • 3,322
2 votes

How to automate Nikto output?

Go on their website: https://cirt.net/nikto2-docs/options.html, and you will easily find how to specify output. Inspiration for this kind of answer was a quote: If you give a man a fish he is ...
Mirsad's user avatar
  • 10.2k

Only top scored, non community-wiki answers of a minimum length are eligible