Unanswered Questions

96 questions with no upvoted or accepted answers
5
votes
0answers
1k views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
4
votes
1answer
865 views

Powershell Empire - Token Impersonation

I have been struggling trying to get token impersonation to work in Empire 2.0. I use the credentials/mimitokens module to list and elevate to use a specific users token - I see mimikatz' output ...
3
votes
0answers
471 views

How to run Metasploit WMAP on site that requires SNI

Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
2
votes
0answers
28 views

Burp Suite - Mark Issues as “Validated”

After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
2
votes
0answers
60 views

How to identify the communication protocol used in a wireless device?

I really hope that this is the right place to ask. I need to analyze a baby monitor for any security or privacy weaknesses. The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
2
votes
0answers
73 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
2
votes
0answers
110 views

Guideline/Standards for Valid Penetration Testing

I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid ...
2
votes
1answer
289 views

Hydra - all passwords work

I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form. Therefore I got Hydra (for windows) on GitHub. ...
2
votes
0answers
328 views

Looking for a specific story of a pen-tester who used a fake raffle to get a keylogger into a company

While reading about USB hardware keyloggers on the web a few months ago, I stumbled upon a story by a rather patient pen-tester: He organized a raffle where the first prize was a cool gamer ...
2
votes
0answers
217 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
2
votes
0answers
2k views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
2
votes
0answers
884 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u "http://...
2
votes
1answer
670 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
1
vote
0answers
32 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
0answers
53 views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...

15 30 50 per page