Today I was hired to pentest a company's framework. While getting directions on what needs to be tested I counted 4times the sentence:
"We are a multi-awarded company for our security, virtually nothing gets past our firewalls".

Most of the PCs had Win98

I hope I'll be able to release the new/refreshed version of the security/privacy blog today.

Feel free to test stuff out and report back when it breaks!

Also, feel free to pentest it. The only thing I ask is to, if you find any vulnerabilities, report them instead of passing them to malicious people/abusing them.

And yes, post sorting will be fixed ;)

3 rants for the price of 1, isn't that a great deal!

1. HP, you braindead fucking morons!!!

So recently I disassembled this HP laptop of mine to unfuck it at the hardware level. Some issues with the hinge that I had to solve. So I had to disassemble not only the bottom of the laptop but also the display panel itself. Turns out that HP - being the certified enganeers they are - made the following fuckups, with probably many more that I didn't even notice yet.

- They used fucking glue to ensure that the bottom of the display frame stays connected to the panel. Cheap solution to what should've been "MAKE A FUCKING DECENT FRAME?!" but a royal pain in the ass to disassemble. Luckily I was careful and didn't damage the panel, but the chance of that happening was most certainly nonzero.
- They connected the ribbon cables for the keyboard in such a way that you have to reach all the way into the spacing between the keyboard and the motherboard to connect the bloody things. And some extra spacing on the ribbon cables to enable servicing with some room for actually connecting the bloody things easily.. as Carlos Mantos would say it - M-m-M, nonoNO!!!
- Oh and let's not forget an old flaw that I noticed ages ago in this turd. The CPU goes straight to 70°C during boot-up but turning on the fan.. again, M-m-M, nonoNO!!! Let's just get the bloody thing to overheat, freeze completely and force the user to power cycle the machine, right? That's gonna be a great way to make them satisfied, RIGHT?! NO MOTHERFUCKERS, AND I WILL DISCONNECT THE DATA LINES OF THIS FUCKING THING TO MAKE IT SPIN ALL THE TIME, AS IT SHOULD!!! Certified fucking braindead abominations of engineers!!!

Oh and not only that, this laptop is outperformed by a Raspberry Pi 3B in performance, thermals, price and product quality.. A FUCKING SINGLE BOARD COMPUTER!!! Isn't that a great joke. Someone here mentioned earlier that HP and Acer seem to have been competing for a long time to make the shittiest products possible, and boy they fucking do. If there's anything that makes both of those shitcompanies remarkable, that'd be it.

2. If I want to conduct a pentest, I don't want to have to relearn the bloody tool!

Recently I did a Burp Suite test to see how the devRant web app logs in, but due to my Burp Suite being the community edition, I couldn't save it. Fucking amazing, thanks PortSwigger! And I couldn't recreate the results anymore due to what I think is a change in the web app. But I'll get back to that later.

So I fired up bettercap (which works at lower network layers and can conduct ARP poisoning and DNS cache poisoning) with the intent to ARP poison my phone and get the results straight from the devRant Android app. I haven't used this tool since around 2017 due to the fact that I kinda lost interest in offensive security. When I fired it up again a few days ago in my PTbox (which is a VM somewhere else on the network) and today again in my newly recovered HP laptop, I noticed that both hosts now have an updated version of bettercap, in which the options completely changed. It's now got different command-line switches and some interactive mode. Needless to say, I have no idea how to use this bloody thing anymore and don't feel like learning it all over again for a single test. Maybe this is why users often dislike changes to the UI, and why some sysadmins refrain from updating their servers? When you have users of any kind, you should at all times honor their installations, give them time to change their individual configurations - tell them that they should! - in other words give them a grace time, and allow for backwards compatibility for as long as feasible.

3. devRant web app!!

As mentioned earlier I tried to scrape the web app's login flow with Burp Suite but every time that I try to log in with its proxy enabled, it doesn't open the login form but instead just makes a GET request to /feed/top/month?login=1 without ever allowing me to actually log in. This happens in both Chromium and Firefox, in Windows and Arch Linux. Clearly this is a change to the web app, and a very undesirable one. Especially considering that the login flow for the API isn't documented anywhere as far as I know.

So, can this update to the web app be rolled back, merged back to an older version of that login flow or can I at least know how I'm supposed to log in to this API in order to be able to start developing my own client?

Story from my friend who I drank a beer with yesterday:

His manager has balls bigger than elefants.. Hiring a group of anarcho kinda pentest / hacker fucks from a freelance portal from Serbia... Who found quite some shit in their internal systems.

You should think twice about paying them late and especially paying them only half the amount. Even though "they wouldn't sue them anyway".

Sure, they won't.

But take a smart guess what they did.

Fuckin idiot manager.

Someone's going to get a surprise tonight 🤣

Sad story:
User : Hey , this interface seems quite nice
Me : Yeah, well I’m still working on it ; I still haven’t managed to workaround the data limit of the views so for the time limit I’ve set it to a couple of days

Few moments later

User : Why does it give me that it can’t connect to the data?
Me : what did you do ?
User : I tried viewing the last year of entries and compare it with this one

Few comas later

100476 errors generated
False cert authorization
Port closed
Server down
DDOS on its way

Last night I was exploring the feasibility of cracking the WPA2 key of my own router at home. I set out on a late night adventure, set up a couple devices and, knowing the default password convention of the manufacturer, setup a Hashcat instance with the relevant masks on my laptop, created a Crunch wordlist and ran aircrack on my Raspberry Pi 3, and thought "Hey - maybe there's something for Android too."

Hashcat on Android is a cat based social media app. I'm a little scared.

Pentest wifi today client ask me why the rabbit

I'm performing a pentest for my client.
So after scanning my client's network I understood they're using IIS 4.5 and windows server 2012 (or 2012 R2)
I know the systems are real old.
And there are known exploits for them.

The tricky part is I have to stay hidden and I only have my own credentials for logging in to the asp page. (Uploading a script is almost crossed cuz it will reveal my identity)
Also I have access to the local network with some of the other employees user/pass.

Any recommendation for exploiting and staying hidden at the same time ?

One more question : will exploits for newer versions work for the older ones necessarily?

I wonder if lock picking is part of the pentest or not ? XD

0.
1. That arrays start at [1]
2.
3.

So, this incident happened with me around 2 years ago. I was pentesting one of my client's web application. They were new into the Financial Tech Industry, and wanted me to pentest their website as per couple of standards mentioned by them.

One of the most hilarious bug that I found was at the login page, when a user tries logging into an account and forgets the password, a Captcha image is shown where the user needs to prove that he is indeed a human and not a robot, which was fair enough to be implemented at the login screen.

But, here's the catch. When I checked the "view source" option of the web page, I saw that the alt attribute of the Captcha image file had the contents of the Captcha. Making it easy for an attacker to easily bruteforce the shit outta the login page.

You don't need hackers to hack you when your internal dev team itself is self destructive.

I'm currently pentesting a web app on a Mac Mini with 8 Gigs of RAM and a i5-4620 using OWASP ZAP. Third time the fuzzer got stuck, the RAM's full an the CPU's permanently at 100 %.

Before starting this job, I always said that pentesting on this POS is like bringing a knife to a gunfight.

When I kicked off two fuzzers at once, I started feeling like bringing a cocktail sword to a thermonuclear war.

It's not even 10 here and I already wish for some booze. Damn, I gotta start making moonshine or something.

Pentesting for undisclosed company. Let's call them X as to not get us into trouble.
We are students and are doing our first pentest at an actual company instead of assignments at school. So we're very anxious. But today was a good day.
We found some servers with open ports so we checked a few of them out. I had a set of them with a bunch of open ports like ftp and... 8080. Time to check this out.
"please install flash player"... Security risk 1 found!

System seemed to be some monitoring system. Trying to log in using admin admin... Fucking works. Group loses it cause the company was being all high and mighty about being secure af. Other shit is pretty tight though.

Able to see logs, change password, add new superuser, do some searches for USERS_LOGGEDIN_TODAY! I shit you not, the system even had SUGGESTIONS for usernames to search for. One of which had something to do with sftp and auth keys. Unfortunatly every search gave a SQL syntax error. Used sniffing tools to maybe intercept message so we could do some queries of our own but nothing. Query is probably not issued from the local machine.

Tried to decompile the flash file but no luck. Only for some weird lines and a few function names I presume. But decompressing it and opening it in a text editor allowed me to see and search text. No GET or POST found. No SQL queries or name checks or anything we could think of.

That's all I could do for today. So we'll have to think of stuff for next week. We've already planned xss so maybe we can do that on this server as well.

We also found some older network printers with open telnet. Servers with a specific SQL variant with a potential exploit to execute terminal commands and some ftp and smb servers we need to check out next week.

Hella excited about this!

If you guys have any suggestions let us know. We are utter noobs when it comes to this.

Yay!
Finally joined the os security lab !!

A bit confused !
Must prepare an article about network pentest and defense .
Since its a very wide topic and I've been told not to just mention tools , I'm confused about categorizing these tests !
Also the footprinting stage is not likely to have any defense !(no attack is lunched yet :) )

So... Any idea?

I realized that I'm spending about 2 hours in the taxi so I told myself that I I gotta make use of this time and started reading books about pentest and such.
After a while I noticed that this is not working as expected. Because the stuff I was trying to learn by just reading books were mostly practical and I had to see how they really work (like running the codes and so on)
So I reviewed my long term plans and oh! All the topics are practical !

So I'm asking you:
What are the useful topics that I can learn by just reading or what are the other ways I can make use of this time?

Any better way for breaking telnet ?
(I had no idea who was ever going to connect to this ip using telnet so i had no chance to sniff the password :(
Now it is taking ages to brute force )

//mac is already spoofed ;)

got first assignment on my first meet on Network Security. it require to pentest one unsecured specified website. yet they don't tell me shit about anything just try it.
i need to :
1. Footprint
2. Scanning
3. Enumeration
4. Gaining Access (previledges raising?) (bonus)

suppose : <target-website> is x
i've done this:
1. whois x
2. got the ipaddress via :
host x
3. nmap -F ip.of.x

my head is already spinning, i need to know what BASICLY each of what i've done. i only get that 'whois' get the information about that domain, 'host' is used to know the target ip address and nmap to find what are the open ports. i don't know what else should i do. need help :(

Coronavirus is starting to turn me into a pentest hulk 😂

Do I need ccna for pentest?
I know it's about network administration but I was wondering if it will help me see things the way the sysadmin does.

Assume U've captured the cap using airmon-ng , airodump and aireplay .
The question is:
If I dont wanna use air crack-ng and wanted to use sites like hashkiller , how can i get the hash from the cap file?

Exploiting port 1723...
That's all !!!

That moment you forget to tell the devs about the new tests and end up doing brute force for some pen testing and load capacity and they do a rant of you

Hello together.

I need your help. Im a junior Pentester.

Tomorrow I need to pentest a Macintosh workstation but I have no idea where to start. Users can login via LDAP and I will do a white box pentest.

Any suggestions where to start?

Hi!
I want to know if there is possibility to find a vulnerability on a .jar file.
I tried to install Kali on VM (for now) and tried to use metasploit but I found that it attacks the inter system on a indicated ip address.
There are many application or video (and so on) for my problem?
This .jar file is an application and I want to do pentesting...
Sorry for my poor english but it isn't my native language.
I'm new in pentesting wolrd 🤣

A backdoor means an open port so...
If anybody in including the admin checks the open port he will definitely notify the port and probably will close that port so...

Maintaining access means nothing?

What (realistic) requirements would you need to run windows 10pro OS with kali linux on a VM for pentest/ coding environment ONLY. no gaming etc. ?
Im starting my software development school soon, and im needin a new laptop.
Any requirements/ good to know appreciated from you old time code gods

Loooots of login pages !!!

Which ons is less risky and which one Is most profitable to succeed ?

0- telling the admin you forgot your password and as he's logging in, sniff his password (you already placed sslstrip)

1- gain access to router using its vulnerabilities and redirect the traffic to a fake page and get the password.

2- exploiting smb port of admin's system and placing a krylogger or stealing his cookies if available

3- brute forcing admin password :/

4- pressing forgot password on admin account and staying close to him and sniff the SMS containing the otp using rtl-sdr (and of course you will be prompted to set a new password)

5- any other way .

Also the website itself is almost secure.
It is using iis 8.5 and windows server 2012
Only open ports are 80 and 443.

remember: the conficker table is still really useful in 2020 due to the prevalence of laziness in users and sysadmins. Use with permutations of some sort!

Going to do our first social engineering pen test. We're setting up a general plan and we'll call for a meeting with a company next week. Any tips?

this afternoon, we got email from our pentester. He said that he got some security vulnerability in our project. He found .git/ folder in project directory in production server. He considered it as security vulnerability because user can see all git branch on remote repo. He recommend us to remove that folder but the problem is, we using CI/CD so we need that .git/ folder. My question is it bad practice to use git on production server?

Feels like I'm stuck in an escape game.
The more I go, the more complex it gets.
When clues lead to greater questions...

But the challenge has just begun !