Information Gathering - Why? How? & What?

Lets suppose any thriller stealing movie. Think what does robbers do before they hack the bank or anything else? They gather the information. They collect each and every information about bank system, alarm methodology, CCTV interface, Guards changing time, list of weapons having with guards.After gathering information they make plan and attack or rob the bank. You all are clever. So assume they don't have these much of information and they are going to rob bank directly, what will happen ? You will find them caught with by police.

Same scenario also applied in information security world. Before attacking or testing something a hacker/tester needs to find the information about his/her target. Now this target can be a network, web application, organization or a person. In our world finding information is also called as footprinting or doxing. Also the term reconnaissance can be used sometimes.

Juicy Areas of Web Application For Pentesters

In this tutorial I am going to write small things which everyone knows already but I am trying to convey it in another manner of checklist. I am going to talk on some juicy areas for pen tester. Mainly it will be focusing on fingerprinting concept. While doing fingerprinting of any website, which are the areas mainly a pen tester or web application security analyst should target at high priority.

First thing to check is the server name and the version information. This information is really helpful to pen testers because older versions have already exploits in market. So If they got older server version they can directly check whether that exploit is working or not.

Python Service Banner Grabbing Script

Hello Guys I have written some small banner grabbing script in python. It is very simple and basic. By using this script you can check the services any network or domain. You will be able to know which services as well as version of service they are using.

In our penetration testing we do some nmap or other port scanning. After we come to know that these much of ports are opened, we try to find the version of service they are using. We do that in order to find  if there is any direct exploit available or not. So in this case this little code will help you to find out the version of services.

Its just basic script which does FTP, HTTP banner grabbing.

Penetration Testing - FTP Service

[1] The source code of the older version of ProFTPD server (1.3.3a) was downloaded from the ProFTPD source code repository located at ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.3a.tar.bz2.

Penetration Testing - SAMBA SERVER

Aim: The aim is to understand how the countermeasures are applied in order to protect the potential vulnerable organization using the samba server.

Detail summery of configuration in Victim computer.

The attacker system, victim server (Linux) and client (Windows XP) was setup in a virtual environment using VMware workstation 9. They all belong to the host only network and are isolated from the rest of the network.

Web Service With CGI Support - Penetration Testing

This report shows an hands-on penetration testing using Apache server with cgi access, it identifies some vulnerabilities and performs exploits with this vulnerability and It further patches it by mitigating this known threats.

INTRODUCTION

APACHE

Apache can also be referred to as Apache HTTP Server. It is a standard that is established for allocating services for website online which has developed the World Wide Web. It is a free platform of web server which is been used by most of the website. The server is been used by most of the operating systems e.g. Unix, Linux, Window, Microsoft Windows, Mac OS etc but was originally designed for Unix.

Lets send packet without PING command - Introducing Scapy

Whats scapy?

Its packet manipulation mechanism. One can send and receive the packet of large no. of protocols. Its useful to send and receive reply in order to further analysis. Scapy provides many classical tasks such as :

• probing
• tracerouting
• scanning
• network discovery

Lets develop a source code from executable : Reverse engineering approach

Why mobile security is important ?

Now a days world is becoming tiny with the latest inventions in gadgets. Hardwares are becoming smaller and smaller and their efficiency and usability is increasing rapidly.

There is a drastic growth in mobile application development in past 3 years.

Average 500% people are using mobiles for day 2 day transaction. From all those people 60% of people are not installing anti virus in their phone and 50% of mobile users jailbreak their phones. Number of chances are very high that mobile applications can be used in a wrong manner to harm other people.