Pentest | tools | Development Tools library
kandi X-RAY | Pentest Summary
kandi X-RAY | Pentest Summary
backdoor exploit fuzzing note misc powershell.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of Pentest
Pentest Key Features
Pentest Examples and Code Snippets
Community Discussions
Trending Discussions on Pentest
QUESTION
I create a Pentest tool for educational purposes, so the old version was written using python 2, then I convert it to python 3 and when I try to run the main file pxxtf.py I got multiple errors, I correct most of them but for this one about Circular Import, I try multiple fixes from forums and StackOverFlow and nothing work with me.
When I try to run the main script :
...ANSWER
Answered 2021-Jun-15 at 14:05The error message is saying it all: "most likely due to a circular import".
pxxtf.py
QUESTION
I don't have much experience of penetration testing, but I am currently looking at OWASP Zap.
The website I am going to pentest runs on an Amazon EC2 instance. Amazon seems to have certain requirements when it comes to security testing: https://aws.amazon.com/security/penetration-testing/
The above website says that you can run security tests on a Amazon EC2 instance but not certain ones such as DNS zone walking, DoS, etc. which is fair enough.
The problem is that I can't see exactly what OWASP Zap will do when I click the "Attack" button and I obviously don't want to upset AWS!
Has anyone else used OWASP Zap on an EC2 instance? Did it you have to configure it to not do DoS attacks, etc? Is there any way I can find out what Zap is doing (I couldn't see anything in the documentation but may have missed something)?
...ANSWER
Answered 2021-Jun-10 at 07:50Yes, I've done that. ZAP does not deliberately attempt DoS attacks (or any other attacks intended to cause damage) but it can still 'take out' insecure or badly configured applications. If you have permission from the website owner then they hopefully wont complain to Amazon and then you'll be ok.
For details of the scan rules ZAP uses see https://www.zaproxy.org/docs/alerts/ - those pages link to the relevant source code so that shpould provide you with more than enough detail ;)
QUESTION
I'm a total newbie in Javascript, so really need your help, guys.
I have a vertical submenu, and I'd like to hide one dropdown item as soon as another one is opened. I've been browsing what feels like for ages today, and I assume I have to use the 'toggle' method somehow, maybe even an onclick function, but so far, I haven't been able to figure out how, and mainly, how to make it work with an already existing Javascript piece of code. The answer must be very simple, and yet... Would be awesome if you could help me.
My code:
...ANSWER
Answered 2021-May-27 at 16:36You can loop through all the dropdown containers and style them with display:none before you add display:block to the clicked element like this:
QUESTION
My client is using a PenTest tool to test his web applications hosted in Azure. He would like to not see the exceptions that are generated from this in Application Insights as they are making it very difficult to find actual application errors.
Is it possible to filter out requests from specific IP addresses so that they are not sent to App Insights? Using something like a TelemetryProcessor maybe? I've found examples that check things like request response codes but I can't seem to find how to do it for IP address.
Thanks
...ANSWER
Answered 2021-May-19 at 10:01If you know the ip addresses, then you can use TelemetryProcessor.
Here is the code snippet:
QUESTION
I am pentesting an Angular application backed by a .NET 5 app. They run both on localhost. This is my very first experience with OWASP Zed Attack Proxy
I can add http://localhost:4200 to ZAP scope, but ZAP can't seem to find https://localhost:5001 which is the Kestrel backend
- Question: how can I add manually a site to the scope from the HUD?
- Question: is it meaningful to add a REST backend to ZAP scope for active scanning?
The answer to the second may likely be yes as it could be testing for SQL injection tokens at least.
The site tree contains only the following
...ANSWER
Answered 2021-Apr-26 at 15:32Does the browser make any requests directly to the Kestrel backend? If not then ZAP will not know about it.
You should add test any related backend if you are able to. Do you have an API definition? ZAP can import SOAP, OpenAPI/Swagger, GraphQL...
QUESTION
I'm working on a pentesting challenge in which a corrupt PNG is provided with the eight dimension bytes in the IHDR chunk all set to zero. The CRC checksum and the rest of the file is still intact. I was wondering whether there is a way to recover the image dimensions by somehow reversing the CRC, since as I understand it, the CRC is calculated from the chunk's bytes. If this is not possible, is there some other way to find the dimensions based on the image data? Any help would be much appreciated.
...ANSWER
Answered 2021-Apr-25 at 18:15In general, no, you cannot recover 62 bits of information from a 32-bit CRC. (It's 62 and not 64 because the specification limits the range of each to 1..231.)
However, if you assume that the image width and height are both constrained to fit in 16 bits each, say 1..65535, then it can be done with just the CRC. spoof will do this for you, where you provide those bit locations and the exclusive-or of the CRC of the header that's there, with the zeroed-out width and height, and the CRC stored in the header, asserted to be the CRC of the header when it contained the original width and height. spoof does this by solving the linear equations over GF(2) of 32 equations in 32 unknowns.
This can be solved in general for very large images if you also make use of the image data, asserted to be intact. Using the rest of the header information and decoding the image data, you would factor the integer number of total bytes in the decompressed data into its prime decomposition. You will then have a small number of possible factorizations into rows and columns. You can try each of those back in the header to see which matches the CRC. Some may be ruled out even before checking the CRC, since the number of bytes in a row has to be one plus a multiple of the bytes per pixel, e.g. three for an RGB image or four for RGBA. (In fact, for the corrupted image originally provided in the question, there is only one factorization that meets that constraint, which is the answer.)
In the incredibly unlikely case that more than one of those matches the CRC, you can use each to decompress the image and see which one looks right. The others will likely look terribly skewed, like an old television that is unable to lock onto the horizontal sync from the received signal.
QUESTION
Short disclaimer: As this question includes topics regarding hacking/pentesting, I'd like to state that this question is only asked for educational purposes as part of a school project. To prevent possible abuse, I will only post code that is necessary for understanding the problem.
To demonstrate dangers and vulnerabilities of Windows 10, I'm currently writing a small C++/WinAPI application that utilizes two common techniques:
- A UAC bypass using the "fodhelper technique" (this works by simply setting a specific registry value to the path of the executable which is supposed to be elevated and then launching an automatically elevated Windows executable called "
fodhelper.exe", which will then read the registry value and execute it as command/launch the specified application). - Performing PE injection, i.e. running a PE file from the address space of the current process (based on this example from github). The PE that gets injected in my program is a simple C++ Console Application (x86) that prints a message box. The shellcode is hardcoded in the injector binary (x86).
I managed to perform both of these techniques successfully in independent files. However, once I combine these two methods (i.e. first elevating, then injecting), a weird error appears.
Description of the problemWhen the injector gets started manually (by double clicking), everything works fine, but when the injector is launched by System32\fodhelper.exe (x64) as a result of the UAC bypass, the following happens: After the injection has finished, the console window of the injected application appears, but instead of continuing the execution, I receive a bunch of error messages stating "The code execution cannot proceed because [garbage characters].dll was not found". This indicates that something went wrong with the offsets, and the Windows loader is trying to read the imports at a wrong position.
To summarize: The code injection works fine, unless the injector was started by fodhelper.exe. In this case the injected PE file is unable to run.
- Debugging the injection using
GetLastErrorand printing the various memory addresses used during the injection. There is no difference if the file is manually started (and the injection is successful) or if it gets started byfodhelper.exe(and the injection fails). - Replace the
WriteProcessMemorycalls withWriteFileto compare the output file when the injector gets manually launched or byfodhelper.exe. Both output files are exactly the same and runnable. This indicates that the injection itself is not the problem, but the Windows loader seems to act differently. - Manually elevating the injector using UAC or by using an elevated command prompt. In both cases, the injection is successful.
- Copying
fodhelper.exeto another location (for example to the desktop) and launching this copy. In this case, the injection is successful. The injection only fails if the injector gets started by the originalfodhelper.exein theSystem32folder.
It seems that the injection behaves completely identical, but the indicators show that due to some unknown impact of fodhelper.exe that gets passed down to the injector, the Windows loader seems to behave differently.
I appreciate any explanation or assumption! Feel free to ask if you require more information.
Minimal reproducible example(with limited debug info and comments): https://0bin.net/paste/UPRIg12n#6nJvBok72UcDvIa56c-XEss7AibIh1Zrs+c3sUzvQMj
Note: See how the injection works if you exclude the elevateProcess function or manually elevate the exe with UAC, and how it fails when including said function.
According to the answer by user RbMm, this error is a result of a specific exploit protection attribute (PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY with the EnableModuleTamperingProtection value) that gets automatically applied onto fodhelper.exe and seemingly gets inherited by all child processes. According to this, removing/resetting this attribute when launching the target process should fix the error. So far I've tried the following, but couldn't achieve any change in the outcome:
ANSWER
Answered 2021-Apr-18 at 02:07when process created via RunAs with elevation - the appinfo.dll call RAiLaunchAdminProcess function (this is in some svchost.exe) and this function, pass STARTUPINFOEX (and EXTENDED_STARTUPINFO_PRESENT flag) to CreateProcessAsUser. and here - lpAttributeList, in particular PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY attribute key is used for set several exploit mitigation policy for the child process (fodhelper.exe in your case). and here EnableModuleTamperingProtection is set for child process tree. effect of this - when system resolve import descriptor, it check (inside LdrpGetImportDescriptorForSnap) for this mitigation flag, and if it enabled - call LdrpCheckPagesForTampering api, it return true, if SharedOriginal is 0, this means this is a copy-on-write private copy of the EXE/IAT -- hence 'tampered' with.
after this LdrpMapCleanModuleView is called. at this point your try begin breaking
possible first public info about this, from Alex Ionescu -
LdrpCheckPagesForTampering/LdrpMapCleanModuleView (RS3) are pretty cool antihollowing mitigations (EPROCESS.EnableModuleTamperingProtection)
if you by self launch new process, you of course not call UpdateProcThreadAttribute for set PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY and in this case, your code sometime work. really only random and sometime - here exist many other errors and bad codding
QUESTION
Hello I am trying to make a simple letter brute force for pentesting:
...ANSWER
Answered 2021-Apr-17 at 20:28You can try a recursive approach for the problem.
QUESTION
I have to write the "assumptions" part of a pentest report and I am having trouble understanding what I should write. I checked multiple pentest reports (from https://github.com/juliocesarfort/public-pentesting-reports) but none of them had this paragraph.
Also I found this explanation "In case there are some assumptions that the pen-tester considers before or during the test, the assumptions need to be clearly shown in the report. Providing the assumption will help the report audiences to understand why penetration testing followed a specific direction.", but still what I do have in mind it is more suited for "attack narative".
Can you provide me a small example (for one action, situation) so I can see exactly how it should be written?
ANSWER
Answered 2021-Apr-16 at 15:25I would think the "assumptions" paragraph and the "Attack narrative" paragraph are somehow overlapping. I would use the "Assumptions" paragraph to state a couple of high level decisions made before starting the attack, with whatever little information the pentester would have on the attack. I would expand on the tools and techniques used in the "Attack narrative" paragraph
For example an assumption could be: "The pentester is carrying on the exercise against the infrastructure of a soho company with less than 5 people It is common for soho companies to use consumer networking equipment that is usually unsecure, and left configured as defualt. For this reason the attacker focused on scanning for http and ssh using a database of vendors default username and passwords"
QUESTION
Before anything else, I've already read all those solutions that says I put an error-page block in my application's or tomcat's conf/web.xml and add an error-code block inside with the corresponding location and those didn't work (did those for 404 errors and those worked).
What I already did inside my application's and tomcat's web.xml:
...ANSWER
Answered 2021-Apr-15 at 09:02The error pages you declare are used in two situations:
To allow developers to customize the appearance of content returned to a Web client when a servlet generates an error, the deployment descriptor defines a list of error page descriptions. The syntax allows the configuration of resources to be returned by the container either when a servlet or filter calls
sendErroron the response for specific status codes, or if the servlet generates an exception or error that propagates to the container.
(Servlet 4.0 Specification, section 10.9.2)
In your case the error happens much earlier during the processing of the HTTP request itself. Therefore you need to modify the server's configuration (server.xml) and add a custom ErrorReportValve (cf. documentation). If all you want is to omit the server's version string, just add:
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install Pentest
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page
