Collaborate Disseminate
I am working on testing multiple code review tools and what to know if there are any free vulnerable code projects that I can run my scanning tools against and compare the results of each tool. I am mostly aiming at projects using .NET/C# … Continue reading Vulnerable Projects to Test and Compare Code Review Tools [closed]
When testing I was able to use rpcclient tool and have an anonymous login on the machine. I was very limited on what I can do. Should this be enabled on the server? Would best practice be to disable anonymous login?
What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?
The example below is from the “have i been pwned” Web site:
… Continue reading A third party Web site wants me to validate my domain ownership using a TXT record
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:34 EDT
Nmap scan report fo… Continue reading Open ports on my NetGear router
Has anyone ever came across this type of attack in a work environment? I am doing some research and cant seem to find any information on companies who experienced this type of attack and how they remediated it. How many compa… Continue reading Password Spraying Attacks
I am running nmaps NSE vuln scans against servers for my pentest and it seems to be pulling in inaccurate results with services that we don’t have on those servers. Is this a known issue when using those NSE scripts? How acc… Continue reading Nmap Vulnerability NSE scripts
What would be a good approach for testing malware or bad URL’s from things picked up from my SIEM to validate them? I was told to set up a VM for these tests but don’t want it to hit the internal network.
I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing there to view?
This question already has an answer here:
HTTP Basic Auth is enough?
1 answer
Is basic auth safe to use? What are ways at… Continue reading Basic Auth Security [duplicate]
I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don’t seem to be working accurately. Can som… Continue reading Best tool to BruteForcing RDP