Tag Info

Hot answers tagged

5

There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website". Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...


2

Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this: http://www.example.com.:80 Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. ...


2

As a tester part of your job is to provide information and to advise others (BAs, Developers, Managers etc.) about the state of the system and any potential risks. With this in mind, what I'd do in your situation is to research examples of this problem and the potential effects. To appear more credible you could outline best case scenarios (e.g. distribution ...


1

This is a technique in penetration testing to detect a vulnerability called "Insecure Direct Object References", 4th on OWASP Top 10 list. Regarding whether this is security or confidentiality testing. I would say both as confidentiality is just one of the measures in security testing: A security measure which protects against the disclosure of ...


1

Pls find useful links (references) to get started http://resources.infosecinstitute.com/net-penetration-testing-test-case-cheat-sheet/ https://www.pentesterlab.com/exercises/ http://darkassassinscybercrew.blogspot.in/2013/01/sqlmap-tutorial-for-window-7.html http://www.fuzzysecurity.com/tutorials/4.html


1

I don't have any experience with PenTesting (training or otherwise) but I came across this mindmap and thought of this question. It appears to list practice labs (doesn't state where they are located) for Pen Testing. I know Stack Exchange has a Security Forum and post on learning ethical PenTesting here - maybe this is a good place to follow up? Then you ...


1

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative. w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting ...



Only top voted, non community-wiki answers of a minimum length are eligible