Penetration Testing: Create a DNS Zone Transfer Lab
DNS zone transfers use the AXFR protocol to replicate DNS records across DNS servers. If you do not protect your name servers, attackers can get information about all your hosts with AXFR.
PenTest
34 articles
Find Information About a Person on Instagram with OSINTgram
Social media platforms can betray a considerable amount of information on a person or organization which can be useful during a pentest information gathering.
A List of Tools to Help you Detect the Log4j Vulnerability
How can you detect the Log4j zero day vulnerability (known as Log4shell)? Here's a list of FREE Log4j vulnerability scanner tools.
Build a Penetration Testing Lab on a Raspberry Pi with DVWA
You can build a pentest lab on a raspberry pi with DVWA to test your skills and also learn new tricks on how to attack and/or secure web applications.
Hunt a Username on Social Media with Sherlock
Many users register themselves on websites using the same username. If you are performing an investigation on a person, and especially if you know a username or handle they are usually using online, you may hunt for usernames on social media platforms with Sherlock.
Web Dashboard for your Nmap Scans
WebMap is a web dashboard for your nmap scans. This tool, which is free, can provide you with more management capabilities of your scan results.
How To Find Domains Owned by a Company
During a black box, or grey box penetration testing engagement for a company, one of the main things you will need to find domains owned by the company.
Find Web Server Vulnerabilities With Nikto
Nikto is an open source scanner capable of scanning for over 6700 items to detect any misconfigurations on web servers like Apache, Nginx, Litespeed etc. as well as discovery of exposed files, user enumeration and outdated components.
Discover Subdomains During A Penetration Testing Engagement
During an external penetration test, and especially if it is a black-box engagement, one of the most important steps is to find subdomains used by the target company.
Enumerate and Capture Website Files Metadata
Many organizations are uploading files on their websites like pdf, word and excel without being aware that they are exposing sensitive information. You can enumerate and capture the files and its metadata.
Cool Nmap Tricks and Techniques
A list of not so commonly used but powerful Nmap commands to help you bring your enumeration skills to the next level.
PenTest Reports That Bring Value to your Customer
Penetration Test Reports must bring value to your clients. There are key elements every proper pentest report must include.
Types of Man-In-The-Middle Attacks
What is a Man-In-The-Middle attack and how the attacker can use it against you. Is there a way to protect yourself from such attacks?
Free and Essential Security Tools You Should Already Be Using
The most important, free and powerful security tools which you should be using right now to assess your systems and network and uncover vulnerabilities.
Penetration Testing: Pre-Engagement Interactions
There are many important actions you should focus on prior to diving into a penetration test. PenTests are not just point-and-shoot activities.
Five Penetration Testing Frameworks and Methodologies
Which are the best frameworks for penetration testing? What are the attributes of each and which one is best for your organization?