Knowledge Base for Penetration Testing
Enumeration Vulnerability – Supermicro IPMI UPnP Supermicro includes a UPnP SSDP listener running on UDP port 1900 on the IPMI firmware of many of its recent motherboards. On versions prior to SMT_X9_218 this service was running the Intel SDK for UPnP Devices, version 1.3.1. This version is vulnerable to the issues Rapid7 disclosed in February […]
Post Office Protocol version 3 (POP3) is an mail protocol used to retrieve mail from a remote server to a local email client. POP3 copies the mail from the remote server into the local mail client. Optionally, mail is deleted after it is downloaded from the server. This saves space on the server. If you […]
Visual Studio Code is a free IDE that is great for debugging, compiling, and building .NET Framework applications. https://code.visualstudio.com/ Let’s use a simple C# program to demonstrate a very basic workflow for decompiling .NET executables. First, let’s use Notepad++ to create a text file on the Windows virtual machine Desktop with the following code: We […]
While there are many tools that we could use to decompile Java bytecode (with various degrees of success), let’s checkout the JD-GUI decompiler. Java-based web applications primarily consist of compiled Java class files that are compressed into a single file, a Java ARchive, or JAR, file. Using JD-GUI, we can extract the class files and […]
https://www.technoherder.com/PenTestStudyNotes/common_ports.pdf https://www.technoherder.com/PenTestStudyNotes/Metasploit_Cheat_Sheet.pdf https://www.technoherder.com/PenTestStudyNotes/netcat_cheat_sheet_v1.pdf
https://www.technoherder.com/PenTestStudyNotes/PracticeExams2021.pdf
After finishing your pen test and writing the report, you should plan to have a discussion with the client about the findings in the report. During the formal hand-off process, you’ll need to get confirmation from the client that they agree that the testing is complete and that they accept your findings as presented in […]
In any case where an exploit will destabilize a live production system, you should be cleaning up directly after. However, for everything else, you can wait until the report has been handed off to begin your cleanup tasks. The purpose of these tasks is to ensure that there are no artifacts left over that an […]
Reporting Tips Report Data Normalization Data normalization is a term often associated with databases. In this sense, the database designer is looking to create a cohesive set of data that reduces data redundancy and increases data integrity. Sometimes your data might be presented to the client in a database, so this makes perfect sense. If […]
Mobile device management (MDM) is the process of tracking, controlling, and securing the organization’s mobile infrastructure. MDM solutions are usually web-based platforms that enable administrators to work from a centralized console. Using MDM, the organization can enforce its security policies, as well as manage applications, data, and other content, all at once on every mobile […]
by 
