Jump to content

digininja

Global Moderators
  • Posts

    4,005
  • Joined

  • Last visited

  • Days Won

    210

Posts posted by digininja

  1. You are talking about sites on different hosts, I'm talking the same host. If you have two sites, both on different virtual machines, then cross site access becomes a lot harder.

    I've done it plenty of times for sites on the same host, get RCE or LFI through site one and use it to compromise a second site.

    On different virtual machines you need to look for things like trust relationships between the hosts. I've seen multiple machines all mounting the same file share which contains all the sites the company hosts.

  2. 11 hours ago, tamir cohen said:

    right now i work as penetration tester for a little compay who protects from mobile hacking

    If you aren't in a team and the rest of the company don't know anything about jail breaking phones then I think there is something wrong with the company's business model.

    • Like 3
  3. Once you go out of support for security patches you don't get any more unless something hits that is so bad that the manufacturer deems it worth putting out a special patch.

    Remember, despite the 5x being the most recent, it came out in October 2015 so had 3 years of support.

    Rooting a device generally makes it more vulnerable than less as the apps installed on it can do more damage. I'd stick with what is there and hope nothing is found rather than deliberately introducing more risk with a root.

  4. First, it depends on your location and local laws, check those as they may limit what you can do.

    In the UK, and I'd guess the USA, it depends how you use it. If you use it in a lab at home and don't attack anyone else, it's fine, if you use it against a client where you have a contact, that's fine, if you use it in school or the local shopping centre to attack random strangers, that's not fine.

    • Like 1
  5. Check their advisories for known issues. Why are you particular interested in the login panel?

    If it is secure enough is a question only you can answer. Do a risk analysis, work out your threats and then decide 

×
×
  • Create New...