3 ms·
That's right, any pentester worth anything will know the stack used in a few seconds by looking at cookies or even sometimes just by the login page's url. For e
by welder 7y ago
That's right, any pentester worth anything will know the stack used in a few seconds by looking at cookies or even sometimes just by the login page's url. For ex: different frameworks have different session and csrftoken naming, Rails and Django have recognizable url conventions, and there's always default error pages that usually give away the framework used.
Sharing is caring, be secure not paranoid :)
- czbond 7y agoNo - they won't. If you have a very simple front end stack, and application stack or infrastructure sure. But if I'm needing to traverse networks, or only directly get to a database - that's different than some silly nmap script kiddy scan. Remember it is often easier to penetrate around the gates where everyone is looking (some app stack + OWASP top 10) to instead focus getting inside a network (your dev's laptop, vpn connection, social engineered access, malware to your CEO or sales team, Wi-Fi connection to intercept the VPN tunnels, etc). Or i'm looking for holes in Docker versions to root, Kubernetes flaws, virtual machine dependencies, how many microservices layers do I have to deal with, etc etc.