Home page logo
/

basics logo Security Basics mailing list archives

Re: pen test
From: "Serg B" <sergeslists () gmail com>
Date: Thu, 13 Dec 2007 09:06:34 +1100

To perform an ethical-hack you need a disclaimer form clearly
outlining what you are going to do and what you are not going to do.
For example, will you be held liable if your test crashes a server and
as a result costs a web hosting company thousands of dollars in lost
revenue during the down-time (depending on the size of the company
damage can be calculated in thousands of dollars per minute)? You need
a very detailed disclaimer form outlining what is and is not in scope,
techniques used and an outline of risk to the company. If you "just"
have a go you may get away with it or you may be sharing a studio
apartment in a federal "holiday reserve" with some hairy guy, for a
very long time - your choice.

Also keep in mind that some companies will not want to be audited by
untrusted source, what assurance do they have that you will not
publish your findings on the Internet, hand them over to the
competitors or sell personal data acquired during the test?

   Serg

On Dec 11, 2007 11:13 PM, Worrell, Brian <BWorrell () isdh in gov> wrote:
Michael,

Am I wrong, but there are lots of practices and in some cases laws that
say that you need to run  vulnerability assessments to be compliant.
If you were to ask you web host in writing before doing it, that should
solve the possible "legality" issue that it sounds like you talking
about.

As far as I know, White Hat hacking has never been illegal, if done
correctly and above board.  If it was, why would SANS and other offer
Certified Hacker classes and certs?

Thanks
Brian

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Michael R. Martinez
Sent: Monday, December 10, 2007 7:54 PM
To: Marty Resnick; listbounce () securityfocus com; security-basics
Subject: Re: pen test

Marty,

absolutely not, this is called hacking. Pen testing is actively
exploiting a server, identifying a weakness exploiting gaining access.
Are you talking about scanning ports? Could you provide a little more
detail. If you mean pen-testing, then the answer is no.

Cheers
------Original Message------
From: Marty Resnick
Sender: listbounce () securityfocus com
To: security-basics
Sent: Dec 10, 2007 9:35 AM
Subject: pen test

Am I able to pen test or run a vulnerability assessment on my web
hosting company. I got the idea after reading this article.
http://www.securitypark.co.uk/Security_article.asp?articleid=260173

--
Marty Resnick
Techmaking Inc.
(877) 291-1110 (office)
(661) 209-2089 (mobile)
(805) 512-9603 (fax)
marty () techmaking com



Michael R. Martinez
TF: 800-987-7307



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault