Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: [PEN-TEST] First step of a pen-test
From: "Tonick, Mike" <Mike.Tonick () PS NET>
Date: Tue, 19 Sep 2000 11:33:19 -0500

Christopher,

Here is a short list provided courtesy of some of my SANS training:
- Gather DNS Information
- Whois information
- NSLookup information
- Ping information
- Traceroute information
- Map the network
- Determine the network mask
- Perform port scanning
- Begin running your exploits

Regards,

Michael D. Tonick, CISSP
Senior Security Consultant
Perot Systems
Dallas, Texas

-----Original Message-----
From: Christopher M. Bergeron [mailto:ChrisB () HGSS COM]
Sent: Monday, September 18, 2000 1:39 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: First step of a pen-test


What is the industry norm for _beginning_ a pen-test after the contract has been made?  Would one first map the 
network?  Try to war-dial the exchange for possible remote (pcanywhere, etc). access machines?  VRFY email addresses to 
look for user logins?  Is it typical to ask for information about the network (ie. network architecture) beforehand or 
do most pen-tests start "blindly" and do the network reconnaissance.

Thanks to anyone who addresses even one of my many questions.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]