Home page logo
/

pen-test logo Penetration Testing mailing list archives

RE: Pen test, tcp/1404 found - advice needed
From: "Craig Wright" <cwright () bdosyd com au>
Date: Sat, 17 Sep 2005 12:29:51 +1000

As stated on a prior post - get some training
 
People who try to pass as being capable of doing something they can not and who do not seek to remidy this are one of 
the major issues in the security industry. Start learning, start acting professionally and stop the generally 
unprofesional attitudes to the field of enterprise you profess to have the requisite knowledge.
 
The nomenclature "Sekurity Wizard" does nothing to help your case. If you think I am being mean, welcome to the real 
world. The attidutes of pseudo professionals with "no clue" harm the clients they profess to aid, the profession I love 
and society as a whole.
 
If you wish to learn I support your enterprise wholeheartedly. The issue is that you need to learn the job prior to 
doing it. Who would feel ok having a physician who had not completed university operate on them? The same applies where 
- learn first, than operate.
 
Craig

        -----Original Message----- 
        From: Sekurity Wizard [mailto:s.wizard () boundariez com] 
        Sent: Fri 16/09/2005 10:44 PM 
        To: pen-test () securityfocus com 
        Cc: 
        Subject: RE: Pen test, tcp/1404 found - advice needed
        
        

        SOCAT results are below:
        
        <results>
        
        ICA
        ICA
        ICA
        
        </results>
        
        That ICA is repeated every 10 seconds or so, of after a carriage return
        into the port.  Obviously it's a Citrix ICA box - the problem is how to
        get it to do my bidding...
        
        S.Wiz
        
        
        -----Original Message-----
        From: Andre Ludwig [mailto:andre.ludwig () gmail com]
        Sent: Thursday, September 15, 2005 4:14 PM
        To: Luke Eckley
        Cc: Sekurity Wizard; pen-test () securityfocus com
        Subject: Re: Pen test, tcp/1404 found - advice needed
        
        Use your level 45 remote service enumeration spell!  Be careful, as you
        wouldn't want your spell to trigger a recasting of "Perimeter ACL
        Blast".  Unless of course you have learned the always handy "Unholy
        0-day of Reckoning"; hell, that has its caveats.  Of course, being a
        Sekurity Wizard, you know all of this already, as opposed to a lowly
        mage such as myself.
        
        If all else fails, you may heed the guidance that the others have
        provided.  I hasten to suggest usage of a network fuzzer but none the
        less you may try it.
        
        Another possible solution (using socat), this will only read the first
        1000 bytes of output.
        
        socat - tcp:yourtargetip:1404,readbytes=1000
        
        http://www.dest-unreach.org/socat/doc/socat.html#EXAMPLES
        
        Dr3
        "security mage and jester"
        
        On 9/15/05, Luke Eckley <luke () xifos org> wrote:
        > Sekurity Wizard wrote:
        > > Hey folks,
        > >       Found tcp/1494 open to a server during a pen test, black-box
        > > style.  Are there any interesting tools that may be available to
        > > extract information from the server on the receiving end?
        >
        > The easiest thing to do is telnet (or use netcat) to the port to see
        > if it responds with a version or any other information.
        >
        > Also if you know the OS, then just google for that port and narrow
        > down your results by OS.
        >
        > Luke
        >
        > ----------------------------------------------------------------------
        > -------- Audit your website security with Acunetix Web Vulnerability
        > Scanner:
        >
        > Hackers are concentrating their efforts on attacking applications on
        > your website. Up to 75% of cyber attacks are launched on shopping
        > carts, forms, login pages, dynamic content etc. Firewalls, SSL and
        > locked-down servers are futile against web application hacking. Check
        > your website for vulnerabilities to SQL injection, Cross site
        scripting and other web attacks before hackers do!
        > Download Trial at:
        >
        > http://www.securityfocus.com/sponsor/pen-test_050831
        > ----------------------------------------------------------------------
        > ---------
        >
        >
        
        
        
        ------------------------------------------------------------------------------
        Audit your website security with Acunetix Web Vulnerability Scanner:
        
        Hackers are concentrating their efforts on attacking applications on your
        website. Up to 75% of cyber attacks are launched on shopping carts, forms,
        login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
        futile against web application hacking. Check your website for vulnerabilities
        to SQL injection, Cross site scripting and other web attacks before hackers do!
        Download Trial at:
        
        http://www.securityfocus.com/sponsor/pen-test_050831
        -------------------------------------------------------------------------------
        
        


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]