Home page logo

pen-test logo Penetration Testing mailing list archives

Re: [SPAM] RE: Pen-Test as a favor
From: Dogten <dogten () d3fcon org>
Date: Thu, 13 Jul 2006 20:58:11 -0500

techlists () comcast net wrote:
I would like to second that suggestion about practicing with the tools in your own lab first.

I had a friend that ran a small ISP that allowed me to try a vulnerability scan on his network, with my promise that the 
tools wouldn't change anything; it would all be passive testing.

Nessus, it seems (at least at that time, maybe different now), when running an IIS test, deleted the index.htm file on a webserver, which wiped 
out this fellow's online webmail application. Needless to say, he was quite a bit peeved at the "service" I was providing him 
"as a favor".

When someone's livelihood is depending on the network you're testing, you don't want to make such mistakes. Practice with 
your tools a lot before you touch someone else's network!

Such silliness, networks will collapse, servers will crash, it is inevitable. The IIS admin should not have let his box be pentested without a current bare-metal capable back up. Whether your friend knows it or not you helped him see at least one thing he is grossly vulnerable to. Ewwww, I hate ending in a preposition. Honesty in advertising for pen-testers should have them begin converations with "do you have a current tested backup mechanism and is your backup onsite and up to date? good, some of my tools might crash stuff you did not configure correctly...."

___________________          _-_
\==============_=_/ ____.---'---`---.____
            \_ \    \----._________.----/
              \ \   /  /    `-_-'
         /____          ||-
-dogten, CĀ²ISSP
Fight the power and the power will fight back
you're only as good as the system you hack
if you become a problem you will be replaced
banned, shut down, erased !

This List Sponsored by: Cenzic

Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]