Penetration Testing: Re: Pen testing techniques

[intel96 <intel96 () bellsouth net>]

Hi Atif,

While Core Impact is a great tool, it is only that a tool.  For example, 
Tool-vs-Human...not to long ago, I had to prove my professional salt to 
a customer concerning a potential pentest project.  My skills were 
tested against a security tool vendor, which was using their tool as a 
selling point.  The security vendor lost, because their tool did not 
find any vulnerabilities.  The reason the tool lost was, because it 
could not think like a human.   Which is my main point!  

Sometimes by stepping back and looking at the underlying site you may 
find a vulnerability.  For example,  the tool vendor lost, because it 
was not designed to identify or find vulnerabilities in SAP web-enabled 
applications.
More non-tool examples:

Once, I found a major security issue by reviewing the source code on the 
web site.  Within the source code I found a username and password that 
was left over by the development team.
Another time, I modified a web site's underlying source code to gain 
access to multiple customer accounts. 

Another time, I used Google to find customer usernames and passwords for 
test site that linked into the production database.
I could continue this list, but why...my point is to take a step back 
and look at the site(s) without any automated tools to see what may lay 
underneath the covers.....
Sorry for the lecture, but I have had my share in the last few decades 
too............
Good luck with the project!

Cheers,
Intel96

Atif Azim wrote:
> Hello,
> I am new to pen testing and am currently involved in doing an external
> pen test for one of our clients.We are doing it through Core
> Impact.Reconnaisance showed only port 80 as open and the web server
> running IIS 6.0.Core Impact did not find any vulnerabilities in the
> server and hence was unable to penetrate.The web application was also
> tested for SQL Injection and PHP remote file inclusion and did not
> find any vulnerabilities there either.
>
> My question is what else can we do besides relying on Core Impact for
> this pen test.And what impression can a client get if we say to them
> that there are no vulnerabilites in your network or web app.Its
> dificult to digest something like that for a security specialist that
> everythings alright.
>
> Looking forward to some great views.Thanks.
>
> Regards,
> Atif Azim
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------
>
>
>   

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------