Re: [PEN-TEST] Hypothetical Wargaming

[Mark Teicher <mark.teicher () NETWORKICE COM>]

This seems a bit simple.  Why not scale the wargame to 100 or 1000 of
Windows based machines, then what would be one's methodology to cull all
the information together.  What type of script/techniques would be used.

PEN-TESTING usually is a few identified machines and one hope that rest of
the environment is the same, but in most large scaled enterprises that is
not the case.

/m

At 11:52 AM 10/7/00 +0000, H Carvey wrote:
> Assume you're given a pen test.  All you have is a
> domain name.  A couple of quick checks tell you
> that the systems in question are Win32 machines.
>
> Your goal is to "tag" a file.  No DoS allowed.
>
> IIS, Exchange, and MS DNS are being used.
>
> What steps do you take?  At each step, what do you
> hope to gain, and what programs/scripts/techniques
> do you use (give program name, and command line
> switches/GUI options)?
>
> At each step, assume both NT and Win2K.