In my opinion penetration testing is nothing more than legal cracking.
Breaking into computers doesn't make you a hacker.
I can teach my girlfriend how to run nessus over the Internet and use
the Metasploit web interface in a few hours. In just one day I can
teach her how to successfully find vulnerable hosts on the internet
and how to break into them gaining root access.
This doesn't mean she will become a hacker, it just means that she
learned a few techniques that allow her to break into computers.
Sadly enough, even big corporations are vulnerable to these types of
attacks because you still see machines these days not being patched
regularly.
Anyways, from my experience in penetration testing the hacking kicks
in when it seems that there is nothing left you can try to break into
a system. That's the hard part, that's when creativity and "thinking
outside the box" kicks in.
For those that think that a magic paper or lesson will teach them
everything they need, they will always be doomed to not be able to
discover new things by themselves.
I agree with the previous posts: experiment! Don't expect people to
teach you. Try techniques you read about and try to come up with new
attacks on your own, without having to go to the next chapter in a
book.
So far, the people I've met that I consider true hackers are people
that try to come up with interesting ideas and experiment with them.
That's all it's about.
IMHO hacking is not for people that believe in theory.
On 11/23/05, pagvac <unknown.pentester@gmail.com> wrote:
In my opinion penetration testing is nothing more than legal cracking.
Breaking into computers doesn't make you a hacker.
I can teach my girlfriend how to run nessus over the Internet and use
the Metasploit web interface in a few hours. In just one day I can
teach her how to successfully find vulnerable hosts on the internet
and how to break into them gaining root access.
This doesn't mean she will become a hacker, it just means that she
learned a few techniques that allow her to break into computers.
Sadly enough, even big corporations are vulnerable to these types of
attacks because you still see machines these days not being patched
regularly.
Anyways, from my experience in penetration testing the hacking kicks
in when it seems that there is nothing left you can try to break into
a system. That's the hard part, that's when creativity and "thinking
outside the box" kicks in.
For those that think that a magic paper or lesson will teach them
everything they need, they will always be doomed to not be able to
discover new things by themselves.
I agree with the previous posts: experiment! Don't expect people to
teach you. Try techniques you read about and try to come up with new
attacks on your own, without having to go to the next chapter in a
book.
So far, the people I've met that I consider true hackers are people
that try to come up with interesting ideas and experiment with them.
That's all it's about.
IMHO hacking is not for people that believe in theory.
On 11/23/05, Barrie Dempster <barrie@reboot-robot.net> wrote:
On Tue, 2005-11-22 at 23:57 -0500, Valdis.Kletnieks@vt.edu wrote:
Keep in mind that 98% of systems are nailed by either automated worms or
people running canned stuff. Just because it's not "real hacking" doesn't
mean it doesn't actually work in practice.
Quite right, the majority of security incidents dealt with by
administrators (the guys that have a use for these courses) are the
automated/canned/known attacks, so for people in that position an
understanding of these attacks is extremely important for their own
network defense. These courses usually market themselves to the guy
looking to understand how systems are compromised. They are most useful
for pen-testers that rely on vulnerability scanners and the sysadmin
looking after his network.
For the guys writing the exploit code and figuring out to work around
things like ProPolice and DEP these courses won't help - no matter how
in depth they are, because figuring these sort of details out doesn't
require any knowledge you can be taught in a classroom, it requires
dedication and in most cases addiction to the task.
There definitely is a market and a value in these courses as they raise
the general security awareness of network administrators. A common
question among guys working in these sort of roles is "How do I get to
do that cool security stuff", the sad thing is the fact that they don't
already know the answer means they probably will never be any good, as
the most important part of it is ingenuity and initiative as well as the
dedication/addiction mentioned above.
The common mantra used within this sort of training is "think like an
attacker". My opinion is if you have to be taught that, you can never
think like an attacker, because the attacker doesn't have to focus his
thoughts he is always, automatically, looking for a way
around/over/under/through. The guy trying to think like an attacker is
focusing on his adversary when the real focus should be his systems,
because that's where the attackers focus is.
--
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue
"He who hingeth aboot, geteth hee-haw" Victor - Still Game
blog: http://reboot-robot.net
sites: http://www.bsrf.org.uk - http://www.security-forums.com
ca: https://www.cacert.org/index.php?id=3
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
