Joel
First things first. You should really bring any gaping security holes that
you identify early in the pen-test engagement to the attention of the client
and stop all testing until the issue can be properly addressed. From your
wording it seems that the hole is pretty big. Also you typically have a
communication process agreed up front with the client where you confirm that
the client is ok to proceed with you exploiting a vuln service. Hopefully
they give you the ok but it's not uncommon for a client to be satisfied with
the "this is what we could do". Having said that the less restrictions on
you the better from both parties point of view as it makes for a more
realistic pen-test.
David.
"Joel Jose" <joeljose420@BonBon.net>
No Phone Info Available
03/30/2006 12:03 AM
To
<pen-test@securityfocus.com>
cc
Subject
vulnerability scanners not effective? or just a false-positive?
hy ppl,
i was pen-testing a network. First i do a manual check with my
own methods, i use nmap,hping,metasploit,telnet,dig,whois..etc and then
for the confirmation i scan with nessus, just to be sure that i havent
overlooked any. But, today something very strange happened; i found a huge
vulnerability which could drastically compramise the network. The
directories were not protected. I could easily access the template
directory, and view the internal directory structure. I even got access to
a few files, which contained backup data of some of thier old employees.
now, if i had "known" the names of the *important* diectories, i am sure i
would have been able to access them as a piece of cake. Ofcourse the
network is
safe as long as the attacker doesnt "learn" the name of the important
directories. But i think it is a very "huge" vulnerability. and nessus
didnt even give a hinch!!
and one more quest. How many of you think that the existance of the
default
banners in services(eg apache default error pages) are a security threat,
if
not high, atleast medium?. I do.
joel.
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to
proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic
Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
_________________________________________________________________
Learn English via Shopping Game, FREE!
http://www.linguaphonenet.com/BannerTrack.asp?EMSCode=MSN06-03ETFJ-0211E
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
