The approach should depend on the scope of the
project. Do they only want to find application
vulnerabilities, or do they want to know what an
application user might be able to do beyond their
authorization level? Testing only the application
would not include testing the platform. It can be
assumed to have typical Windows vulnerabilities and
should be tested, but for a variety of reasons, the
customer's internal audit team, security officer, etc.
might not want that to be part of this project.
There might be many other things to include in the
scope depending on their organizational policies and
whether there is a security policy defined for the
system and application. While written policies are
often badly written and fail to take significant
factors into account, they at least give you an idea
of the organization's concerns and intent. Good to
review if they exist.
--- IRM <irm@iinet.net.au> wrote:
Dear All,
On my recent pen-test, I need to deal with an
application that sitting
on the remote host. The way its works is that the
client need to connect
to the remote server through Citrix and run the
application.
1) I feel that this is quite challenging pen-test as
I do not have full
control to the remote server. This gets me thinking
that apart from
analyzing the traffic from the client PC to remote
host and input
validation checking. Is there any thing that I could
possibly do?
2) I noticed that the Citrix Client (Citrix Program
Neighborhood 7) used
Basic Level encryption. I couldn't find anything in
regards to this
Basic Level Encryption as to which algorithms that
Citrix uses. I was
wondering whether this Basic Encryption could be
cracked easily. Any
thought around this?
Cheers,
John
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
____________________________________________________________________________________
Moody friends. Drama queens. Your life? Nope! - their life, your story. Play
Sims Stories at Yahoo! Games.
http://sims.yahoo.com/
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
