From: Dogten (dogten@d3fcon.org)
Date: Thu Jul 13 2006 - 21:58:11 EDT
techlists@comcast.net wrote:
> I would like to second that suggestion about practicing with the tools in your own lab first.
>
> I had a friend that ran a small ISP that allowed me to try a vulnerability scan on his network, with my promise that the tools wouldn't change anything; it would all be passive testing.
>
> Nessus, it seems (at least at that time, maybe different now), when running an IIS test, deleted the index.htm file on a webserver, which wiped out this fellow's online webmail application. Needless to say, he was quite a bit peeved at the "service" I was providing him "as a favor".
>
> When someone's livelihood is depending on the network you're testing, you don't want to make such mistakes. Practice with your tools a lot before you touch someone else's network!
>
> PG
Such silliness, networks will collapse, servers will crash, it is
inevitable. The IIS admin should not have let his box be pentested
without a current bare-metal capable back up. Whether your friend knows
it or not you helped him see at least one thing he is grossly vulnerable
to. Ewwww, I hate ending in a preposition. Honesty in advertising for
pen-testers should have them begin converations with "do you have a
current tested backup mechanism and is your backup onsite and up to
date? good, some of my tools might crash stuff you did not configure
correctly...."
--
___________________ _-_
\==============_=_/ ____.---'---`---.____
\_ \ \----._________.----/
\ \ / / `-_-'
__,--`.`-'..'-_
/____ ||-
`--.____,-'
-dogten, C˛ISSP
_________________
Fight the power and the power will fight back
you're only as good as the system you hack
if you become a problem you will be replaced
banned, shut down, erased !
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:17 EDT