From: David Ball (lostinvietnam@hotmail.com)
Date: Thu Mar 30 2006 - 00:23:38 EST
Joel
First things first. You should really bring any gaping security holes that
you identify early in the pen-test engagement to the attention of the client
and stop all testing until the issue can be properly addressed. From your
wording it seems that the hole is pretty big. Also you typically have a
communication process agreed up front with the client where you confirm that
the client is ok to proceed with you exploiting a vuln service. Hopefully
they give you the ok but it's not uncommon for a client to be satisfied with
the "this is what we could do". Having said that the less restrictions on
you the better from both parties point of view as it makes for a more
realistic pen-test.
David.
>
>"Joel Jose" <joeljose420@BonBon.net>
>No Phone Info Available
>03/30/2006 12:03 AM
>
>To
><pen-test@securityfocus.com>
>cc
>
>Subject
>vulnerability scanners not effective? or just a false-positive?
>hy ppl,
> i was pen-testing a network. First i do a manual check with my
>own methods, i use nmap,hping,metasploit,telnet,dig,whois..etc and then
>for the confirmation i scan with nessus, just to be sure that i havent
>overlooked any. But, today something very strange happened; i found a huge
>vulnerability which could drastically compramise the network. The
>directories were not protected. I could easily access the template
>directory, and view the internal directory structure. I even got access to
>a few files, which contained backup data of some of thier old employees.
>now, if i had "known" the names of the *important* diectories, i am sure i
>would have been able to access them as a piece of cake. Ofcourse the
>network is
>safe as long as the attacker doesnt "learn" the name of the important
>directories. But i think it is a very "huge" vulnerability. and nessus
>didnt even give a hinch!!
>
>and one more quest. How many of you think that the existance of the
>default
>banners in services(eg apache default error pages) are a security threat,
>if
>not high, atleast medium?. I do.
>
>joel.
>
>
>
>------------------------------------------------------------------------------
>This List Sponsored by: Cenzic
>
>Concerned about Web Application Security?
>As attacks through web applications continue to rise, you need to
>proactively
>protect your applications from hackers. Cenzic has the most comprehensive
>solutions to meet your application security penetration testing and
>vulnerability management needs. You have an option to go with a managed
>service (Cenzic ClickToSecure) or an enterprise software (Cenzic
>Hailstorm).
>Download FREE whitepaper on how a managed service can help you:
>http://www.cenzic.com/forms/ec.php?pubid=10025
>And, now for a limited time we can do a FREE audit for you to confirm your
>
>results from other product. Contact us at request@cenzic.com
>------------------------------------------------------------------------------
>
_________________________________________________________________
Learn English via Shopping Game, FREE!
http://www.linguaphonenet.com/BannerTrack.asp?EMSCode=MSN06-03ETFJ-0211E
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:46 EDT