Re: External Penetration Question

["crazy frog crazy frog" <i.m.crazy.frog () gmail com>]

simple!!
when someone r00t ur pc which is connected to the external network
then he will use tht system to compormise the internal lan of ur
network.because that pc is also connected to internal network so he
can access then and try to exploit them :)
-CF
---------------------------------------
http://www.secgeeks.com
---------------------------------------

On 8/10/06, thatch <leethatcher () gmail com> wrote:
> This does help me understand, and now you've pointed it out i see how it
> would work for example when i've been telnet'd into a network device and
> from there i have connected to another device etc....
>
> Thanks.
>
>
> Michael Krymson wrote:
> >
> > There are a couple of things to say about this.
> >
> >
> >
> > 1) Do you host your corporate web site on the Internet? This would be
> > publicly accessible and thus part of an external pen-test. In addition, if
> > you manage a lot of your own infrastructure, that would also be valid
> > (DNS, mail servers).
> >
> >
> >
> > 2) The firewall itself, by its own nature, has to be accessible from the
> > outside world for you to get Internet access. Therefore, the firewall
> > itself can be tested for misconfigurations, default accounts, etc.
> > Besides, you never know if an admin poked a hole for himself to get to his
> > computer from home, and never fixed that up...
> >
> >
> >
> > 3) Lastly, what if you did have some web servers or a misconfiguration? I
> > could poke at your web servers for a hole. If I find one, your NAT'd IP
> > space means nothing now. Once I get control of one system inside your
> > network, I can use its network context for further attacks.
> >
> >
> >
> > Think of it like one enemy attacker getting inside your walls and holing
> > up inside a building that you thought was safe. He can scout and move into
> > other buildings at will, using your own streets and streetlamps, your
> > internal network and IP space.
> >
> >
> >
> > Does that help a bit?
> >
> > ---------------------------------------------------------------------------
> > This list is sponsored by: Norwich University
> >
> > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> > The NSA has designated Norwich University a center of Academic Excellence
> > in Information Security. Our program offers unparalleled Infosec
> > management
> > education and the case study affords you unmatched consulting experience.
> > Using interactive e-Learning technology, you can earn this esteemed
> > degree,
> > without disrupting your career or home life.
> >
> > http://www.msia.norwich.edu/secfocus
> > ---------------------------------------------------------------------------
> >
> >
> >
>
> --
> View this message in context: http://www.nabble.com/External-Penetration-Question-tf2071662.html#a5748621
> Sent from the Security Basics forum at Nabble.com.
>
>
> ---------------------------------------------------------------------------
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> The NSA has designated Norwich University a center of Academic Excellence
> in Information Security. Our program offers unparalleled Infosec management
> education and the case study affords you unmatched consulting experience.
> Using interactive e-Learning technology, you can earn this esteemed degree,
> without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> ---------------------------------------------------------------------------


--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
"oh yeah oh yeah...
another wannabe, in hackerland!!!"

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------