Re: Level of Exploitation

[Goni Sarakinov <gsarak () sarakinovconsulting com>]

pentestr wrote:
> Hi list,
>
> I have come across a situation where I need to specify the "Level of
> Exploitation" to the client ( a govt. agency). I was able to do SQL
> Injection, Cross Site Scripting attacks against the web application. 
> Could you share your ideas about level of exploitation. What level we
> can give for SQL Injection, Cross site scripting, buffer overflow, TCP
> stack exploit,etc
>
> thanks in advance
> Pen Testr

I would ask them for a sample of previous reports or a definition
document outlining the various levels that their management has agreed
upon or been told to comply to.


-- 
Goni.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------