Re: Any security attack state model

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2005-07-07 ricci wrote:
> I have been working on IT security attack methodology. Is there any
> security attack methodology and category information that has been
> adopted by IT market?
>
> Besides, as I thought through security attack methodology, there
> should be some step by step attack states. That is, after port
> scanning, you will be able to attack web, etc. Is there any
> methodology or good reference document?

Maybe I am not getting your point here, but I doubt there is such a
thing as an "attack methodology". An attacker will try to find and
exploit things their counterparts failed to consider (and will also try
to disguise their activities), so they will most likely try to *avoid*
any methodology.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq