Dailydave mailing list archives
Re: Immunity Certified Network Offense Professional
From: "matthew wollenweber" <mwollenweber () gmail com>
Date: Sun, 13 Jul 2008 20:06:22 -0400
I'd like to add two points to this discussion. First is that a key value I try to present to clients is that pen testing shows business impact. It lets a manager understand why security is important to the business. A list of vulnerabilities for IPs doesn't demonstrate quite the same impact as controlling some core business system. So successfully exploiting vulns is important to me. Second, I see terribly insecure apps across enterprises all the time. They're niche products or internally developed that often sit on key systems. They usually don't have public vulns because they're internal or niche but if you sit down with them they're generally easy enough to break. So doing so is reasonable way to get into a fully patched system. It also makes you look good and reinforces security best practices like compartmentalization, defense in depth, etc. So while I agree pen testers don't need to be exploit developers and it isn't a skill that's always needed, I'd add that it is one that can really turn a vanilla assessment into cool work. On Sun, Jul 13, 2008 at 3:03 PM, Thomas Ptacek <tqbf () matasano com> wrote:
The problem I see with this is that people that can't write a simple exploit also cannot to other very important tasks such as: - Decide if a crash is exploitable at allPlenty of people who can't write X86 assembly can discern whether a flaw allowed them to corrupt memory. Plenty of people who can write X86 assembly, like myself, are content to leave it at that: memory corruption bad. MUSTFIX.- Make a judgement about the reliability of any exploits writtenThis is circular. Sure, if you write exploits, knowing how to do so reliably will in fact improve the quality of the checks you write for your company's scanner.- Debug the crash to see what input caused the crash in a reasonabletime limit This isn't true. Basic investigative skills, of the sort possessed by many 2nd tier call center operators, coupled with the ability to generate malicious outputs, and you've got this one nailed. I agree it's important, so test for it.- Discuss possible fixes intellegentlyWhat does ret-to-libc have to do with knowing how to manage sign bits, check multiplications, or bound copies?- Apply knowledge of the crash to other areas of the program to ensure that the bug isn't repeated and that the fix is in fact completeIt really sounds like you want to test people's ability to write fuzzers. Amen to that. I'm not sure where the shellcode comes in to it, though. -- --- Thomas H. Ptacek // matasano security read us on the web: http://www.matasano.com/log _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
-- Matthew Wollenweber mwollenweber () gmail com | mjw () cyberwart com www.cyberwart.com
_______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Immunity Certified Network Offense Professional Dave Aitel (Jul 11)
- Re: Immunity Certified Network Offense Professional Blue Boar (Jul 11)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 11)
- Re: Immunity Certified Network Offense Professional Alexander Sotirov (Jul 11)
- Re: Immunity Certified Network Offense Professional Rodney Thayer (Jul 12)
- Re: Immunity Certified Network Offense Professional root (Jul 12)
- Re: Immunity Certified Network Offense Professional Dave Aitel (Jul 12)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 13)
- Re: Immunity Certified Network Offense Professional Pusscat (Jul 13)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 13)
- Re: Immunity Certified Network Offense Professional matthew wollenweber (Jul 13)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 13)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 11)
- Re: Immunity Certified Network Offense Professional val smith (Jul 14)
- Re: Immunity Certified Network Offense Professional Blue Boar (Jul 11)
- Re: Immunity Certified Network Offense Professional Paul Melson (Jul 13)
- Re: Immunity Certified Network Offense Professional drraid (Jul 13)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 13)
- Re: Immunity Certified Network Offense Professional root (Jul 14)
- Re: Immunity Certified Network Offense Professional Thomas Ptacek (Jul 14)
- Re: Immunity Certified Network Offense Professional Paul Melson (Jul 14)
- Re: Immunity Certified Network Offense Professional val smith (Jul 15)
- Re: Immunity Certified Network Offense Professional Dino A. Dai Zovi (Jul 16)