Metasploit mailing list archives
The Perfect Pen Test? Your opinions?
From: angelisonline at gmail.com (Mr Gabriel)
Date: Fri, 23 Jan 2009 15:44:48 +0000
Dear All, Thanks for taking the time to read this message. First off - I'd like to say to HD Moore and co; keep up the damn fine work, and also to everyone on this list who helps others who have issues, (and I mean MSF based issues, not like, "my wife left me, because she caught me in my PA" type issues :) ). I've been trying for a long time to get my head around pen testing, and for me it's not too much of a problem to understand, I usually explain in in these four steps, - Take a look around the network, to find as many end points as possible - Take a look at each end point to see what services are running on which ports, - Match the service, service version, port, and OS, to a known vulnerability - Make use of the vulnerability, hence, proving a security breach/hole/issue - ( I know this is a fifth step, but you could also use fuzzing, if no prior known vulnerability exists ) Now, I've had numerous discussions with people that think there is much more to pentesting that what I just stated, and my argument is that, unless I already have a target in mind, how can I be more specific? It was at that point, I realise that people tend to have personal approaches to a pen test rather than a general approach - which leads me to my question - What would be your perfect pen test approach? Personally, I think the steps I have outlined, is the best principal you can follow, but I will be delighted if someone could not only prove me wrong, but improve on it :) The scenario is as follows; You are presented with an unknown network, you have no prior knowledge, other than the fact that it is an IP4 based network. You must prove that it has the potential to be compromised - what are your steps? -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.metasploit.com/pipermail/framework/attachments/20090123/7ef64e95/attachment.htm>
Current thread:
- The Perfect Pen Test? Your opinions? Mr Gabriel (Jan 23)
- The Perfect Pen Test? Your opinions? Cash (Jan 23)
- The Perfect Pen Test? Your opinions? Robin Wood (Jan 23)
- The Perfect Pen Test? Your opinions? Donnie Werner (Jan 23)
- The Perfect Pen Test? Your opinions? Tommy Elliott (Jan 23)
- The Perfect Pen Test? Your opinions? MaXe (Jan 27)