Pen-Testing and Metasploit Question

[rafael.pandini at gmail.com (pandini pandini)]

Matt Gardenghi, TK and BN thanks for your replies !

 One quote about Matt Gardenghi reply, about writing a good report.
Just a .pdf document, containing all vulnerabilities found (Machine
XXX vulnerable to ms08-069), its severity (Critical), and how to fix
it (some link to a patch) ? Other informations (If I was asked to do
it)  like credentials grabbed(Plain text/hashed passwords),
informations about hosts and devices (running linux, apache, etc), if
the target has some database then some tables of an database, or
source codes from the a internal cvs server of the company, as "proof"
of what can be done by an attacker is usefull or just say "passwords
can be stolen" ?

 About the report, someone has some "model" or example of report that
can be shared with us ?

 I agree with you TK about certifications, and I seriouly thinking
about CEH certification. But I have no ideia from where to start,
someone knows a good book/material ?

 Thanks in advance,
 Pandini.

On 4/23/09, Ben Nell <enemy.cow at gmail.com> wrote:
> A good place to look for help with these types of questions might be
> the Security Focus pen-test list.  You can read some details about it
> at http://seclists.org/#pen-test.
>
> A lot of this sort of thing has already been discussed, so you could
> probably find a lot of useful information reading through the
> archives.
>
> BN
>
> > pandini pandini wrote:
> > > ?I'm in the same boat that professor, trying to get into pentest
> > > industry but I don't know "where to start". I agree with what max
> > > said, imho methodology is the center of the thing, know how and why,
> > > is really better than know "where to click" or what command to run.
> > >
> > > ?My questions are, "What the industry expect from a pentester" (audit
> > > database, software source code, networks, servers , etc..), "What is
> > > generally done in a basic pentest", and what certifications are "good"
> > > to proof some basic knowledge. Just say to a company that "I'm able to
> > > do a pentest, can you give me a change ?" will don't work.
> > >
> > > ?I think that I need some formal proof of knowledge, as I haven't any
> > > professinal experience in pentest, this is the only one way that I
> > > see.
> > >
> > >
> > >
> > > ?Thanks in advance,
> > > ?Pandini.
> > > _______________________________________________
> > > https://mail.metasploit.com/mailman/listinfo/framework
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework