Re: [PEN-TEST] How to "break into" the Pen-Testing field

["Frasnelli, Dan" <dfrasnel () COREWAR COM>]

> One is absolutely correct, it really depends on the type of penetration
> test one is engaged to conduct.
> But what really is Industry Best Practices.  I know some high end

I imagine SANS or similar group has a list of recommended practices.

Security auditing IBP is a sticky subject, so preface everything below
with glowing neon "in my humble opinion" signs.

On paper, all IBPs serve at least two purposes:
- peace of mind for the client/consumer
- legal coverage (aka. CYA insurance) for the provider and their employees

When it comes to pen testing, your "IBP" is best determined by the
client's requirements document and contract terms.
If it reads "discover which hosts are visible on the internet",
out comes a portscanner or similar util.
If it reads "compromise the internal customer database using all necessary
 means", out comes the phosphorephic VT320 O' Doom, wirecutters, C4
and a 10 gallon drum of coffee.

Really, though.. the point of penetration testing is to mimic an
unpredictable, chaotic attacker.
I've mentioned this in other forums, and I'll mention it here:
information security is one part technology, one part psychology.
You cannot boil down a sophisticated attacker's techniques into
logical rules and process trees.

> What tool would be used first and what would be the secondary tool to
> validate any false positives one may discover???  Is there any manual
> massaging of the data??

In very generic terms.. a vulnerability scan is the first tool,
exploitation of the vulnerability is the second tool which validates
the finding.  Of course, this is subject to terms of your contract.

> Would you turn over the raw data to the customer??

Without hesitation.  If not the raw data, slightly formatted data
not far up the chain.
Results from a penetration test usually have three parts:
a) executive summary
b) "raw data" (or close facsimile)
c) recommendations

You want to provide actual data to validate your recommendations and
provide the client's technical staff a good starting point.

-dan