Re: [PEN-TEST] How to "break into" the Pen-Testing field

["Teicher, Mark" <mark.teicher () NETWORKICE COM>]

Wouldn't the first tool one would utilize is www.arin.net or
www.internet.net to collect information regarding the IP addresses and
hosts associated with the site, and technical, administrative, billing
contacts, also the address, city, state, zip, plus phone number (if updated
correctly).. Thus giving you several pieces of information in order for one
to start their pen security roadmap??

So basically this would be the first step in the network/host discovery
process and some information for social engineering...

At 01:34 PM 9/11/00 -0400, Frasnelli, Dan wrote:
> > One is absolutely correct, it really depends on the type of penetration
> > test one is engaged to conduct.
> > But what really is Industry Best Practices.  I know some high end
>
> I imagine SANS or similar group has a list of recommended practices.
>
> Security auditing IBP is a sticky subject, so preface everything below
> with glowing neon "in my humble opinion" signs.
>
> On paper, all IBPs serve at least two purposes:
> - peace of mind for the client/consumer
> - legal coverage (aka. CYA insurance) for the provider and their employees
>
> When it comes to pen testing, your "IBP" is best determined by the
> client's requirements document and contract terms.
> If it reads "discover which hosts are visible on the internet",
> out comes a portscanner or similar util.
> If it reads "compromise the internal customer database using all necessary
>  means", out comes the phosphorephic VT320 O' Doom, wirecutters, C4
> and a 10 gallon drum of coffee.
>
> Really, though.. the point of penetration testing is to mimic an
> unpredictable, chaotic attacker.
> I've mentioned this in other forums, and I'll mention it here:
> information security is one part technology, one part psychology.
> You cannot boil down a sophisticated attacker's techniques into
> logical rules and process trees.
>
> > What tool would be used first and what would be the secondary tool to
> > validate any false positives one may discover???  Is there any manual
> > massaging of the data??
>
> In very generic terms.. a vulnerability scan is the first tool,
> exploitation of the vulnerability is the second tool which validates
> the finding.  Of course, this is subject to terms of your contract.
>
> > Would you turn over the raw data to the customer??
>
> Without hesitation.  If not the raw data, slightly formatted data
> not far up the chain.
> Results from a penetration test usually have three parts:
> a) executive summary
> b) "raw data" (or close facsimile)
> c) recommendations
>
> You want to provide actual data to validate your recommendations and
> provide the client's technical staff a good starting point.
>
> -dan