Penetration Testing mailing list archives
Re: Network Exploitation Tools
From: Iván Arce <ivan.arce () coresecurity com>
Date: Thu, 02 Sep 2004 19:41:56 -0300
darbean () cetin net cn wrote:
In-Reply-To: <200408191906.45416@M3T4>Would you please give me any hints for the keyword to search
>the so-called "fuzzing/exploit frameworks" and "complete pen-test >framework" as you mentioned? I am interested and just can't find >what you mentioned by google :( As I known, Core Impact had ever >declared to be an "Automated Pen-test Framework" in its early >version. In the meaning of covering the whole proceeding of pen-test >from scanning to exploiting, "exploits framework" should be the main >important part of "pen-test framework".
Well, that is at least debateable Since you mention CORE IMPACT I'd like to point out some differences and some concepts around it. CORE IMPACT covers the entire process of a network penetration-test according to our own methodolody. Eveybody has one, right? We call ours RPT (Rapid Penetration Test) and we believe it does cover most of current best-practices around network pentesting. But I believe it would be a consensus that as part of a penetration test you need to do some sort of information gathering and network fingerprinting of the target network, find and exploit vulnerabilities, leverage access on compromised systems to escalate privileges and/or compromise other systems that were not accesible from the original attackers launching pad, produce deliverables (reports) and leave everything as it was before you started the penetration test (clean up of tools and other stuff you changed/uploaded to compromised systems). Exploits and exploit-frameworks are an important part of that entire process, but not the only part and perhaps not even the most important one. In the case of CORE IMPACT, we try to cover and automate the entire process, the exploits (local and remote) bundled are used in that process and you can use them manually as well. Also note that an "exploits framework" can be used for things other than just penetration testing such as testing IDSes and firewalls or weeding out false positives/negatives from vuln. scanners and patch deployments. It might or might not be appropiate to put Metasploit, CANVAS and CORE IMPACT on the same category, but they do have huge differences in functionality, feature set, usability, support and maturity. The common denominator is that the three of them ship with exploit code. -ivan --- To strive, to seek, to find, and not to yield. - Alfred, Lord Tennyson Ulysses,1842 Ivan Arce CTO CORE SECURITY TECHNOLOGIES 46 Farnsworth Street Boston, MA 02210 Ph: 617-399-6980 Fax: 617-399-6987 ivan.arce () coresecurity com www.coresecurity.com PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836 B25D 207B E78E 2AD1 F65A ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
Current thread:
- Re: Network Exploitation Tools Iván Arce (Sep 03)
- Re: Network Exploitation Tools Andy Cuff (Sep 07)