RE: LAN pen test

[Nelson Brito <nbrito () sekure org>]

Why don't you try ARPSpoofing, so you can own all the network telling other
machines that you, from know, are the router. ;-) 

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of Bruno 
> Cesar Moreira de Souza
> Sent: Thursday, December 07, 2006 3:48 PM
> To: pen-test () securityfocus com
> Subject: Re: LAN pen test
>
> Hi
>
> Only a review of my statement in the last post, because I 
> think was not enough clear:
>
> "you could try ... exploiting an Internet Explorer flaw..."
>
> change for this:
>
> "If you were doing an internal pen-test trying to own the 
> network administrator workstation, you could try to do a DNS 
> poisoning or just an arp poisoning attack (take a look on 
> ettercap and dsniff) to redirect the http connection of your 
> target, for your 'evil' http service with a 0day Internet 
> Explorer exploit."
>
> Cheers,
>
> Bruno Cesar M. de Souza
>
> --- Bruno Cesar Moreira de Souza
> <bcmsouza () yahoo com br> escreveu:
>
> > Hi,
> >
> > For an updated XP machine, whithout additional network services or 
> > network applications, maybe you will need a 0day exploit - 
> an exploit 
> > for a vulnerability not yet patched by the vendor. 
> Sometimes, security 
> > researches disclose 0day exploits for the public.
> > Recently, some exploits for Internet Explorer and MS Office 
> > applications were disclosed before Microsoft could patch 
> the holes. If 
> > you were doing an internal pen-test trying to own the network 
> > administrator workstation, you could try to do a DNS 
> poisoning or just 
> > an arp poisoning attack (take a look on ettercap and dsniff) to 
> > redirect the target for your web site, exploiting an 
> Internet Explorer 
> > flaw, for example.
> >
> > But if you can´t find a known vulnerability for your 
> target, you can 
> > try by yourself discover a security hole and write an exploit.
> >
> > A suggestion: in the learning of the "pen-test art"
> > is
> > better to first understand deeper the common kinds of 
> vulnerabilities 
> > and have the fundamentals, instead of just run exploits downloaded 
> > from the web.
> >
> >
> > Best Regards,
> >
> > Bruno Cesar Moreira de Souza
> >
> > --- mifa () stangercorp com escreveu:
> >
> > > I have gone through the eh course and I still do
> > not
> > > feel like I can really understand how to pen test.
> >
> > > None of the exploits or methods seem to work on a updated xp 
> > > machine.  I set up a vm ware network to practice on.  I 
> can not seem 
> > > to make any progress because the information I have is outdated.
> > >
> > > Can anyone point me to a resource that would help
> > me
> > > gain access to an xp machine that is running automatic 
> updates (my 
> > > vm).  I cant seem to do it
> > one
> > > the lan any way other than to use a trojan and
> > what
> > > would be to point of pen testing a system if the only way 
> in is via 
> > > trojan; thats standard
> > seucrity,
> > > dont run programs from email, blah blah blah...
> --------------------------------------------------------------
> ----------
> > > This List Sponsored by: Cenzic
> > >
> > > Need to secure your web apps?
> > > Cenzic Hailstorm finds vulnerabilities fast.
> > > Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> > >
> --------------------------------------------------------------
> ----------
> > >
> >
> >
> >
> >     
> >
> >     
> >             
> _______________________________________________________
> > Você quer respostas para suas perguntas? Ou você sabe muito e quer 
> > compartilhar seu conhecimento?
> > Experimente o Yahoo! Respostas !
> > http://br.answers.yahoo.com/
>
>
> __________________________________________________
> Fale com seus amigos  de graça com o novo Yahoo! Messenger 
> http://br.messenger.yahoo.com/ 
>
> --------------------------------------------------------------
> ----------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> --------------------------------------------------------------
> ----------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------