Penetration Testing mailing list archives
Re: Informing Companies about security vulnerabilities...
From: <jay.tomas () infosecguru com>
Date: Wed, 4 Oct 2006 15:39:31 -0400
I dont want this to come across as a flame. But want to be clear and direct with my message. One of the first things that you should teach in your class is Ethical and Permission Granted Assessments of Public Web sites. You had no right to assess their site, which is why you probably got a less than a warm reception. Companies contract and pay for assessment services. A good practice is not to interact with some party that has chosen to run a few tools and typing in ' or 1=1-- in all the available input fields. This is responsible approach to assessment. I would suggest you spend some time with Foundstone or OWASP to get some of their test environments, e.g. HACME BANK, WEBGOAT for your presentations. ----- Original Message ----- From: Joseph McCray To: pen-test () securityfocus com Sent: Wed, 04 Oct 2006 03:07:12 -0400 Subject: Informing Companies about security vulnerabilities... This probably won't sound like that big of a deal, but it still bothered me so I figured I'd ask the list. I was teaching a Web Application Security class last week and we were performing simple XXS, SQL Injection, etc on the vulnerable web apps I use for class. Normally, I go to a live public website or two during the class and we talk about common tests to perform and how to approach certain types of websites. A common subject is how to handle large website with tons of dymanic content - so the class chose a major newspaper's website for the discussion. Usually when we do this we only find a few simple things (XXS for example) - no big deal right. With this particular website we just kept finding another, after another and on and on. Over 600 instances of XXS, over 200 SQL Injection - this was bad. After a while it started to get boring there was so many.... So I drafted a letter to the editor as well as several other prominent people at the newspaper. It detailed my finding and recommended some possible mitigation strategies. After emailing this I didn't hear anything for a few days, so I emailed it again and followed up with a phone call. After getting no response to the second email and then having been bounced around from department to department when I called I just said forget it. Has anyone else gone through a similar situation? Was the company receptive? Other companies I've contacted in the past have been quite receptive - I'm just curious if other people have gone through this as well. No need to fill the list with this, you can email me directly with your inputs and stories. -- Joe McCray Toll Free: 1-866-892-2132 Email: joe () learnsecurityonline com Web: https://www.learnsecurityonline.com Learn Security Online, Inc. * Security Games * Simulators * Challenge Servers * Courses * Hacking Competitions * Hacklab Access
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: Informing Companies about security vulnerabilities..., (continued)
- Re: Informing Companies about security vulnerabilities... pand0ra (Oct 04)
- Re: Informing Companies about security vulnerabilities... Andreas Putzo (Oct 05)
- Re: Informing Companies about security vulnerabilities... Steve Friedl (Oct 05)
- Re: Informing Companies about security vulnerabilities... pand0ra (Oct 05)
- Re: Informing Companies about security vulnerabilities... s-williams (Oct 05)
- Re: Informing Companies about security vulnerabilities... pand0ra (Oct 04)
- Re: Informing Companies about security vulnerabilities... Dan Catalin Vasile (Oct 05)
- RE: Informing Companies about security vulnerabilities... bugtraq (Oct 04)
- RE: Informing Companies about security vulnerabilities... Brian . Marino (Oct 04)
- Re: Informing Companies about security vulnerabilities... gat0r (Oct 06)
- Re: Informing Companies about security vulnerabilities... Dragos Ruiu (Oct 05)
- RE: Informing Companies about security vulnerabilities... Brian . Marino (Oct 04)
- Re: Informing Companies about security vulnerabilities... jay.tomas (Oct 04)
- Re: Informing Companies about security vulnerabilities... Thor (Hammer of God) (Oct 04)
- Re: Informing Companies about security vulnerabilities... Stefano Zanero (Oct 05)
- Re: Informing Companies about security vulnerabilities... Thor (Hammer of God) (Oct 04)
- RE: Informing Companies about security vulnerabilities... Krpata, Tyler (Oct 04)
- Re: Informing Companies about security vulnerabilities... bugtraq (Oct 04)
- RE: Informing Companies about security vulnerabilities... Craig Wright (Oct 04)
- Re: Informing Companies about security vulnerabilities... techlists (Oct 04)
- RE: Informing Companies about security vulnerabilities... Craig Wright (Oct 05)
- RE: Informing Companies about security vulnerabilities... Arian J. Evans (Oct 05)
- RE: Informing Companies about security vulnerabilities... Michael Scheidell (Oct 05)
- RE: Informing Companies about security vulnerabilities... Michael Scheidell (Oct 05)