Penetration Testing mailing list archives
Re: Testing the user community
From: Javier Fernández-Sanguino <jfernandez () germinus com>
Date: Wed, 31 Jan 2007 11:10:21 +0100
webmaster () absolutenetworks biz dijo:
We all know our weak link but how do you identify just how weak they are? I think it's time to pen test my user community and have a couple ideas to gather statistics on just how nonaware they really are. Maybe a simple phishing scam and bogus email with a fake virus attachment that emails me when it's opened so I can track how many folks actually opened it. Has anyone ever done this before? I can't find any information about it on the web.. thoughts and ideas anybody?
I did this while pentesting for a client (on his request and with their written permission):
- find a XSS flaw at their (public) website that could be used to have web browsers load the image and provide their session IDs
- setup a webserver with an "blank" gif image- send a credible e-mail to a set of controlled users (unaware of the experiment, but aware of the pentest) that would make them open up the company's website and use the XSS flaw
- monitor the logs of the webserver, get the session IDs and reuse them - profit!For some other customers I have produced (again on their request) plausible phishing scams using XSS flaws at their sites in order to recover user credentials. Given that (through separate flaws) the pentest team had access to parts of the customer's user's databases (including names and e-mails of thousands of users) it was easy to convince them of the possible impact of the issues uncovered and the need to fix those promptly. We did not, however, test these "live" for obvious reasons.
Regards Javier ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: Testing the user community Matthew Snider (Feb 01)
- <Possible follow-ups>
- RE: Testing the user community Des Ward (Feb 01)
- RE: Testing the user community Morris Sgt Derek P (Feb 01)
- Re: Testing the user community mblack9905 (Feb 01)
- Re: Testing the user community Javier Fernández-Sanguino (Feb 01)
- Re: Testing the user community webmaster (Feb 01)
- Re: Testing the user community Carl Jongsma (Feb 01)
- Re: Testing the user community Nicolás F . Iglesias (Feb 02)
- Re: Testing the user community Lee Lawson (Feb 02)
- Re: Testing the user community Nicolás F . Iglesias (Feb 02)
- Re: Testing the user community Pete Herzog (Feb 01)
- Re: Testing the user community Schanulleke (Feb 01)
- RE: Testing the user community Paul Melson (Feb 01)
- RE: Testing the user community webmaster (Feb 01)
- RE: Testing the user community Paul Melson (Feb 01)
- RE: Testing the user community webmaster (Feb 01)
- Re: Testing the user community Mister Coffee (Feb 01)
(Thread continues...)