Re: Cross testing exploit with vulnerability scan results

["John M. Martinelli" <john () martinelli com>]

Well, sadly, this is why you should not completely depend on  
vulnerability scanners to conduct a full penetration test - they  
don't catch everything you like, and sometimes they make false- 
negatives, as well as false-positives, and other times faulty code  
can impact your audit severely.

Regards,
John Martinelli
RedLevel.org Security

On Jul 27, 2007, at 8:25 AM, Chroot wrote:

> Hi Fellow testers,
>
> I've been conducting pen tests since 4 yrs now... the methodology I
> follow is that we exploit or attempt to exploit ONLY those
> vulnerabilities that a vulnerability scanner identifies. What if the
> appropriate check or signature in the vulnerability scanner was not up
> to date or had some coding issue or was not comprehensiveness enough
> (or anything else) to identify a real existing vulnerability on a
> system. This can result in serious false negatives. Would downloading,
> installing and cross testing all available exploits for an identified
> service be a good idea to minimize such a case? How many people have
> faced such an issue or a similar issue? For me I faced this issue with
> some  bug in Nessus recently.
>
> This is something like my NMAP says there is IIS6.0 running on port
> 443 of a target server. I do a Nessus scan on it and it doesn't report
> anything. I then download all available exploits for IIS6.0 (or for
> all version of IIS? would this make sense) from securityfocus.com or
> securiteam.com or similar source and run it manually on the target
> system.
>
> Eagerly await opinions.
>
> THNX
>
> ---------------------------------------------------------------------- 
> --
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ---------------------------------------------------------------------- 
> --


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------