RE: WebTrends testing

["Shenk, Jerry A" <jshenk () decommunications com>]

Are you testing feom the inside out?  Is the goal of the client to restrict and/or log web access from within the 
network?

If those questions are true, you might try going around web trends by setting up an proxy server on the outside 
someplace.  This proxy should probably use https and a non-standard port.  If they are not doing any egress filtering, 
this may let you circumvent this security control.

This really is an attack on the egress filtering rules but, if it lets you bypass the task that web trends is 
performing, it's a valid test...depending on the scope of course;)

There are also specific web trends attacks that obfuscate the web requests.  That depends on the particular version 
though...and I don't have specific info 'cuz I haven't done it.

-----Original Message-----
From: "Philip Cox" <phil.cox () systemexperts com>
To: "pen-test () securityfocus com" <pen-test () securityfocus com>
Sent: 8/13/08 10:56 PM
Subject: WebTrends testing

Any pointers as to WebTrends exposures? I have been whacking on the
server for a while and have come up with nothing.

Any thoughts are appreciated.

Phil


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------


**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which 
they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the 
intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the 
message. If you have received this communication in error, please notify the sender and delete this e-mail message. The 
contents do not represent the opinion of D&E except to the extent that it relates to their official business.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------