Re: Pen-Test and Social Engineering

Greetings!

On Wed, 08 Feb 2006 08:55:52 -0600
Leif Ericksen <leife@xxxxxxx> wrote:


SHORT AND SWEET:
IMHO, a good pen-test will have a contract that dictates
1) Name of the company being tested and people that will be testing.
2) Any forbidden access methods.
3) Any forbidden tactics DOS/or even a shutdown of the server
(Real hackers will not care if they shutdown or DOS a server.)
4) Time of the attacks. (start/end date start/end time)
(Real hackers will not care about time.)
5) Maybe all telephone numbers owned by the company for a war-dial
list.
But this might not be shared with the whole team. If a modem is
found a weakness is noted, and the actual intrusion team would have
to find modems with SE or other methods.
6) If the team is going to be on premise can they enter restricted
areas or are they only allowed to test the door to see if it is open.

Most important: contacts (esp. phone numbers!) of all people involved!

7a) contact details of pen testers where the client can contact them during
the test in case something goes wrong. I once wardialed a client who
was not aware that his telephone system relayed each and every non-valid
number and/or service to the front desk. 50.000 numbers dialed where
only 20% were connected. 4 wardialers each running at 30second
intervals. Effectively DoSed the client telephone-wise...

7b) contact (and authority) details of the client. Especially when doing
physical assessment. Police usually won't take a "Dunno" as valid
legitimation for trespassing...

7c) Who is allowed to know and who not (e.g. for a pentest with simultaneous
readiness/performance test of the IDS/FW/network staff).


Bye

Volker


--

Volker Tanger http://www.wyae.de/volker.tanger/
--------------------------------------------------
vtlists@xxxxxxx PGP Fingerprint
378A 7DA7 4F20 C2F3 5BCC 8340 7424 6122 BB83 B8CB

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------

Relevant Pages

  • RE: PT Activity duration/time
    ... figure out the workaround or log it and give the client the patch notes. ... Vulnerability Assessment ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
    (Pen-Test)
  • Re: Pen-Test and Social Engineering
    ... War Games VS Hackers VS Bond VS Matrix?. ... Time of the attacks. ... I once wardialed a client who ... Audit your website security with Acunetix Web Vulnerability Scanner: ...
    (Pen-Test)
  • RE: MyDoom
    ... Does anyone have any kind of client I can use? ... mykralor.exe: MyDoom Exploit ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • MyDoom
    ... I am currently trying to penetrate a client having the mydoom virus. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: An argument AGAINST hosting your own email domain.
    ... the ISP for a client is currently hosting their email and we are bringing it ... the client should be receiving ... > system to 'auth attacks', NDR attacks, attacks which have yet to be ... get rid of your global mailboxes and set up ...
    (microsoft.public.windows.server.sbs)