Re: Basic facilities required to establish a pen test lab

Gubir schrieb:
I am CEH. But still I need some suggestion from you guys to setup a pen test
lab. Please give me some guidance about the basic essential hardware and
software to make a good pen test lab

A pent test lab; what could this be?
Definition of laboratory: A laboratory (often abbreviated lab) is a place where scientific research and experiments are conducted. A lab can hold space for one to thirty, or more, researchers depending on the size of the room and state mandated maximum occupancy limit.

In conjunction with pen-test this makes no sense to me, exeptual you are conducing external tests.
I for myself decided that I don't use laptops, exeptual I go mobile-wireless, they are mostly not the money worth, you can't mainteaince them tecnically by yourself -at least not here in Costa Rica.
What I do have here are a few boxes with 2.8 G Intel Pentium, 2GB Ram, 80 - 160 Gb HDD, 2 NICs and one with AMD 64bit Athlon, 2GB Ram, 80GB HDD, 2NICs. For special purposes I use PowerEdge 1850, 2 Xeon 2.8 G, 4GB Ram, 2x36 GB HDD, 2 NICs [doesn't run with Unix :'( ]

OS's: Windows XP, Fedora7, freeBSD

Before you step into a new job you have to setup your box new, that means set your HDD on zero. For this purpose I use PowerMax [Live-On edition], it takes some hours but its working excellent and with all brands of HDDs.
Don't use the OS "onboard"-formatting tools.
Never ever perform a test with a "USED" box.

If you use [Vuln]-Scanner [for a first look] make sure that you use only open-source products.
Double check all results.
Especially, don't believe the results of a Vuln-Scanner until you haven't proofed it manually.

In your repositioy you should have the common OS's for practizing and studying, as well as a collection of all Exploits you can grab, wether you need them or not.
Exploit-Frameworks like Metasploit or ATK are helpful.
You might come into a situation where you have to reverse-engineer something; IDA Pro is a excellent and comfortable choice and it's money worth.
Not mentioned the tools of the trade, you should know them all, you are CEH; isn't it?!

Regards
Jan











------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: suck out pathogens with a mini-pump?
    ... >> insurer requires them to but not a particular lab). ... Both inter and intra laboratory variability? ... Serologic tests for Lyme disease. ...
    (sci.med.diseases.lyme)
  • Re: UCI to give opinion on LA doping scandal in 10 days
    ... >>> the sake of argument it's found that it was the Director of the lab. ... >>> 'colorful' background it wouldn't be a complete surprise. ... So probably everybody at the laboratory knew they had some ... > patient and did not divulge his lab results or name or location, ...
    (rec.bicycles.racing)
  • Re: Laboratory Request Form scanning
    ... I am interested in exploring less laboriuos ways of importing the data from Laboratory Request forms into out Laboratory Information Management System and would like to get some information on the subject from anyone who may be using a similar mechanism in their Laboratory currently. ... This generates a form with all the details and a unique number called an ION which they send with the blood sample to the lab. ... When any provider enters an order into the Computerized Patient Record System (CPRS is the gui version of VISTA), the orders are instantly available to lab staff for either inpatient or outpatient work. ...
    (sci.med.laboratory)
  • Re: UCI to give opinion on LA doping scandal in 10 days
    ... >> the sake of argument it's found that it was the Director of the lab. ... >> 'colorful' background it wouldn't be a complete surprise. ... So probably everybody at the laboratory knew they had some ... patient and did not divulge his lab results or name or location, ...
    (rec.bicycles.racing)
  • The Disturbing Story of Plum Island
    ... The Disturbing Story of the Government's Secret Plum Island Germ Laboratory ... Lab 257 reveals the frightening true story of an unknown island ... The conventional wisdom surrounding the 1999 West Nile virus outbreak ...
    (sci.med.diseases.lyme)