Re: External Pentests Obsolete?



On 8/9/07, Yiannis Koukouras <d4rw1n@xxxxxxxxxxxxx> wrote:
Do you think that an external infrastructure pentest is nowadays
obsolete?

No.



What I want to say is that, most of the serious companies nowadays
will only have a few servers on their DMZ (web server, mail server,
SSL concentrator, terminal server, citrix) and will only allow access
to one or two ports for each of them. The rest of the infrastructure
(excluding the internet facing router and firewall) will be completely
inaccessible.


Certainly they think this is so, and it may even be true.
Until a test is performed however, one does not know with any certainty.


Thus, if web application testing is out of scope, there isn't much to
test, is it? Only half a dozen of services to check vulnerabilities
and misconfiguration, check if mail rely is on, make a password
bruteforce attack(?), check that the DNS can't be poison and VOILA!
You have finished!

While it may be true that with web application testing out of
scope a (possibly great) wealth of "soft and chewy" is being ignored,
this does not mean that there is nothing else to do.

To my definition, a pentest does more than just "check vulnerabilities",
it attempts to exploit them, and if successful, then proceeds to attempt
to move to the next level of access (whatever that may be).

In this event, compromising the available external services is not
(necessarily) trivial, nor quickly done.


Do you think that it is ethical to consult our clients to "buy" an
external pentest anymore?

I think it is just as ethical as consulting them to buy any other
form of pentest, for the reasons stated above.

--
jason

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



Relevant Pages

  • Re: Outlook wont send large attachments
    ... the one operating your own personal mail server. ... header to the e-mail client while they interrogate the message but that only ... the timeout due to excessive delay. ...
    (microsoft.public.outlook)
  • RE: No delivery report 4.4.7
    ... mail.rabarberlandet.dk is a mail server host on our ISP. ... Please let me know where the mail.rabarberlandet.dk host on. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Sendmail problem
    ... machines to my mail server (OK, right now it seems it is just my ... When it gets to my mail server, ... network when hostnames resolve to the localhost address. ... If something goes into localhost that needs to actually leave the ...
    (Fedora)
  • Re: Is a DC needed Here?
    ... Yes I FULLY agree with you I want the file server for the mail but there are ... the mail you can create accounts just in the mail server DB alone. ... My mail server does not require AD ... because a mailbox is a difinitive object. ...
    (microsoft.public.windows.server.active_directory)
  • Re: DNS MX Question
    ... You're also sending from that mail server, ... wouldn't match the rDNS of the hosting company's server. ... reverse DNS *or* A record matches the HELO string in a mail server. ... ask them to create a PTR record for me? ...
    (microsoft.public.windows.server.sbs)