Pen testing techniques

Hello,
I am new to pen testing and am currently involved in doing an external
pen test for one of our clients.We are doing it through Core
Impact.Reconnaisance showed only port 80 as open and the web server
running IIS 6.0.Core Impact did not find any vulnerabilities in the
server and hence was unable to penetrate.The web application was also
tested for SQL Injection and PHP remote file inclusion and did not
find any vulnerabilities there either.

My question is what else can we do besides relying on Core Impact for
this pen test.And what impression can a client get if we say to them
that there are no vulnerabilites in your network or web app.Its
dificult to digest something like that for a security specialist that
everythings alright.

Looking forward to some great views.Thanks.

Regards,
Atif Azim

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • [Full-disclosure] CORE-2008-0126: Multiple vulnerabilities in iCal
    ... Core Security Technologies - CoreLabs Advisory ... Title: Multiple vulnerabilities in iCal ... Available through Apple security updates. ... from the Core Security Consulting Services team of Core ...
    (Full-Disclosure)
  • CORE-2008-0126: Multiple vulnerabilities in iCal
    ... Core Security Technologies - CoreLabs Advisory ... Title: Multiple vulnerabilities in iCal ... Available through Apple security updates. ... from the Core Security Consulting Services team of Core ...
    (Bugtraq)
  • [Full-Disclosure] iPlanet vulnerabilities on IRIX
    ... Multiple vulnerabilities exist in the iPlanet Web Servers as supplied by ... memory of the web server process. ... implemented on ALL vulnerable SGI systems. ...
    (Full-Disclosure)
  • [Full-Disclosure] iPlanet vulnerabilities on IRIX
    ... Multiple vulnerabilities exist in the iPlanet Web Servers as supplied by ... memory of the web server process. ... implemented on ALL vulnerable SGI systems. ...
    (Full-Disclosure)
  • Re: [fw-wiz] X server in a Firewall
    ... >> The more code, the more potential vulnerabilities, ... A X server running in a firewall ... I don't like remote access to my firewalls, but if I have to have it, then ... the ssh or web server port used to manage it ...
    (Firewall-Wizards)