Penetration Testing mailing list archives
Re: [PEN-TEST] Noisy ou stealthy ?
From: Jose Nazario <jose () BIOCSERVER BIOC CWRU EDU>
Date: Wed, 8 Nov 2000 11:28:32 -0500
On Wed, 8 Nov 2000, Nicolas Gregoire wrote:
When you are doing some pen-tests, do you use the noisy way (full port range scan, lot of scanning for cgi whitout IDS evasion techniques, brute force attacks on FTP) or the sthealthy one ?
So, what's your method ?
depends on what they're interested in testing, their intrusion detection systems (ie staff, host or network based IDS systems, what have you) or vulnerability assessments. for the former, try the whole shebang from obvious to stealthy with all possible options and permutations attempted. see what shows up. for the latter, there's no need if all you want to do is evaluate the software they're running unless it's to attempt to penetrate. if it suffices to say, 'this database interface is known to be vulnerable at these points' then, unless it's contracted for, you don't need to. *shrug* jose nazario jose () cwru edu PGP: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80 PGP key ID 0xFD37F4E5 (pgp.mit.edu)
Current thread:
- [PEN-TEST] Noisy ou stealthy ? Nicolas Gregoire (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? Jose Nazario (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? Iván Arce (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? Greg (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? andy lowton (Nov 11)
- Re: [PEN-TEST] Noisy/stealthy ? N Catlow (Nov 14)
- Re: [PEN-TEST] Noisy ou stealthy ? Don Bailey (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? a007 (Nov 10)
- <Possible follow-ups>
- Re: [PEN-TEST] Noisy ou stealthy ? Eric Lauzon (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? Dunker, Noah (Nov 09)
- Re: [PEN-TEST] Noisy ou stealthy ? Masse, Robert (Nov 09)