Penetration Testing mailing list archives
Re: [PEN-TEST] First step of a pen-test
From: "Dunker, Noah" <NDunker () FISHNETSECURITY COM>
Date: Tue, 19 Sep 2000 11:10:30 -0500
It depends on the scope. Usually, I try to perform interviews with key administrators, engineers, and managers. I also like to review some policy documents, if they have any. Of course, you can't *DO* this if they want a "hacker's eye veiw" on security. You'd have to use social engineering. It all depends on the scope of the contract. Usually, an in-house assessment is what they want. they want to see what you're doing... and so they don't hid the fact that you're pen-testing. In this case, Interviews and Policy review are typically my first activity. This gives me a good idea of some network structure, OS's, and things theat they consider "Assets", and the level of vulnerability the assets have (or how vulnerable the company thinks they are). In general, this is a good way to get the client comfortable with you, and for you to get comfortable with the environment and people you'll be around for the next couple of days. -----Original Message----- From: Christopher M. Bergeron [mailto:ChrisB () HGSS COM] Sent: Monday, September 18, 2000 1:39 PM To: PEN-TEST () SECURITYFOCUS COM Subject: First step of a pen-test What is the industry norm for _beginning_ a pen-test after the contract has been made? Would one first map the network? Try to war-dial the exchange for possible remote (pcanywhere, etc). access machines? VRFY email addresses to look for user logins? Is it typical to ask for information about the network (ie. network architecture) beforehand or do most pen-tests start "blindly" and do the network reconnaissance. Thanks to anyone who addresses even one of my many questions.
Current thread:
- [PEN-TEST] First step of a pen-test Christopher M. Bergeron (Sep 19)
- Re: [PEN-TEST] First step of a pen-test Tom Litney (Sep 19)
- Re: [PEN-TEST] First step of a pen-test Teicher, Mark (Sep 19)
- [PEN-TEST] LDAP-nullbase krisk (Sep 20)
- Re: [PEN-TEST] LDAP-nullbase Brian Conte (Sep 20)
- Re: [PEN-TEST] LDAP-nullbase spi (Sep 20)
- [PEN-TEST] LDAP-nullbase krisk (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Erik Tayler (Sep 20)
- Re: [PEN-TEST] First step of a pen-test van der Kooij, Hugo (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Wandering One (Sep 20)
- <Possible follow-ups>
- Re: [PEN-TEST] First step of a pen-test Dunker, Noah (Sep 19)
- Re: [PEN-TEST] First step of a pen-test Tonick, Mike (Sep 19)
- Re: [PEN-TEST] First step of a pen-test Jason Stout (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Teicher, Mark (Sep 20)
- [PEN-TEST] anyone using firewalking? The Picard (Sep 20)
- Re: [PEN-TEST] anyone using firewalking? Jonathan Rickman (Sep 21)
- Re: [PEN-TEST] anyone using firewalking? El Nahual (Sep 21)
- Re: [PEN-TEST] First step of a pen-test Teicher, Mark (Sep 20)
- Re: [PEN-TEST] First step of a pen-test H Carvey (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Loschiavo, Dave (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Max Vision (Sep 20)
- Re: [PEN-TEST] First step of a pen-test Dawes, Rogan (Sep 21)