Penetration Testing mailing list archives
RE: Limited vs full blown testing
From: "Martin Murray-Brown" <Martin.Murray-Brown () derivco com>
Date: Thu, 24 Jun 2004 11:22:05 +0200
Heyas, I would recommend preparing a standard document detailing the tests (not a full test plan, something dumbed-down for the suits), and also detailing the pro's and con's of both doing the test, and NOT doing the test. That way the customer can make an informed decision as to what to do and what not to do. Then, if you make the possible consequences of NOT doing the test sufficiently scary, the customer is more likely to agree to actually doing a test. Also, it makes you look even more professional... just slap in document control and a fancy header :) - M -----Original Message----- From: Toby Barrick All, During my many years of pen testing one common thread when dealing with customers has been the request to not perform any destructive or DOS type testing. When I speak of DOS, I'm not talking about DDOS, I'm talking just a single machine and the tests that can be accomplished with that machine. IMHO abiding by that request is really short changing the customer and skewing the results. Additionally a lot of companies don't want their applications poked at either. What has been the experience of the members on this list? Do you just gleefully accept the check and any limitations imposed on testing or do you push for a "complete" suite of tests? Thanks in advance! T
Current thread:
- Limited vs full blown testing Toby Barrick (Jun 24)
- RE: Limited vs full blown testing Jerry Shenk (Jun 24)
- Re: Limited vs full blown testing Richard Rager (Jun 24)
- Re: Limited vs full blown testing Peter Wood (Jun 24)
- Re: Limited vs full blown testing R. DuFresne (Jun 24)
- RE: Limited vs full blown testing Jerry Shenk (Jun 27)
- RE: Limited vs full blown testing R. DuFresne (Jun 27)
- Re: Limited vs full blown testing R. DuFresne (Jun 24)
- Re: Limited vs full blown testing Martin Mačok (Jun 25)
- RE: Limited vs full blown testing Markowsky, Tyler (Jun 27)
- <Possible follow-ups>
- RE: Limited vs full blown testing Bénoni MARTIN (Jun 24)
- RE: Limited vs full blown testing Martin Murray-Brown (Jun 24)
- Re: Limited vs full blown testing El C0chin0 (Jun 24)
- IE caching issue jatkinson (Jun 27)
- Re: IE caching issue Daniel Staal (Jun 28)
- IE caching issue jatkinson (Jun 27)
- RE: Limited vs full blown testing Thompson, Jimi (Jun 27)
- RE: Limited vs full blown testing Wayne Wooley (Jun 27)
- RE: Limited vs full blown testing R. DuFresne (Jun 27)
- RE: Limited vs full blown testing Alan Davies (Jun 27)
- RE: Limited vs full blown testing Martin Murray-Brown (Jun 28)