Penetration Testing mailing list archives
Re: Penetration test of 1 IP address
From: Dave <dlaud.flux () gmail com>
Date: Thu, 09 Feb 2006 11:14:29 -0500
John Forristel (SunGard-Chico) wrote:
May I ask why you recommended trying to gain access without using webblaze? As you said previously, weblaze could be using a database to hold valuable information etc... doesnt *possible* SQL injection come into mind? The pen tester could potentially get a wealth of information even if the box cant be cracked.WebBlaze is a way for lawyers to share documents. As Dave mentioned, scan the machine with nmap, Nessus, and other tools. Be careful with Brutus, you can lock out accounts very quickly and your information is logged for all to see. WebBlaze is a webform, not a listening protocol, so it may be that the software is using a local database to store login information. Try gaining access without using WebBlaze.
Then look on the website for the company you are trying to penetrate. Email addresses make for good login material.Check to see if there is a default password for WebBlaze and try that.My $1.32 (2 cents + inflation) John Forristel Network Security Analyst SunGard Bi-Tech "You don't have to lie to me, we aren't married."
------------------------------------------------------------------------------Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: Penetration test of 1 IP address, (continued)
- Re: Penetration test of 1 IP address Anonymous (Feb 09)
- Re: Penetration test of 1 IP address Packet Man (Feb 09)
- Re: Penetration test of 1 IP address intel96 (Feb 09)
- Re: Penetration test of 1 IP address Ivan Arce (Feb 15)
- Re: Penetration test of 1 IP address Sugiowono (Feb 09)
- RE: Penetration test of 1 IP address Bob Radvanovsky (Feb 09)
- RE: Penetration test of 1 IP address Sels, Roger (Feb 09)
- RE: Penetration test of 1 IP address Anders Thulin (Feb 09)
- RE: Penetration test of 1 IP address Edmond Chow (Feb 09)
- RE: Penetration test of 1 IP address John Forristel (SunGard-Chico) (Feb 09)
- Re: Penetration test of 1 IP address Dave (Feb 09)
- RE: Penetration test of 1 IP address Clemens, Dan (Feb 09)
- RE: Penetration test of 1 IP address Edmond Chow (Feb 10)
- Re: Penetration test of 1 IP address thomas springer (Feb 10)
- RE: Penetration test of 1 IP address John Forristel (SunGard-Chico) (Feb 09)
- RE: Penetration test of 1 IP address Levenglick, Jeff (Feb 09)
- Message not available
- Fwd: Penetration test of 1 IP address Brian Loe (Feb 09)
- Re: Fwd: Penetration test of 1 IP address Justin Seitz (Feb 09)
- Message not available
- RE: Penetration test of 1 IP address Beau Mersereau (Feb 09)
- RE: Penetration test of 1 IP address Bob Radvanovsky (Feb 09)
- Re: Fwd: Penetration test of 1 IP address Bob Radvanovsky (Feb 09)