Penetration Testing mailing list archives
Re: External Pentests Obsolete?
From: "Jason Ross" <algorythm () gmail com>
Date: Fri, 10 Aug 2007 15:54:05 -0400
On 8/9/07, Yiannis Koukouras <d4rw1n () linuxmail org> wrote:
Do you think that an external infrastructure pentest is nowadays obsolete?
No.
What I want to say is that, most of the serious companies nowadays will only have a few servers on their DMZ (web server, mail server, SSL concentrator, terminal server, citrix) and will only allow access to one or two ports for each of them. The rest of the infrastructure (excluding the internet facing router and firewall) will be completely inaccessible.
Certainly they think this is so, and it may even be true. Until a test is performed however, one does not know with any certainty.
Thus, if web application testing is out of scope, there isn't much to test, is it? Only half a dozen of services to check vulnerabilities and misconfiguration, check if mail rely is on, make a password bruteforce attack(?), check that the DNS can't be poison and VOILA! You have finished!
While it may be true that with web application testing out of scope a (possibly great) wealth of "soft and chewy" is being ignored, this does not mean that there is nothing else to do. To my definition, a pentest does more than just "check vulnerabilities", it attempts to exploit them, and if successful, then proceeds to attempt to move to the next level of access (whatever that may be). In this event, compromising the available external services is not (necessarily) trivial, nor quickly done.
Do you think that it is ethical to consult our clients to "buy" an external pentest anymore?
I think it is just as ethical as consulting them to buy any other form of pentest, for the reasons stated above. -- jason ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- External Pentests Obsolete? Yiannis Koukouras (Aug 10)
- Re: External Pentests Obsolete? US Infosec (Aug 11)
- RE: External Pentests Obsolete? Van Heerden, Francois (CSS) (Aug 11)
- RE: External Pentests Obsolete? Williamson, Clyde (Aug 11)
- RE: External Pentests Obsolete? Shenk, Jerry A (Aug 11)
- Re: External Pentests Obsolete? Jason Ross (Aug 11)
- Message not available
- Fwd: External Pentests Obsolete? Joel Jose (Aug 11)
- Re: External Pentests Obsolete? rajat swarup (Aug 11)
- <Possible follow-ups>
- Re: Fwd: External Pentests Obsolete? cwright (Aug 12)
- RE: Fwd: External Pentests Obsolete? richard (Aug 13)