Penetration Testing mailing list archives
Re: Citrix Pen Test,
From: Sat Jagat Singh <flyingdervish () yahoo com>
Date: Wed, 30 May 2007 09:06:15 -0700 (PDT)
The approach should depend on the scope of the project. Do they only want to find application vulnerabilities, or do they want to know what an application user might be able to do beyond their authorization level? Testing only the application would not include testing the platform. It can be assumed to have typical Windows vulnerabilities and should be tested, but for a variety of reasons, the customer's internal audit team, security officer, etc. might not want that to be part of this project. There might be many other things to include in the scope depending on their organizational policies and whether there is a security policy defined for the system and application. While written policies are often badly written and fail to take significant factors into account, they at least give you an idea of the organization's concerns and intent. Good to review if they exist. --- IRM <irm () iinet net au> wrote:
Dear All, On my recent pen-test, I need to deal with an application that sitting on the remote host. The way its works is that the client need to connect to the remote server through Citrix and run the application. 1) I feel that this is quite challenging pen-test as I do not have full control to the remote server. This gets me thinking that apart from analyzing the traffic from the client PC to remote host and input validation checking. Is there any thing that I could possibly do? 2) I noticed that the Citrix Client (Citrix Program Neighborhood 7) used Basic Level encryption. I couldn't find anything in regards to this Basic Level Encryption as to which algorithms that Citrix uses. I was wondering whether this Basic Encryption could be cracked easily. Any thought around this? Cheers, John
------------------------------------------------------------------------
This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020
------------------------------------------------------------------------
____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- Most Successful Exploits/Tools to use against windows & Linux? Pen Testee (May 25)
- Re: Most Successful Exploits/Tools to use against windows & Linux? Morgan Reed (May 25)
- Re: Most Successful Exploits/Tools to use against windows & Linux? nnp (May 27)
- Citrix Pen Test, IRM (May 29)
- Re: Citrix Pen Test, rajat swarup (May 30)
- Re: Citrix Pen Test, Lee Lawson (May 30)
- Re: Citrix Pen Test, sherwyn . williams (May 30)
- Re: Citrix Pen Test, rajat swarup (May 30)
- Citrix Pen Test, IRM (May 29)
- Re: Citrix Pen Test, Sat Jagat Singh (May 30)