Penetration Testing mailing list archives
RE: WebTrends testing
From: "Shenk, Jerry A" <jshenk () decommunications com>
Date: Thu, 14 Aug 2008 08:54:46 -0400
Are you testing feom the inside out? Is the goal of the client to restrict and/or log web access from within the network? If those questions are true, you might try going around web trends by setting up an proxy server on the outside someplace. This proxy should probably use https and a non-standard port. If they are not doing any egress filtering, this may let you circumvent this security control. This really is an attack on the egress filtering rules but, if it lets you bypass the task that web trends is performing, it's a valid test...depending on the scope of course;) There are also specific web trends attacks that obfuscate the web requests. That depends on the particular version though...and I don't have specific info 'cuz I haven't done it. -----Original Message----- From: "Philip Cox" <phil.cox () systemexperts com> To: "pen-test () securityfocus com" <pen-test () securityfocus com> Sent: 8/13/08 10:56 PM Subject: WebTrends testing Any pointers as to WebTrends exposures? I have been whacking on the server for a while and have come up with nothing. Any thoughts are appreciated. Phil ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------ **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business. ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------
Current thread:
- WebTrends testing Philip Cox (Aug 13)
- <Possible follow-ups>
- RE: WebTrends testing Shenk, Jerry A (Aug 14)