Re: What's Next? Attack of Internal IP Disclosure

[Michal Zalewski <lcamtuf () coredump cx>]

> After I launched a penetration testing attack from Internet, I could
> disclose the internal IP address. What would be the attack after I
> knew the internal IP address?

There is no attack. The server leaks a piece of low-value information
that, in conjunction with other vulnerabilities, may make your life
marginally easier. But usually doesn't.

IP disclosure, path disclosure, server responding to ICMP pings, etc,
are the canonical examples of padding in security assessment reports.

/mz

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------