Bernhard Mueller wrote:
Exibar wrote:
I didn't mean to imply that the consultants create their own exploits,
not many I know could even begin to do that, only a couple are talented
enough to do just that. Even for those very few, it's just not feasable
from a time perspective. Much quick and cost effective to use what's out
there.
so what use is a pentest if the consultant isn't even talented enough to
find / create exploits for unknown vulnerabilities?
any average admin can install and run an automatic security scanner.
furthermore, a common nessus report contains 99% useless garbage.
A good pentester will not just hand over a Nessus (or ItsStillShit,
CANVAS,..) report. The results of a Nessus scan (as with Nmap, firewalk,
document grinding, google searches, *plus* the results of all the manual
scouting about that's done) are data that need to be analysed and placed
in context by the pentester.
A pentester who hands over nothing but an automated report, isn't.
A pentester who doesn't bother using Nessus is either extraordinarily
good, has a very small target, or is perhaps doing something slightly
different.
It's important to draw a distinction between an attempt to find *any*
way into the target network / plant a flag file / get root on the target
system, or whatever, versus an attempt to find as many ways onto the
target as possible in the time.
Many pentest customers think they want the latter, but get the former.
Some people would call this a "vulnerability assessment" rather than a
pentest. I guess it depends whether you're joesbaitshop.com or the USAAF
Strategic Air Command (nuclear strike group), who were one of the first
orgs to use pentest / tiger team methods.
\a
--
Andrew Simmons
Technical Security Consultant
MessageLabs
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
