Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party.
All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things lik...
There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character). as you say a web crawler can delete data from a system ...
if you are asked to set it up, then you have to ensure the web apps actually work in the testing environment. this involves changing/chasing down configuration files/etc
@AviD well white-box / test env the worst you'll do is trash the test env. If they need it for other stuff, they should still back it up (or just snapshot the VMs) before the tester starts
@MarkBuffalo usually it's just "reboot things" to fix. but I did once get a case where a customer came back 9 months after testing, saying data we created as part of the test broke their upgrade... I pointed at the bit in the report that said "please delete all data created under these users at the completion of testing"
@AviD nah it's entirely justified (IMO). Take a system that has had 2 man years of work to develop and a test is going to walk in cold and in under 2 man weeks be better at that system than the devs
if someone gives me as much time as the devs had to write it, I'll take out the caveats
@AviD seriously I do see it, but I try to describe what I saw, and why it leads me to a conclusion. If I'm not sure, I say "I'm not sure, but x is indicative of y"
@AviD oh absolutely but you need to caveat where needed (e.g. what was the scope, did you get the right accounts, did the app. work properly, did they provide you a dir listing of the web root so you have some confidence that you hit all the URLs available)
@RоryMcCune too often I see clueless reports, with wrong findings, analysis, explanations, etc - but then they say "oh we dont guarantee anything we write is correct"
@AviD so if your original question was , do I do that kind of thing, the answer is no I don't . That said I'm just a tester, I don't write the contracts :)
also, while we agree completeness is not achievable, if you say you're testing for XSS, and there is a trivial XSS right on the main page and you didnt find it - your ass is negligent.
(again not talking about extreme edge cases, hidden pages, complexified logic...)
@AviD yeah sure if there's something that should've been found in the scope of testing (XSS on the front-page) but say for example the account provided didn't have rights to see a given page, you may never even know that
@RoraΖ heh that implies good development discipline from the target. I seriously have had people do deploys to the test environment during a pen test or immediately afterwards
I've started writing up as a security finding (under secure maintenance and code protection) when dev teams dont have a proper VCS and process around that.
@AviD nice. I remember one time I was doing a server build review and saw an admin log into the box and start surfing gaming websites, that was amusing
@RoraΖ yep. it's why I'd love to work with more DevOps kind of companies where that kind of thing is de-rigeur, instead of "oooh you want a test env. well that'll take 2 months to approve and build"
@kalina "Trillian: You idiot! You signed the order to destroy Earth! "
@kalina "Trillian: Probability factor of one to one. We have normality. I repeat, we have normality. Anything you still can't cope with is therefore your own problem. "
in my company, some russians broke through our firewall and got to our pfSense. The pfSense has a failover Design, so two WAN Connections are available. It is reachable over the internet via two diffrent addresses.
Actually our firewall blocks all incoming ports, except:
Address1:
PORT ST...
A high-risk intrusion was detected on <servername> within group Default Group on 2/12/2016 4:14:46 PM. Attack Signature: OpenSSL Heartbleed CVE-2014-0160 3
@MarkBuffalo "If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." - Cardinal Richelieu
@MarkBuffalo I can't actually set the order, there's a fine art in getting them to line up
@RоryMcCune A wonderful quote. I remember this one fondly. I do this all the time, actually. Like earlier when we were discussing the male vs. female programmers with @kalina
Proposed Q&A site for individuals who are interested in matters of etiquette within their proper contexts, including but not limited to: religious, cultural, dining, and the reasons therefore. The scope is not limited to Western etiquette.
in my company, some russians broke through our firewall and got to our pfSense. The pfSense has a failover Design, so two WAN Connections are available. It is reachable over the internet via two diffrent addresses.
Actually our firewall blocks all incoming ports, except:
Address1:
PORT ST...
