« first day (2155 days earlier)      last day (3023 days later) » 

Stack Exchange
Stack Exchange
05:08
Once you've done this, make a note of how old they were. Then, when their age reaches double that, show them this chart again.
 
11 hours later…
Aria
Aria
16:12
got plenty of views for one question (around 2.5k in 1 day), but there arent any good answers
The question was about the pen-testing and contract fulfillment, whatever I need to exploit something or just find vulnerability
somebody argued that he can do automated test himself
So I think the right pen-test would try to find more vulnerabilities then automated test
and it would include not only list of the vulnerabilities, but also good, actionable analysis of the issue
and basic exploitation is still required to prove the point beyond doubt, things like cross-site scripting
and also some brute-force won't be bad
CodesInChaos
CodesInChaos
Different customers have different expectations.
Aria
Aria
yeah, my idea was to maximize the list of issues (going wide), instead of going deep when it's not always successful
however, with relatively easy / obvious issues, some exploitation would be good
that would include login boxes, websites
but some people may want to do different things
and to have good analysis
crovers
crovers
@Aria Wide is only valuable if there's guidance as to severity - it is easy to hand someone a thousand page report if you go too wide. To me, a pentest should help guide the organization as to what needs to be fixed NOW, because the reality is that it can't be all fixed instantly (or even at all sometimes..)
CodesInChaos
CodesInChaos
If the issue is obviously bad, then I don't need to see an exploit. Exploits only matter if it's not clear if an issue is actually a problem.
crovers
crovers
Which is why I like actual pentesters to concentrate on showing me the exploit, rather than giving me output of tools that say 'there might be a problem here'... Tools give lots of false positives and false negatives. I'm not discounting them in my answer, but if I'm coughing up pentesting bucks / internal pentesting hours, I want focus on what can be exploited
Basically, as a blue team guy, I'm drowning in tools output - I've got SAST tools, software composition analysis tools, dynamic application testing tools, I got SIEM reports, I got 'wide' all day long. But if I want deep, I need to put in the grunt work to dig in, figure out what's real, what's not.
With a pentest, I want you to do that work - I want a PEN test - can you get in? What's the obvious route? I want to see the failures - it shows me where my defences work. I want to especially see successes. I got an infinite number of 'maybes' already. Anyways, that's my perspective and that's what I was trying to get across in the answer. I'll let someone else answer :)
Aria
Aria
16:33
okok
I think showing the real stuff is very important
Anyway, as example, PHP 4 from 2007 but built in a way that most of exploits wont work, therefore it's vulnerable but not exploitable
however, displaying this version in netcraft is not good for software development company for a real example
anyway, showing up the real issues is not that difficult assuming it's possible to start by gaining some low-level access
so the pentest done from outside is one thing, but it can be done from other employees privilege level as well, which I think it's good to ask for
crovers
crovers
Yeah, I agree with that.
grochmal
grochmal
From an organisational standpoint, a pentest is also a useful tool to give voice for the security concerns that are already present but not acted upon.
What do i mean: in an organisation big enough employees may have security concerns that are not acted by management. And it is needed a pentest report to force action to be taken
In other words saying: "Our company gives paramount importance to information security." and then publishing all SFTP passwords on the wiki. Is easy.
Being auctioned for a pentest report which contains: "Passwords to all FTP sites, for all departments, are available on the wiki for all employees"
is a different story
crovers
crovers
16:49
Even better is "And we used that access to reach..." - I've seen too many "no brainers" de-prioritized in my time...
(explicitly not talking about my current employer there :) )

« first day (2155 days earlier)      last day (3023 days later) »