Penetration testing and low-cost freelancing • Hacker News Board

Re: Penetration testing and low-cost freelancing

#11

Post by mattlondon » Fri, Oct 23, 2020, 2:08 PM UTC

So how would someone know they have connected to a honeypot? Presumably detecting this sort of thing is deliberately difficult, otherwise there isn't much point of the honeypot?

Re: Penetration testing and low-cost freelancing

#12

Post by albntomat0 » Fri, Oct 23, 2020, 2:08 PM UTC

This comes down to the fact that penetration testing has a high false-negative rate. There's no way for a customer to really evaluate what a mostly empty report means, if there actually are no bugs, or the penetration tester missed them/did a poor job.

Re: Penetration testing and low-cost freelancing

#13

Post by leugim » Fri, Oct 23, 2020, 2:09 PM UTC

For those prices (except maybe the 400$) I don't think anyone is going to perform manual actions or invest more than a couple of hours.

Re: Penetration testing and low-cost freelancing

#14

Post by jpablo » Fri, Oct 23, 2020, 2:09 PM UTC

notwhereyouare wrote: post #10

tinus_hn wrote: post #2

Number 3 wil surprise you!

if anything, the number 5 should be the surprising one

I have VMs specifically for running garbage that I find/need to but I don't trust. These have 0 personal information and gets wiped to a clean state afterwards.

Re: Penetration testing and low-cost freelancing

#15

Post by lenlorijn » Fri, Oct 23, 2020, 2:10 PM UTC

This isn't really comparing the results to other pentests, so I have a hard time seeing the use of this. I think almost any pentest will miss some/many security issues.

And these issues look more like CTF style issues than real world security issues. If you're not thinking about the challenge in the right way, it is probably harder to see the vulnerabilities.

Re: Penetration testing and low-cost freelancing

#16

Post by dutchmartin » Fri, Oct 23, 2020, 2:13 PM UTC

The only thing this article proves yet again is: if you pay peanuts you get monkeys. I mean, 100 dollar is maybe enough for 2 hours of a freelancers time. But I do not think that is enough time to find both issues and scan the server.

Re: Penetration testing and low-cost freelancing

#17

Post by wayf » Fri, Oct 23, 2020, 2:15 PM UTC

I'm trying to imagine being a customer for this kind of service. When would I be satisfied with a pen testing service?

If I'm not familiar with pentesting methodologies, my only metric of satisfaction would be the pen tester's reputation i.e., if a well-reviewed pentester says my site is OK, then maybe my site is safe.

Re: Penetration testing and low-cost freelancing

#18

Post by cortesoft » Fri, Oct 23, 2020, 2:16 PM UTC

What they didn't test is whether higher cost services would find the vulnerabilities.

Re: Penetration testing and low-cost freelancing

#19

Post by th3o6a1d » Fri, Oct 23, 2020, 2:17 PM UTC

Clickbait title. I refuse to click.

Re: Penetration testing and low-cost freelancing

#20

Post by czbond » Fri, Oct 23, 2020, 2:21 PM UTC

dutchmartin wrote: post #16

The only thing this article proves yet again is: if you pay peanuts you get monkeys. I mean, 100 dollar is maybe enough for 2 hours of a freelancers time. But I do not think that is enough time to find both issues and scan the server.

I agree with you - yet there is also a philosophy that some organizations take which is to intentionally hire quite subpar 'certified' practitioners who themselves can be duped or walked past issues to provide 'clean reports' to upper management, even if false.