Interesting test, but too unrealistic bugs.
Penetration testing and low-cost freelancing
51–60 of 76 posts
Re: Penetration testing and low-cost freelancing
#52[deleted]
Re: Penetration testing and low-cost freelancing
#53So how would someone know they have connected to a honeypot? Presumably detecting this sort of thing is deliberately difficult, otherwise there isn't much point of the honeypot?
Some SSH honeypots accept more than one password for root. So, if 'letmein' and 'changeme' get you a root shell, it's probably a honeypot... but it could be a very broken PAM config as well (I have seen this firsthand).
PAM is one utter freaking nightmare to set up if one wants to stray from the distro defaults. Actually I'm astonished no one has dared to try and develop an alternative... god knows it's about time.
Re: Penetration testing and low-cost freelancing
#54I am curious how common would it be to get actual SQL (obfuscated or not) in http response. How in the world could that happen? Edit: I guess it could happen if a developer decided to debug SQL via http response which seems pretty insane
> How in the world could that happen?
Broken exception handling, for one.
Re: Penetration testing and low-cost freelancing
#55You should be satisfied with the results of a pen test if you can get a real hacker to do it for you. Finding real white hat hackers is hard, but they are out there.
Most 'security guys' are not hackers. They do not have CS degrees and are not curious at all. Rather, they are 8 to 5 office workers that are compliance and risk oriented. They run automated vulnerability scanners (that are largely useless and filled with false positives based on the version string of Apache). They submit reports to management where they discuss how to make the 'red' things 'green' to impress the Board.
Real hackers are very curious about technology and like to see how they can break things or make things do something that they were not intended to do. That's how they find bugs.
Two totally different worlds. One is focused on 'compliance and risk and loss prevention insurance policies' (basically CYA) while the other is focused on actually being technically secure by trying to break things before the bad hacker comes along and does so.
Re: Penetration testing and low-cost freelancing
#56Which platforms have you used to hire them?
Re: Penetration testing and low-cost freelancing
#57Earlier quoted context omitted.
I suspect these would be realistic vulnerabilities introduced by freelance or inexperienced devs hired by a startup, for example. They might have hardcoded admin-level passwords for debugging, then forgotten about it. They might have mis-typed HTTP headers like 'set-cookie', after having written manually a lot of auth & session management that should really be done using well-vetted libraries instead.
Respectfully, you are incorrect. Delegating session and cookie management to the framework or (in php's case) the language is so much simpler that I have seen manual implementations of this behavior only 2-3 times in my career. And the idea that logging in incorrectly would somehow return a malformed, but correct, session-setting header is again, pathological. Most of the time, these types of profound errors come fro…
eh, ive seen pros ("pros") do eerily similar thimgs in production code
Re: Penetration testing and low-cost freelancing
#58Undergrad pen-test homework assignment that someone paid actual money for. Most people got C- or worse, one guy got maybe a B-.
The "reports" are absolutely hilarious. Even better, the blog post "analysis" is worse than the pen-test reports.
Re: Penetration testing and low-cost freelancing
#59You should be satisfied with the results of a pen test if you can get a real hacker to do it for you. Finding real white hat hackers is hard, but they are out there. Most 'security guys' are not hackers. They do not have CS degrees and are not curious at all. Rather, they are 8 to 5 office workers that are compliance and risk oriented. They run automated vulnerability scanners (that are largely useless and filled wit…
I agree with all of that, except for the part about a CS degree. When I was in the military, a General was talking to us about the officers that they had doing pentesting, and they said that the people with CS and other tech degrees were usually outperformed by the people with degrees in things like political science. From their experience, the people with technical degrees would often get hung up on a problem if it didn't have a provably right/wrong answer, while the people with degrees in "soft" subjects were able to think through a problem and provide a "best" answer.
Re: Penetration testing and low-cost freelancing
#60You should be satisfied with the results of a pen test if you can get a real hacker to do it for you. Finding real white hat hackers is hard, but they are out there. Most 'security guys' are not hackers. They do not have CS degrees and are not curious at all. Rather, they are 8 to 5 office workers that are compliance and risk oriented. They run automated vulnerability scanners (that are largely useless and filled wit…
I agree with all of that, except for the part about a CS degree. When I was in the military, a General was talking to us about the officers that they had doing pentesting, and they said that the people with CS and other tech degrees were usually outperformed by the people with degrees in things like political science. From their experience, the people with technical degrees would often get hung up on a problem if it…
CS/EE degrees are optional. Many hackers do not have them. It's just an indicator that they probably know the basics (bits, bytes, systems, etc.) but certainly not required. Some of the best hackers I have worked with had dropped out of (very difficult CS/EE programs) and never finished college.