Scribd Logo
Upload

Welcome to Scribd!

  • Defcon 19 Engebretson Pauli Pen Testing

    Uploaded by

    Javier Cisneros
    11 views18 pages
    This document outlines 15 common issues encountered by those entering the field of penetration testing. It aims to dispel misconceptions about what the job entails and manage expectations. Some of the issues discussed include unrealistic client expectations, not following the rules of engagement, relying on exploits without vetting them, and how success can sometimes mean others see their work negatively. The overall message is that penetration testing is a challenging job but can still be very rewarding.

    Original Description:

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document outlines 15 common issues encountered by those entering the field of penetration testing. It aims to dispel misconceptions about what the job entails and manage expectations. Some of the issues discussed include unrealistic client expectations, not following the rules of engagement, relying on exploits without vetting them, and how success can sometimes mean others see their work negatively. The overall message is that penetration testing is a challenging job but can still be very rewarding.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    11 views18 pages

    Defcon 19 Engebretson Pauli Pen Testing

    Uploaded by

    Javier Cisneros
    This document outlines 15 common issues encountered by those entering the field of penetration testing. It aims to dispel misconceptions about what the job entails and manage expectations. Some of the issues discussed include unrealistic client expectations, not following the rules of engagement, relying on exploits without vetting them, and how success can sometimes mean others see their work negatively. The overall message is that penetration testing is a challenging job but can still be very rewarding.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 18

    Mammas

    Dont Let Your Babies Grow Up to Be Pen Testers:


    Everything Your Guidance Counselor Forgot To Tell You About Pen TesEng

    Who are we?


    2 dudes by a trash can
    Dr. Patrick Engebretson
    Network Sec wonk

    Dr. Josh Pauli


    Web Sec wonk

    So you want to be a pen tester?

    Issue 1: Your expectaEons


    Hacking like the movies!!!! Chicks dig hackers MS Windows rulz GUI > command line Become a PT, earn millions.

    Issue 2: Reality.
    Most chicks dont really care if youre leet. Linux rulz. Command line > GUI There is no money tree

    What does a budget have to do with a Pen Test? You can have anything you wantas long as its free

    Issue 3: Budgets

    Issue 4: The PT authorizaEon form should NOT give away the farm.
    This job is like ghEng Mike Tyson* with a pillow What do you mean were going to tell them were coming?
    * Tyson circa 1988

    Yes we encourage you to do informaEon gatheringit just has to be done in 10 minutes or less.

    Issue 5: InformaEon Gathering is important.

    Issue 6: You must follow the rules of engagement


    What does scope have to do with anything?
    a.k.a. you mean to tell me that that box is ripe with exploits and can give me root access to my target but Im not allowed to afack it?

    Issue 7: Fat ngers


    The dangers of having chubby lifle hands


    Circus folk. Nomads, you know. Small hands. Smell like cabbage. ~ AusEn Powers

    Issue 8: UnrealisEc deadlines


    You mean Im supposed to perform a Pen Test on 2,000 ips in 16 hours?

    Issue 9: UnrealisEc client expectaEons


    The sales men told you WHAT?
    you know its not REALLY possible to thoroughly scan 200 URLs in the next 20 minutes right?

    Using un-audited exploits

    Issue 10: Relying on other peoples work


    What do you mean I gave away shells?

    Issue 11: Relying on YOUR OWN work


    What do you mean I got our IP banned from Whois?

    Issue 12: Keeping your data secure


    What do you mean you sold the old PT machines on eBay???

    Issue 13: When your success means someone else failed.


    What do you mean the Sys Admin is mad at me for embarrassing him in front of his boss?

    You mean I have to write a REPORT on all this stu? Cant we just do a conference call?

    Issue 14: Someone has to write up all those ndings.

    Issue 15: Things Change. (aka Scanned today Hacked Tomorrow)


    Youre PT is just a snapshot in Eme

    What does it all mean???


    Yep its sEll the best job on earth

    You might also like