Tag Info

Hot answers tagged

4

In the UK, law is a strong factor. The Human Rights Act 1998 states: Everyone has the right to respect for his private and family life, his home and his correspondence. So if any users that are caught up in the penetration test have an "expectation of privacy", then you are required by law to inform them prior to any testing. Note that just because ...


3

Both hash tables and rainbow tables store precomputed hash values. Rainbow tables are a computing power vs storage tradeoff compared to hash tables. They are used because hash tables can grow very large especially as the throughput of cracking hardware has improved. You can brute force more combinations but now you need to store more. How much space are we ...


2

Google/Github should be able to help you with this question. The language a tool was written in only matter if you're looking at the source to extend/enhance/troubleshoot the tool and in that case the usefulness of haskell is increased for people that know haskell and decreased for people who don't know haskell You can write exploits in any language, you ...


2

If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell ...


2

For me the answer to this question largely revolves around the type of testing being undertaken. If you have a "proper" penetration test where the testers are simulating an attack, a decent quantity of the benefit of the test is seeing how/whether the attack is noticed and how the internal users/IT react (e.g. do they report it to the helpdesk if something ...


1

Speaking of isolated pentesting, compartmentalisation is your friend. It's always good if someone knows what you're up to. Could be the Board, CEO, CSO, ICT director, or any other lower management but people that are going to be pentested should not be informed if you want to observe genuine reactions. There are some cons though, mostly if your testing is ...


1

Only the external scan requires an ASV: PCI 3.1 states: 11.2.2 Perform quarterly external vulnerability scans, via an Approved Scanning Vendor (ASV) approved by the Payment Card Industry Security Standards Council (PCI SSC). Perform rescans as needed, until passing scans are achieved. It is only on internal scans where you can run a tool such as ...


1

SilverlightFox, I feel that there are 3 main points one must keep in mind when disclosing a penetration test to personel: What systems are you targeting? - The most important because depending on what is in scope, technicians for these services might need to made aware so that they can prepare and remediate any issues that arise. What are the laws and ...


1

One crucial thing is to refer to the company's Information Security Policy. These policies will also decide what an employee is allowed and not allowed to do in the company with aspect of IT security. It also decides what will be the penalty if an employee breaches a security policy. So for eg: if the policy says that the company can monitor any one any ...


1

That mainly depends on whether the user should know of the test. Of course, since you're simulating a real attack, you may or may not tell them, where comes the dilemma of things users would do. It's just that you should inform all those users for whom you are not testing the preparedness of attack. That's safe enough, because real attacks can come anytime ...



Only top voted, non community-wiki answers of a minimum length are eligible