2

I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them.
While I understand the need to identify all the vulnerabilities, I don't understand why I should wait before trying to exploit a vulnerability I just found (like a sql injection, a command injection, remote file inclusion, ...) and come back to it later?
Is there any reason to proceed like that?

2

There's a chance that the result of exploiting a vulnerability early in the test could change the application. Either crashing it or just breaking certain functionality. Thus making the need to scan for additional vulnerabilities moot.

Another reason for thoroughly identifying vulnerabilities is to give the person performing the test a full understanding of the application. Perhaps that first vulnerability could be exploited even further with information gained in the later stages of the vulnerability assessment.

  • 2
    Maybe another point, is to not spend too much time on exploitation of a vulnerability and taking the risk of not testing the other vulnerabilities since we've limited time? – Othman Jun 11 '16 at 4:18
  • @Othman Great point! +1 – user2320464 Jun 11 '16 at 4:19
  • 1
    Exactly. First fully observe a system before starting to make (unwanted) changes to it. Exploits could also trigger defensive mechanisms and hide other vulnerabilities. – Potaito Aug 10 '16 at 6:24
  • 1
    If this course is anything like the ones I've seen and taken, @potAito is probably onto something. When learning methodologies (as compared to say, trying to maliciously compromise a system) thoroughness is valued because the primary expected output is an analysis (as opposed to an successful exploit). It sounds as though this instructor is attempting to help you develop the skills to perform a complete audit as the first objective and in that case it makes sense to run through the entire application (and associated stack components) to produce an inventory. – Bryan 'BJ' Hoffpauir Jr. Aug 28 '16 at 4:50
1

That sounds more like a course in how to hack someone else's site than to test yours.

Following the suggested logic allows the perpetrator to better plan a quick attack that will let them gain control of the machine before anyone has time to notice the attempts.

That provides no benefit for someone who is only testing their own system's security.

  • Well, penetration testing and hacking do require identical tools and skills. Otherwise the testing would be pointless. – Potaito Aug 10 '16 at 5:46
  • 1
    My point was that it makes no sense to try to avoid your own vigilance. – Julie Pelletier Aug 10 '16 at 6:05
0

If you keep looking you may find an easier to exploit vulnerability or one that gives you more privilege. Of course, if you first find an easy to exploit remote code execution vulnerability there's really no need to look for more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.