1

When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as simple as WPScan (in a Kali VM).

Here's the error that comes up:

WPScan blocked

I am aware that I am able to disable specific security risks within Symantec, but that is honestly a total pain. I have to wait about 10 minutes for the list to load before I disable a specific tool and then I have to disable specific payloads / payload types (ex: SQL injection = payload type vs. Shellshock = payload) in order to perform tests while keeping the antivirus on.

As a security professional, the words "just turn off your anti-virus" just leave a bad taste in my mouth - but I need to be able to do my job. I have to imagine that other organizations have sensible, practical policies on how to permit penetration testers to use security tools without disabling the entire defense system on the pentester's host computer. Although our policy states that you should not just turn off your anti-virus, I see other pentesters do it all the time just so they can enter ' or 1=1-- in an HTTP request.

I know I'm not the only pentester to run into this issue. What does your organization do to permit penetration testers to perform their job functions effectively without compromising on their own defensive security measures?

I want to hear your responses not just for my own benefit, but so I can understand how penetration testers can operate effectively within a large organization. Thanks in advance!

  • Enterprise endpoint protection software tends to allow you to whitelist certain IPs. I know I could do that with Symantec. – schroeder Mar 5 '17 at 7:27
1

If you're doing true penetration testing then the goal is to see what your blue team can and cannot detect or prevent. So you don't want to disable anything. Your pen tester must be skilled enough to find ways to bypass your security controls on his own.

It almost sounds though like your confusing a penetration test with vulnerability management. If you are just trying to scan for vulnerabilities, that is not a penetration test. Vulnerability scanners would be run from dedicated scanning systems that have the scanning tools whitelisted and allowed to execute.

  • Stage 1, leave the AV as is to ensure your blue team can detect the test. Stage 2, you have a couple of options, whitelist the user, the IP or the threst. Normally it's pretty easy to disable the agent, or add policy logic to exclude the user or host from enforcement or alerts. – user2505690 Nov 4 at 7:35
0

What does your organization do to permit penetration testers to perform their job functions effectively without compromising on their own defensive security measures?

We use segregated systems for testing, either through virtualisation (e.g. a Kali VM on a corporate laptop) or dedicated hardware (e.g. a testing laptop vs a corporate laptop).

I've never seen a pentester trying to work from a corporate SOE. As you've discovered, it's not a fun experience.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.