6

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the internet as some of the ISPs monitor the use of such tools and will block access to your internet if they feel you are using such tools.

If this is true - this is a gem of an advise. But the reason I am questioning this is because in no other book I read was this even casually mentioned. So my questions are,

  • Is this advise correct? Will someone have his/her internet connection blocked for using pentesting tools over the internet (with authorization from the website owner)?
  • Are there any workarounds - like running the remote pen test from say a cloud host?
Improve this question
  • 1
    Consider changing the title. – rook Aug 4 '15 at 3:40
  • Sure do you have a suggestion? – Yazad Aug 4 '15 at 3:46
  • 3
    Potental Subject: Do ISP Detect Pen Testing Tools and block? – David Waters Aug 4 '15 at 3:56
  • 1
    VPNs are the typical solution. In essence, get closer to your target so that the ISP doesn't notice what you are doing. – schroeder♦ Aug 4 '15 at 3:59
  • @schroeder, good sugestion, but this is case of purely over the internet and not through a secure tunnel like an IPSec VPN. – Yazad Aug 4 '15 at 4:43
3

First of all, there is a difference between performing a penetration test and an automated scan (low hanging fruits) where automated scans generate a lot of traffic.

Then there is a difference between infrastructure and (web) application penetration tests and then it depends on the type of test:

  • Black Box
  • Grey Box
  • White Box

Infrastructure Penetration Tests

For infrastructure penetration tests I can see where a Black Box PT might get you in trouble with your ISP. In my opinion, you should never recommend to this type of test to your clients because you might not get anything out of it.

While with a Grey or White Box approach you can analyse what an attacker could have done if no information was given (e.g. Black Box approach)

Application Penetration Tests

For (web) application penetration tests, this is done manually, which means this should be considered "normal" traffic. If an ISP would block your connection, chances are they're using DPI (Deep Packet Inspection) but this is considered illegal in some countries.

I have performed hundreds of penetration tests from my home internet connection and I have never ever been warned or blocked by my ISP. (Even when performing automated scanning tools such as Nessus and Acunetix)

So all in all, I think penetration tests can be executed without getting blocked, but that's from my own experience.

Improve this answer
  • Thanks, voted up. But don't you think all 3 - black/grey/white box testing would involve scanning? In that case why is this distinction necessary? – Yazad Aug 4 '15 at 4:45
  • 1
    It might, generally what newer security consultants do is run a scanner to get an idea of where to look for specific issues. The more experienced security consultants generally (from experience) use a browser and Fiddler / Burp Suite. – Jeroen Aug 4 '15 at 5:26
  • 1
    I don't really understand your section on Infrastructure Penetration Tests. Are you talking about port scans alerting IDS systems? Have you any facts and figures to backup your answer? – SilverlightFox Aug 4 '15 at 11:35
  • As far as infrastructure I mean port scans, login attempts (SSH / RDP / Mail) and scans like Nessus. These type of scans are typically caught by IDS/IPS systems. No, I don't have any facts and figures, I only have my personal experience among multiple ISP's in the Netherlands. – Jeroen Aug 4 '15 at 17:09
1

most ISPs will have some security measures to protect their own infrastructure(mostly OSI L3, L2 devices and DNS stuff)

so, if your pen testing involves these above infrastructure, there is a good chance that the ISP will notice it.

The best workaround is the one by @schroeder♦ - use a VPN.

Improve this answer
1

I've indeed crossed this advice in a few other books as well, but this was more a legal than a technical advice.

If you are using a personal internet access (enterprise offers are less likely to be shut down by the ISP), and / or if you did not take the proper legal measure around your penetration testing activity (proper contract signed, every involved person duly informed, etc.), then you get in trouble with your ISP:

  • Either due to the abnormal activity generated from your line,
  • Or because they will begin to accumulate abuse reports coming from your targets.

In either way, chances are that you internet connection will be shut down and that you will have to subscribe to another ISP (again such direct measure will most likely affect personal Internet access than corporate ones where the ISP will show more care before loosing a customer).

Improve this answer
  • Voted up - thanks!Would you know of any reported cases where individuals were in trouble because of this? – Yazad Aug 5 '15 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.