Penetration Testing

Found an announcement of an update to a wireless pen test tool called WifiZoo. I have been meaning to play with this tool but I just haven’t had the time. I like the fact that I don’t have to use Wireshark or another tool like Ettercap to get packet data read (ie: user names/passwords). Pretty […]

Very good article over at Dark Reading today about testing PoC exploit code and security tools before you use them in a production environment. “…how do you know if the PoC (proof of concept) exploit code you downloaded from Milw0rm or Packet Storm includes a backdoor?” The author also mentions some very good things to

I saw a good webcast and presentation on forming a red/blue team in your environment. What is a red/blue team? A red team is basically your attackers and your blue team is the defenders. This is a typical program used by the government and other large organizations to test the assessment process as well as

Ahh..netcat..how useful you are to me! If you don’t use netcat for pen testing you absolutly have to. Good article below on how you can use netcat. Some examples: * Outbound or inbound connections, TCP or UDP, to or from any ports * Full DNS forward/reverse checking, with appropriate warnings * Ability to use any

I remember awhile back reading this article about how a pen testing company came up with a a really neat way to social engineer the employees of a company. How? Place USB thumb drives at strategic locations (like the main entrance) and see if employees plug them in and open up applications or pictures contained

So Immunity is about to release a wireless handheld called “SILICA” that includes hundreds of exploits to perform automated pen testing. If you are not aware Immunity sells a product called “Canvas” which is in direct competition with “Core Impact” from Core Security Technologies. Basically, both these companies offer products very similar to the Metasploit