Monday, March 16, 2009

Attacking Layer 8: Client-Side Penetration Testing SOURCE Boston Edition


Here's the video from our Client-Side talk at SOURCE Boston 2009



Full Scope Security Attacking Layer 8: Client-Side Penetration Testing SOURCE Boston Edition from FullScopeSecurity on Vimeo.
CG

5 comments:

Matthew Wollenweber said...

Excellent presentation. I've been using similar techniques with a fair amount of success. Some of your emails look a little more creative, but we branched out to use Canvas in addition to Metasploit and some custom tools. It would be great to exchange notes sometime.

Anonymous said...

CG: Given the vast variety of client software that can be leveraged to get internal client/workstation access, other than specifically testing a user training program or a HIPS type solution, does cutting straight to the internal test and assuming that a client will be compromised sometime make sense?

CG said...

@anonymous

I think so *sometimes*. Its all based on scope and what the customer wants/needs (those dont always match up properly).

I guess it would also depend on if you are just doing an internal PT for the sake of doing one or if you are trying to test their responses to finding the bad guy once that client side has been executed or if they want to see how far a bad guy can get given one user clicking that email.

But I dont think alot of businesses are mature enough to understand that and let testers that way.

That was probably more questions than answers to your question.

Anonymous said...

Anonymous, you're basically right. But there's a problems. I'd agree with CG on: "But I dont think alot of businesses are mature enough to understand that". Most businesses don't understand security. Sometimes the only way to communicate to them is by executing an attack and providing detailed screen shots.

hawaii67 said...

Hello Chris,

excellent talk about this most intersting topic. I really learned a lot!! Are your slides available somewhere, e.g. as pdf? That would be great.
Cheers