[Dailydave] Immunity Certified Network Offense Professional

[matthew wollenweber]

I'd like to add two points to this discussion. First is that a key value I
try to present to clients is that pen testing shows business impact. It lets
a manager understand why security is important to the business. A list of
vulnerabilities for IPs doesn't demonstrate quite the same impact as
controlling some core business system. So successfully exploiting vulns is
important to me.

Second, I see terribly insecure apps across enterprises all the time.
They're niche products or internally developed that often sit on key
systems. They usually don't have public vulns because they're internal or
niche but if you sit down with them they're generally easy enough to break.
So doing so is reasonable way to get into a fully patched system. It also
makes you look good and reinforces security best practices like
compartmentalization, defense in depth, etc.

So while I agree pen testers don't need to be exploit developers and it
isn't a skill that's always needed, I'd add that it is one that can really
turn a vanilla assessment into cool work.


On Sun, Jul 13, 2008 at 3:03 PM, Thomas Ptacek <tqbf at matasano.com> wrote:

> > The problem I see with this is that people that can't write a simple
> >  exploit also cannot to other very important tasks such as:
> >  - Decide if a crash is exploitable at all
>
> Plenty of people who can't write X86 assembly can discern whether a
> flaw allowed them to corrupt memory. Plenty of people who can write
> X86 assembly, like myself, are content to leave it at that: memory
> corruption bad. MUSTFIX.
>
> >  - Make a judgement about the reliability of any exploits written
>
> This is circular. Sure, if you write exploits, knowing how to do so
> reliably will in fact improve the quality of the checks you write for
> your company's scanner.
>
> >  - Debug the crash to see what input caused the crash in a reasonable
> time limit
>
> This isn't true. Basic investigative skills, of the sort possessed by
> many 2nd tier call center operators, coupled with the ability to
> generate malicious outputs, and you've got this one nailed. I agree
> it's important, so test for it.
>
> >  - Discuss possible fixes intellegently
>
> What does ret-to-libc have to do with knowing how to manage sign bits,
> check multiplications, or bound copies?
>
> >  - Apply knowledge of the crash to other areas of the program to ensure
> >  that the bug isn't repeated and that the fix is in fact complete
>
> It really sounds like you want to test people's ability to write
> fuzzers. Amen to that. I'm not sure where the shellcode comes in to
> it, though.
>
> --
> ---
> Thomas H. Ptacek // matasano security
> read us on the web: http://www.matasano.com/log
> _______________________________________________
> Dailydave mailing list
> Dailydave at lists.immunitysec.com
> http://lists.immunitysec.com/mailman/listinfo/dailydave
>



-- 
Matthew Wollenweber
mwollenweber at gmail.com | mjw at cyberwart.com
www.cyberwart.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.immunitysec.com/pipermail/dailydave/attachments/20080713/ac2cb1a2/attachment.htm