8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

1/18

MammasDontLetYourBabies

GrowUptoBePenTesters:

EverythingYourGuidanceCounselor

ForgotToTellYouAboutPenTesng

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

2/18

Whoarewe?

2dudesbyatrashcanDr.PatrickEngebretson

NetworkSecwonkDr.JoshPauli

WebSecwonk

Soyouwanttobeapentester?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

3/18

Issue1:Yourexpectaons

Hackinglikethemovies!!!!

Chicksdighackers MSWindowsrulz GUI>commandline BecomeaPT,earnmillions.

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

4/18

Issue2:Reality.

Mostchicksdontreallycareifyoureleet. Linuxrulz. Commandline>GUI Thereisnomoneytree

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

5/18

Issue3:Budgets

WhatdoesabudgethavetodowithaPenTest? Youcanhaveanythingyouwantaslongasitsfree

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

6/18

Issue4:ThePTauthorizaonform

shouldNOTgiveawaythefarm. ThisjobislikefighngMike

Tyson*withapillow

Whatdoyoumeanweregoingtotellthemwerecoming?

*Tysoncirca1988

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

7/18

Issue5:InformaonGatheringis

important. Yesweencourageyoutodoinformaongatheringitjusthastobedonein10minutesor

less.

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

8/18

Issue6:Youmustfollowtherulesof

engagement

Whatdoesscopehavetodowithanything? a.k.a.youmeantotellmethatthatboxisripewith

exploitsandcangivemerootaccesstomytargetbutIm

notallowedtoaackit?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

9/18

Issue7:Fatfingers

Thedangersofhavingchubbylilehands

Circusfolk.Nomads,youknow.Smallhands.Smelllike

cabbage.~AusnPowers

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

10/18

Issue8:Unrealiscdeadlines

YoumeanImsupposedtoperformaPenTeston2,000ipsin16hours?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

11/18

Issue9:Unrealiscclientexpectaons

ThesalesmentoldyouWHAT?youknowitsnotREALLYpossibletothoroughlyscan200URLsinthenext20minutesright?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

12/18

Issue10:Relyingonotherpeoples

work Usingun-auditedexploits

WhatdoyoumeanIgaveawayshells?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

13/18

Issue11:RelyingonYOUROWN

work

WhatdoyoumeanIgotourIPbannedfromWhois?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

14/18

Issue12:Keepingyourdatasecure

WhatdoyoumeanyousoldtheoldPTmachinesoneBay???

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

15/18

Issue13:Whenyoursuccessmeans

someoneelsefailed.

WhatdoyoumeantheSysAdminismadatmeforembarrassinghiminfrontofhisboss?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

16/18

Issue14:Someonehastowriteupall

thosefindings. YoumeanIhavetowriteaREPORTonallthisstuff?Cantwejustdoaconferencecall?

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

17/18

Issue15:ThingsChange.(aka

ScannedtodayHackedTomorrow) YourePTisjustasnapshotinme

8/2/2019 Defcon 19 Engebretson Pauli Pen Testing

18/18

Whatdoesitallmean???

Yepitssllthebestjobonearth