this post was submitted on 16 Dec 2024
742 points (97.9% liked)
Greentext
7142 readers
1954 users here now
This is a place to share greentexts and witness the confounding life of Anon. If you're new to the Greentext community, think of it as a sort of zoo with Anon as the main attraction.
Be warned:
- Anon is often crazy.
- Anon is often depressed.
- Anon frequently shares thoughts that are immature, offensive, or incomprehensible.
If you find yourself getting angry (or god forbid, agreeing) with something Anon has said, you might be doing it wrong.
founded 2 years ago
MODERATORS
I'm pretty lazy, but I'd at least run a port scan so I have something to submit in a report. That takes a few minutes to run and can be scheduled to run daily so there's something in their logs.
That said, our audits always turn up something new (usually benign), so I'd be very suspicious of an "all clear" result.
Also, even without a prior pentest the admins should have a rough idea where problems areas are (or maybe even know them for a fact but cannot completely patch/disable them to not lock out legacy systems or so). A completely empty report would definitely raise suspicions
Just copy some report from online and change a few characters. Easy to do on the toilet.
You're not paid for the test, you're paid for the report.
As a professional pen tester myself, you have to test at least some of the pens to make sure the ink isn't all dried up or run out. It's not hard.
So which is your favourite flavour?
Only the best marines are able to become pen testers.
Sharpies smell great.
It’s not hard.
well, unless the ink has dried
Get a lighter
And the company doesn't ask for references, or proof of what was done?
or like a detailed report. I bet you could make a standard report and just change a few things and maybe pull the scam sometimes. The hardest part I think would be getting someone to accept from a cold call. Would need to be pretty stupid to do that to begin with.
The reports list your hardware on them generally. They need access into your network.
The truth is that instead of faking it, you just do an actual pentest. It is generally a mix of FOSS tools like kali, metasploit, nmap, etc and pay tools like nessus. These can all be automated.
Charge the money, mail them a pre setup laptop, then hit the "go" button and still sit on your ass for a week.
I was thinking this. Get a nice format with letter head or whatever for dumping from the tools but now its almost like an honest living. ewwww.
They need access into your network.
"Sir we found an issue in your security practises. You let some rando into your network. That's a terrible idea. My invoice is in the mail."
I was asked to review a project of another company, and needed access to their documentation for that. they gave me access to their whole wiki instead of just a part of it. definitely included that in the report
You jest, but I’ve read somewhere it’s actually reasonable to provide some amount of info or access to pen testers… since they’re just gonna find out anyway, but if you pay them for a week, you might as well not waste the first 3 days to have them figure the basic setup which doesn’t have an effect on the security analysis/outcome.
Yeah well you don’t want to try to scam smart people anyways.
LOL. I wish it was that easy. Also, if you say you did a pen test bjt didn't, then the client gets hit through an exploit you said you checked or should have checked for, you and your company are done.
Not me, just my company Try-N-Hack LLC.
Luckily I'll be back on my feet as ThisGuyHacks LLC in no time!
Not how that works. They will go after the company and individuals. You can bet that fraud charges will be filed with the police and don't think that wire fraud with the feds is out of the question.
It depends on what happened. If the company simply said they'd done the test but never gave any of the tasks to their employees then the employees would be in the clear. You can't be sued for something you never even knew about.
But if the company had taken the contract on in good faith given the task to an employee and then they'd just lied to their managers and said they'd done it then yeah the employee could be gone after.
Lawsuits will name the company and specific individuals they believe are complicit. The company by default because they are the ones with insurance.
Just the same method I employ when people want refunds
>get sued a week later when a real hacker breaks into their system and the IT department notices a security flaw that would easily be addressed by first few staps in pen testing
It's in crypto and I'm in Portugal.
Points out where working with me give no security guarantees, that they accept when agreeing to allow me to hack them, either in person, writing, or electronic communications, along with allowing the terms to change at any time, for any reason, without notice.
This is why you should hire me, the pen tester tester. For $2000 I'll make your network slightly less secure to see if the pen test catches it.
With the exception of Girl Scout cookies, I don't buy anything from anyone that shows up unannounced.
If I didn't know I needed it until now, I need to do research before I buy into it.
If I did know I needed it and you showed up randomly, I have no reason to expect that you provide any reasonable value with your services.
Door to door sales are as dead as cold calls and email.
At least do some auto scans with WebCheck, Shodan, nmap + vulnerability scans and some basic OSINT on their boss so you can report something and at least spook them a little bit.
I’ve always wanted to start a ghost busting business.
Just explain that after I’m done, all the strange sounds they hear have a perfectly logical explanation.
Providing one half of a double blind study.