-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
1/18
MammasDontLetYourBabies
GrowUptoBePenTesters:
EverythingYourGuidanceCounselor
ForgotToTellYouAboutPenTesng
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
2/18
Whoarewe?
2dudesbyatrashcanDr.PatrickEngebretson
NetworkSecwonkDr.JoshPauli
WebSecwonk
Soyouwanttobeapentester?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
3/18
Issue1:Yourexpectaons
Hackinglikethemovies!!!!
Chicksdighackers MSWindowsrulz GUI>commandline BecomeaPT,earnmillions.
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
4/18
Issue2:Reality.
Mostchicksdontreallycareifyoureleet. Linuxrulz. Commandline>GUI Thereisnomoneytree
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
5/18
Issue3:Budgets
WhatdoesabudgethavetodowithaPenTest? Youcanhaveanythingyouwantaslongasitsfree
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
6/18
Issue4:ThePTauthorizaonform
shouldNOTgiveawaythefarm. ThisjobislikefighngMike
Tyson*withapillow
Whatdoyoumeanweregoingtotellthemwerecoming?
*Tysoncirca1988
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
7/18
Issue5:InformaonGatheringis
important. Yesweencourageyoutodoinformaongatheringitjusthastobedonein10minutesor
less.
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
8/18
Issue6:Youmustfollowtherulesof
engagement
Whatdoesscopehavetodowithanything? a.k.a.youmeantotellmethatthatboxisripewith
exploitsandcangivemerootaccesstomytargetbutIm
notallowedtoaackit?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
9/18
Issue7:Fatfingers
Thedangersofhavingchubbylilehands
Circusfolk.Nomads,youknow.Smallhands.Smelllike
cabbage.~AusnPowers
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
10/18
Issue8:Unrealiscdeadlines
YoumeanImsupposedtoperformaPenTeston2,000ipsin16hours?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
11/18
Issue9:Unrealiscclientexpectaons
ThesalesmentoldyouWHAT?youknowitsnotREALLYpossibletothoroughlyscan200URLsinthenext20minutesright?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
12/18
Issue10:Relyingonotherpeoples
work Usingun-auditedexploits
WhatdoyoumeanIgaveawayshells?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
13/18
Issue11:RelyingonYOUROWN
work
WhatdoyoumeanIgotourIPbannedfromWhois?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
14/18
Issue12:Keepingyourdatasecure
WhatdoyoumeanyousoldtheoldPTmachinesoneBay???
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
15/18
Issue13:Whenyoursuccessmeans
someoneelsefailed.
WhatdoyoumeantheSysAdminismadatmeforembarrassinghiminfrontofhisboss?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
16/18
Issue14:Someonehastowriteupall
thosefindings. YoumeanIhavetowriteaREPORTonallthisstuff?Cantwejustdoaconferencecall?
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
17/18
Issue15:ThingsChange.(aka
ScannedtodayHackedTomorrow) YourePTisjustasnapshotinme
-
8/2/2019 Defcon 19 Engebretson Pauli Pen Testing
18/18
Whatdoesitallmean???
Yepitssllthebestjobonearth
