Home page logo  pen-test logo Penetration Testing mailing list
archives  Re: [PEN-TEST] First step of a pen-test From: Tom
Litney <Tom.Litney () NET-RELIANCE COM> Date: Tue, 19 Sep 2000
10:26:37 -0700     Usually the contract defines the scope of the
work to be performed.  I have been on engagements where we
started with nothing and on some where high level information
was provided by the customer.  If wardialing was part of the
scope, I usually asked for all the valid phone number ranges for
the company.  This is because wardialing is technically against
the law in my state and I only wanted to hit targeted numbers.
But basically, we gave the customer what he wanted.  Engagements
where no information was provided usually required more time and
therefore were more costly to the customer. I always started an
engagement with a war room approach where the team would come up
with a strategy on how we wanted to attack the target (within
the scope of the contract).  The first step was to acquire as
much informatio