The approach should depend on the scope of the
project. Do they only want to find application
vulnerabilities, or do they want to know what an
application user might be able to do beyond their
authorization level? Testing only the application
would not include testing the platform. It can be
assumed to have typical Windows vulnerabilities and
should be tested, but for a variety of reasons, the
customer's internal audit team, security officer, etc.
might not want that to be part of this project.
There might be many other things to include in the
scope depending on their organizational policies and
whether there is a security policy defined for the
system and application. While written policies are
often badly written and fail to take significant
factors into account, they at least give you an idea
of the organization's concerns and intent. Good to
review if they exist.
--- IRM <irm@iinet.net.au> wrote:
> Dear All,
>
> On my recent pen-test, I need to deal with an
> application that sitting
> on the remote host. The way its works is that the
> client need to connect
> to the remote server through Citrix and run the
> application.
>
> 1) I feel that this is quite challenging pen-test as
> I do not have full
> control to the remote server. This gets me thinking
> that apart from
> analyzing the traffic from the client PC to remote
> host and input
> validation checking. Is there any thing that I could
> possibly do?
>
> 2) I noticed that the Citrix Client (Citrix Program
> Neighborhood 7) used
> Basic Level encryption. I couldn't find anything in
> regards to this
> Basic Level Encryption as to which algorithms that
> Citrix uses. I was
> wondering whether this Basic Encryption could be
> cracked easily. Any
> thought around this?
>
> Cheers,
> John
>
>
------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Are you using SPI, Watchfire or WhiteHat?
> Consider getting clear vision with Cenzic
> See HOW Now with our 20/20 program!
>
> http://www.cenzic.com/c/2020
>
------------------------------------------------------------------------
>
>
____________________________________________________________________________________
Moody friends. Drama queens. Your life? Nope! - their life, your story. Play
Sims Stories at Yahoo! Games.
http://sims.yahoo.com/
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
|