8
« on: January 22, 2016, 01:28:36 AM »
Well I have to tell you practice VMs at your local uni are very different from the real thing. Mostly in the sense that like you dont have any SOC on your ass, you can't just run Nessus and portscan away outside of the DMZ assuming you could without it being obvious like chances are most of the good stuff is behind the ASA. I've found that writing scripts to do passive recon on their job boards, XSSing employees, doing a lot of recon on the web apps and spidering them and writing automated test cases in advanced, knowing what to look for from job boards for example ASP.NET but with an MVC that would mean I can't really out right dork it I can use the harvester and whatweb or WAD it for info then after I get enough recon on all the web apps I map all their domains what datacenters their shit is hosted on their clients who the people working are their employers I write some XSS bots to target the people with my smtp servers or fake fbs and linked ins. I also write an automated test case for the web apps I see hoping for a server side vuln. Either way doing both at a time generally gets me in the passive recon I did before on the Job Boards help a lot why because I read documentation on the type of stuff they use I will know their back end DB commands I will know the directory structure of the web platforms they use I will know what network services they use so I already have a plan and then I just sit and wait and chip away at the network enjoying how soft it is but not being too loud leaving obfuscated malware, scripts, and cron jobs in my wake slowly but surely. Long story short like if your college is good they will teach you fuzzing and assembly and different attacks maybe some snort rules that's the best case scenario and that's considered really good. However penetration tests are nothing like real attacks in my opinion especially in a university environment because it's noisy, the client side vector is usually removed, and malware is not allowed. You have time limits that force you to do things no competent blackhat would. Long story short it really depends on what you want to do like if you want to be a skilled attacker in the literal approach you can't be so dependent on brute force if you want to be a tool monkey for a firm go ahead I'm not calling you stupid I'm being honest because I used to be noisy and rush that didn't get me anything good.