Pen Testers Abuse Configuration, Capture Creds

guest · Jul 24, 2018

Pen Testers Abuse Configuration, Capture Creds
July 24, 2018
https://www.infosecurity-magazine.com/news/pen-testers-abuse-configuration/

Over a period of nearly 10 months, penetration testers conducted external tests where the testers were able to exploit at least one in-production vulnerability in a large majority of the simulated attacks, according to a new report, Under the Hoodie, from Rapid7.

Rapid7’s pen testers were able to abuse at least one network misconfiguration in 80% of engagements and one in-production vulnerability in 84% of all engagements. In 53% of all engagements, the testers were able to capture at least one credential, and that number jumped to 86% when looking solely at internal engagements.

Additionally, Rapid7’s pen testers remained undetected on 61% of all engagements and just 8% were detected within an hour. “Even mature security teams in established enterprises still struggle with their attack detection capabilities,” said Tod Beardsley, director of research, Rapid7.
Click to expand...

Under the Hoodie - Lessons From a Season of Penetration Testing (PDF):
https://www.rapid7.com/globalassets/_pdfs/research/rapid7-under-the-hoodie-2018-research-report.pdf

Log in or Sign up

Pen Testers Abuse Configuration, Capture Creds

guest Guest

Log in or Sign up

Pen Testers Abuse Configuration, Capture Creds

guest Guest

Useful Searches