Penetration Testing IT Security Knowledge Share Evening
The Penetration Testing team at 7safe were delighted to welcome guests from a wide variety of organisations to our IT Security Knowledge Share Evening in the city of London on 14 October. Ian Glover, President of CREST (Council of Registered Ethical Security Testers) addressed the audience, explaining the necessity of high standards of competency within the pen testing community and importantly, how CREST is driving standards globally.
Highly informative demonstrations were presented from 7Safe’s Penetration Testing and Security Investigations and Assessments teams during the evening. These were designed to share some of the latest exploits and security incidents seen within organisations.
See detailed descriptions and videos below.
Ryan Jones, Daniel Compton, Aleksander Gorkowienko: 7Safe Information Security Consultants
Cross-Site Scripting Explained
In his demonstration, Information Security Consultant, Aleksander Gorkowienko showed the audience a real life exploitation scenario of XSS flaw which is one of the vulnerabilities most frequently found during everyday penetration testing. The live demo illustrated how an attacker may exploit Persistent Cross-Site Scripting flaw, steal a user’s cookie then takeover his session and access sensitive information (e.g. bank statements).
Real World Penetration Testing
Daniel Compton, Information Security Consultant of 7Safe, took the audience through a demonstration of common risks found that he sees whilst carrying out penetration tests for clients. This covered two main areas which were “client side attacks” and “pivot attacks”. The demonstrations were all based on fully patched Windows operating systems with anti-virus protection, firewall protection and the latest patches for 3rd party products. Once the client victim computer was exploited from the Internet, Daniel demonstrated how it was possible to pivot and dive deep into the internal corporate network and extracting passwords and credit card data. You can watch the video demonstration below.
Security Assessments: Common Weaknesses
7Safe’s Senior Security Investigations & Assessments consultant Ryan Jones, delivered a presentation outlining two basic security issues which have been found on a large number of Security Assessments. His presentation was delivered with an encouragement for attendees to tackle these problems themselves as they can be solved in simple procedural ways: “If you have a Security Assessment, give the consultants a challenge, don’t fall foul of these simple issues.”
Download PDF
