Devices - Penetration Testing Like a Hacker. - SecNiche Security Labs

CONTENTSPOINT OF VIEW04Isn’t Social Engineering the SafestForm of Pentesting?by Ankit PratekOne might argue over this, but for a student and a buddingpentester like me, this is the truth and holds water. Socialengineering won’t call your work illegal unless you harmsomeone personally or cause some financial loss. Plus,since you don’t have certifications at competitive prices,no one even wants you to be a certified Social Engineerat that unaffordable price.06Trust Pentesting Team. Do you?by Rishi NarangWith the advent of security and its counterpart, a largeshare of vulnerabilities has been due to human errorsin the software lifecycle. These errors have either creptin mistakenly, or the loop holes have been intentionallyinserted with ‘malicious’ intentions.FOCUS08Breaking Down the i*{Devices}by Aditya K SoodSmartphones have revolutionized the world. Theonline world is grappling with severe security andprivacy issues. The smartphone applications require anaggressive approach of security testing and integrityverification in order to serve the three metrics of securitysuch as confidentiality, integrity and availability.16Act Like A Criminalby Cory AdamsWhat, act like a criminal? That would usually beconsidered bad advice, but having an understanding ofhow cyber criminals conduct business will lead to betterpenetration testing results. In-depth malware analysiswill reveal criminals’ tactics, techniques, and procedures.These can be utilized to generate improved penetrationtesting abilities by allowing the tester to view the targetas a would-be intruder does.22Mobile Application Security Testingby Iftach Ian AmitThriving vendor marketplaces (such as iTunes and theAndroid store) encourage the rapid development anddeployment of mobile applications to consumers andbusinesses alike. Additionally, alternative 3rd-partydownload and install markets open up as software writersseek opportunities, outside the walled gardens providedby the mainstream stores.26Attacking the Mobile Infrastructureby Bill MathewsWe will explore a few philosophies for attacking amobile management infrastructure. The article will coverthe differences in testing mobile stuff vs “everythingelse” as well as reusing some of the things you know todemystify the mobile world.30ToneLoc and Load – Useful For aPentester?by Chris McAndrewWhen on average it takes less than half an hour tobypass the security of many voicemail systems and therewards can be over L250,000 for a weekends work, it’sno wonder that phreaking telephone systems is enjoyinga resurgence.34Inside Android Applicationsby Devesh BhattBy the end of 2011, the number of Smartphone shipmentsaround the world will explode to nearly 468 million unitsand the android operating system would have a fiftypercent market share. This would increase the number ofattacks on mobile applications and also the investment insecuring the applications from the attacks.(NEW) STANDARDS36New Penetration Testing BusinessModelby Arthur GervaisToday everybody can become a hacker. The knowledgespreads all over the Internet. A lot of hackers are showingtheir know-how by sharing the results of their attacks.Why do not use this knowledge through crowd-sourcingin order to globally improve the security? Starting fromthis fundamental idea, a business model has beendeveloped by Hatforce.HOW-TO42Building Your Own PentestingApplicationby Dhananjay D.GargAlthough even today web browsers serve the primarypurpose of bringing information resources to the user,they no longer represent a software application withbare bones support for just HTML. Today, web browserslike Mozilla Firefox come with the support of add-ons,which are small installable enhancements to a browser’sfoundation.05/2011 (5) SeptemberPage 3 http://pentestmag.com