Penetration Testing is one of the most advanced skills within the information security field. It requires not only extensive knowledge but also an analytical and often times creative mind. It’s generally accepted in the community to be an area reserved for the best and most experienced within the infosec field.

While the pentest process involves mostly manual techniques, there are tools available that can assist one during the process. Most of these tools, however, do only small pieces of the process. They cover information gathering, vulnerability scanning, etc. No tool has ever claimed to be able to go from start to finish through an entire pentest — well, none until recently.

There’s a new tool on the scene that supposedly can do everything. It claims to be able to do the discovery, the scans, and finally the compromise and privlege escalation as well. Many in the industry are bothered by this for a number of reasons. First, there’s the primal fear issue. Will we be replaced by a well written piece of software? Ultimately the answer to that is no, but the second question is more poignant.

Will tools like this cheapen the discipline of pentesting — effectively making it available to less-skilled professionals?

The answer is yes, and I can tell you first-hand that it’s the case. Just now I was installing this tool (my company is all about it right now) and was given two options for doing port scans. I could either do the defaults or do custom scans. Fair enough. The problem was the subtext for the custom scan; it read:

“For advanced users.”

Excuse me? Is there another kind of user doing pentests? Evidently so. I openened the menu (to unveil the “advanced” options, you understand) and found timing options for how long to wait before sending “SYN” packets. Wow. That’s high-level stuff.

Keep in mind, this tool is used to emulate a full-blown attack on a customer’s network. this is supposed to be performed by highly qualified professionals with years of IT experience. As I said, it’s one of the most advanced skillsets an information security professional can have. The direct implication that the company that made this tool thinks there would be people performing pentests who didn’t know how port scans worked is quite scary. Worst of all, it’s a sign of things to come. More and more will be calling themselves “pentesters” on the grounds that they were able to get a license for an automated tool. It’s quite sad.

Ultimately it won’t matter because the results that a true pentester can get will always surpass the results of the unskilled wielding applications. But in the meantime our discipline will take yet another hit in the credibiliy department. When managers hear about this sort of application they automatically assume that running foo_tool is a pentest. And that mistake right there is what leads to a great many professionals (and their skillsets) being undervalued.

I realized something about myself tonight that’s worth noting.

It seems that when I approach a skill (say Table Tennis) I focus so much on being a student of the discipline that I almost ignore the element of competition altogether. That may not sound bad, but it is.

Essentially, when I study things, I study to master my technique. I don’t study to win. I want to win, or at least it would be nice to win, but it is far more important to me that I flawlessly execute my movements.

One could argue that I am not focused on the right thing for competition. I noticed this in my last tournament. I was working on doing x or y in my game, and I was losing. After one of the games a guy came up to me and said, “Why do you keep going to his forehand? He’s got a wicked shot on that side and he almost never misses! Don’t go over there!”

It was quite profound. I realized then that I wasn’t even paying attention to how to beat the guy. I found myself thinking, “Yeah, maybe I could beat him if I did that, but I should be able to beat him going to his forehand.” In short, in my mind I wasn’t winning because I wasn’t playing good enough.

To put it another way, finding the other guy’s weakness isn’t attractive to me. What I want to do is develop my own strengths instead — and subsequently overpower my opponent doing what I want to do. It’s utterly inefficent to do this without also attacking places where your opponent is weak.

I contrast this to my buddy Ken. He’s a competitor of the highest caliber. He’s the type to finds a new hobby and is competing in it at the regional level within a few months (when others would take years to do the same). He focuses directly on victory in competition. He masters technique as well, but the whole time he’s studying it, he’s studying with one goal in mind — winning. So if an opponent presents a weakness, he’s going to see it and be able to take advantage. I don’t seem to do that by default.

Perhaps I should do so more. I don’t want to do it so much that I lose what I love about my sport, but perhaps it’d be fun to win more often.

I swear — if I have to hear Bruce Buffer attempt to be his brother one more time I’m going to get violent. I am sure he’s a nice guy and everything, but he is without a doubt the worst announcer I’ve ever heard in my life.

His voice is painful to listen to; it causes hatred and anger to boil within me. At first it’s funny (he looks like Bill Murray’s character in Caddy Shack), but then after hearing it a few times it becomes the smell of burned popcorn.

For the love of God, will these people please get a new announcer? Just because his brother has a voice doesn’t earn him the right to torture millions of people. All the training and voice excercises have done nothing to help the guy; he needs to find something else to do.

It was fine when the UFC was just starting out — cool, he’s Michael Buffer’s brother — but now that it’s legit and becoming mainstream, they need to get someone in there that doesn’t cause physical discomfort in his listeners.

So being in a new state and all I had to get a new license plate for my car. When making my selection of which “skin” to use (wildlife, colleges, etc), I remembered that I could go the personalized route too if I wanted to.

So, as of tonight, I now have my very own “GENTOO” license plate. I’ve been highly enthused about getting it, but to be honest it feels kind of lame now that I have it. I’ve never liked the whole “display” thing too much — bumper stickers, flags, etc. But here I am not only sporting a glider on my car, but now a Gentoo license plate.

I guess my only saving grace is that nobody knows what they mean. That makes it better, I think, but not much. The question I keep asking myself is, “What would I think if I saw a Gentoo plate on someone else’s car?” The answer is that I would simultaneously think it was two things — cool and lame.

I’d probably go up to the guy and share some Gentoo stories, but I am inclined to think less of people who fly flags for their causes. It’s so…”look at me”.

So what the hell was I thinking in the DMV when I got a damn Gentoo license plate? Oh, I remember, I didn’t want to get one randomly assigned to me. I wanted to define myself what went on it. I tossed around a few ideas and settled on Gentoo. Bah.

Oh well, most people won’t think it’s custom anyway. I went with the default theme and it’s not a common word by any stretch of the imagination. Most everyone seeing it will assume it *was* assigned to me.

So what are your opinions? Is it ok to support a distro like this since it’s obscure enough to not stand out, or is it lame to do anything that’ll be recognized? That’s my problem — I’ve always liked to blend in. I’ve never liked to stand out, and that’s what this runs the risk of doing (at least with a few people).

Thoughts?

I think everyone, when buying an item from a vending machine, should leave their change in the return slot. I have simple logic for this:

The “good luck” feeling a person gets when they find the left-over change is worth more than the change itself.

If I hear another person on Fox News say “Homicide Bomber” I’m going to get violent. I swear these people are retarded.

Here’s the concept for the term:

It’s not fair to the victims to call it a suicide bomber, because they didn’t only kill themselves.

Are these people completely dim? Do they think people regularly take themselves out (and only themselves) with explosives?

Here’s the real reason it’s a stupid term. Bombs kill people. When you hear that a bomb went off in a shopping mall in Tel Aviv, you know it was meant to kill human beings.

Now, that leaves two types of bombs — the kind where it was remotely detonated and the attacker was not killed, and the kind where the attacker had the bomb with them when they detonated it. That’s called a fu#%ing suicide bomb. It’s different because of the suicide — not because it killed other people.

Or, to put it another way — the term homicide bombing is redudant — suicide bombing is not. You can have a bombing that kills people that isn’t a suicide bombing, but you can’t have a bombing that kills people that’s not a homicide bombing. So why say it?

Sometimes I hate people.

A while back I wrote myself a little online books database using L.A.M.P; it was utterly simple — a couple of text fields for the author and book title, and a way to list the current books in the library.

Well, just recently, someone commented on the post that I should use librarything.com. I just went and checked it out and it’s quite awesome.

If you’re into reading and/or are anal enough to want to know exactly what books you own, you need to check it out:

http://www.librarything.com

Damn.

I used to be into the whole web-design thing, and wow — this is a colossal development. This is like Microsoft buying RedHat, or Symantec buying Mcafee.

It will be cool to see the products coming out of Adobe though — the combination of the offerings from the two have awesome potential.

I’ve gone and done the unthinkable — I’ve gone to KDE as my desktop environment.

I’ve traditionally hated the option because of the interface — not the way things work, mind you, but how they look. It looks so cartoonish — bouncing icons, cheesy graphics — I couldn’t stand to see it for more than a few seconds. Unfortunately for me (it’s a flaw), I can’t help but be bothered by a horrible look and feel.

Alas, those problems are still there. The issue is that it’s just far more functional than Gnome is (for me, anyway). It’s just a very mature environment; it feels like a real desktop — almost like OS X. :)

Once I hash out my interface/theme issues I think I’ll be all set. So if anyone knows how to make KDE 3.5 look as pretty as Gnome in Ubuntu, do let me know. :)

So, as you may have noticed, my site has slowed to the proverbial crawl. I’m in the process of trying to figure out what the problem is. It’s not AdSense, it’s not the WordPress beta (I downgraded to check), so it may be my host. Not sure yet.

Edit: It seems a very nice person (thanks Allan) has led me to the answer — Google Analytics. I’ve removed the code that allows it to work, and things have improved. Dissapointing.