Experten aus dem binsec-Universum
The Content Security Program of the Motion Picture Association (MPA) specifies security requirements in three areas in its Content Security Best Practices Common Guidelines (Version 4.10 of February 8, 2022):
The "minimum security requirements for decentralized portals and registration authorities" for "internet-based vehicle registration (i-Kfz)" from the german Federal Motor Transport Authority (KBA) are extremely extensive. In addition to the architecture of the i-Kfz system, its…
Breaking into foreign IT systems in the role of an attacker can be very captivating. As a penetration tester, however, you should never lose sight of the actual goal: identifying all entry points and vulnerabilities in a target system. The list of vulnerabilities can become very long and confusing. To tell a customer which vulnerabilities should be addressed…
It is worth mentioning that automated methods are much faster in performing the security analysis.
Recently, during a consulting meeting, I was asked whether you are given a guarantee after a penetration test that the tested application is absolutely secure. From a customer's point of view that question is perfectly understandable. Anyone who spends anything up to several thousand…
The cost of a penetration test primarily depends on two factors: the effort involved and the day rate. The duration of a penetration test depends on the size and complexity of an application or an IT infrastructure. As a rule, there are no blanket estimates…
I have already been asked several times how you actually become a penetration tester and which approach I can recommend for it. There is neither a vocational training specialised in it nor a degree programme specialised in it. I would like to approach the answer from the reverse end…
Hard, harder, OSCP exam. Yesterday - or rather today - I got the OSCP (Offensive Security Certified Professional) exam behind me. Within a 24-hour window I had to break into several servers (Windows/Linux) and gain privileged rights. A CISSP or CISM exam of a few hours is…
With most of the systems taken over, I wanted to start on the Penetration Test Report for the lab. So far I had kept my documentation in bullet points using Keepnote. I have to admit, I should either have created the documentation in the lab right away in parallel to hacking or…
It is not just my last blog post about the OSCP course that dates from November 2013, lately I had not done anything for it either. On top of that, my lab access expired in December. Now it is starting again: ordered a 30-day extension for the lab. Goal: OSCP in March!