O'Reilly logo

Hacking the Hacker by Roger A. Grimes

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

25Penetration Testing

This chapter covers the requirements that make a hacker a legal, professional penetration tester, plus other hints that can help any pen tester’s career. In addition, I cover the most sought‐after certifications.

My Penetration Testing Highlights

There is no doubt that penetration testing was one of the more enjoyable periods of my career. Hacking is fun. It’s hard to pick the best projects I participated in, but the following sections examine some of the most memorable ones.

Hacked Every Cable Box in the Country

We had been hired to see if we could break into a new cable box that the largest cable company in the world was planning to release. I used a port scanner to enumerate all the network ports, which found about a dozen open ports. I then used Nikto, a web server scanner tool, to scan all the ports hoping that one of the ports might have a web interface. One did. Nikto identified one of the ports as an obscure web server software program that I never heard of and said it had a particular vulnerability. But when I tried to exploit the vulnerability, it was not exploitable. But I knew the web server software was old, which meant it was likely full of old bugs that newer web servers had long ago patched. The first thing I tried was something known as a directory traversal attack (essentially I typed in http://..//..//..//), and it worked. I was now the admin and had complete control of the cable box.

We reported the vulnerability to the customer, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required