Hi Zaki,

I this case I was refering to automated scanners, which wont detect
everything :)

Yes, penetration testing can find things like insecure cryptographic storage.
However to be sure you really need to have access to the servers (esp
databases) and the source code.

Cheers,

Simon

(Resent without formatting;)

On Mon, Mar 5, 2012 at 11:00 AM, Zaki Akhmad <zakiakhmad (at) gmail (dot) com [email concealed]> wrote:
>
> On Wed, Feb 29, 2012 at 3:44 AM, psiinon <psiinon (at) gmail (dot) com [email concealed]> wrote:
>
> > Hi,
> >
> > You should be careful with scanners that claim to test "the OWASP Top Ten".
> > For example, "Insecure Cryptographic Storage" is one of the OWASP Top
> > Ten but this is typically only detectable server side, so no web app
> > scanner will find it :)
>
> So Simon, a penetration testing won't cover all?
>
> The simplest test case for this insecure cryptographic storage is by
> requesting a forgot password. If the web application sends your
> password in clear text, then you found the issue.
>
> --
> Zaki Akhmad
> OWASP Indonesia

--
OWASP ZAP: Toolsmith Tool of the Year 2011

------------------------------------------------------------------------

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[ reply ]