+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Pentesting company reported ruby code injection, but the server doesn't have ruby ins (/showthread.php?tid=5946415)
Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 1, 2019
Long story short, we received the pen test report today, and one of the "high risk" things we need to fix is ruby code injection, but the server doesn't have ruby installed. How can that be possible? Is this maybe a false positive or a bad test?
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - valetta - Mar 1, 2019
Who ran your pentest? Kinda unrelated
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 1, 2019
(Mar 1, 2019 03:42 PM)valetta Wrote: Who ran your pentest? Kinda unrelated
A company. Not gonna name specifics. But a legit registered infosec company from around here.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - valetta - Mar 1, 2019
(Mar 1, 2019 03:52 PM)Fishsticks Wrote: A company. Not gonna name specifics. But a legit registered infosec company from around here.
Well did they do a pentest or did they just run a VA and just call it a "pentest" ? Because automated scans aren't pentest and a lot of "legit" orgs don't even validate findings and just slap them on the report.
Maybe it's calling something that involves ruby that doesn't directly affect the assets = FP, but they slapped it on the report because they did a VA isntead of a pentest.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 1, 2019
What is FP?
It was more of a VA/vulnerability scan using Burp suite, they claim to have found 4 possible attack vectors but in the end, security wasn't compromised and no data was leaked.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - valetta - Mar 1, 2019
(Mar 1, 2019 04:02 PM)Fishsticks Wrote: What is FP?
It was more of a VA/vulnerability scan using Burp suite, they claim to have found 4 possible attack vectors but in the end, security wasn't compromised and no data was leaked.
FP = False Positives
Yeah, pick who does your pentest properly, Burp scanner just scans and has tons of FP, it's hard to tell if they don't validate the findings.
They don't pursue those things. Sometimes, something that's marked as "low" or "medium" threat can also be leveraged to compromise a machine, so point is, don't just do a VA, validate and ask them to do manual testing.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 2, 2019
They describe doing manual testing, but they were unable to use any of the vulnerabilities from the burp scanner to access data or compromise security. The ruby one strikes me as an obvious FP, but there are two more that also seem to be FP.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Sitrep - Mar 2, 2019
This sure sounds like a scanner that left a false positive to a person with low experience in the subject. Don't pay that guy if you hired him.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 2, 2019
We paid them $1500, but we do know the tester used was a Junior guy. The dumb thing is this pentest(that has to be done by an external company) is standing in the way of $1,000,000 in VC funds, so I'm kinda pissed off.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Sitrep - Mar 2, 2019
(Mar 2, 2019 12:32 PM)Fishsticks Wrote: We paid them $1500, but we do know the tester used was a Junior guy. The dumb thing is this pentest(that has to be done by an external company) is standing in the way of $1,000,000 in VC funds, so I'm kinda pissed off.
Oh damn! I feel ya man... That's bad news for you.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - valetta - Mar 3, 2019
(Mar 2, 2019 12:32 PM)Fishsticks Wrote: We paid them $1500, but we do know the tester used was a Junior guy. The dumb thing is this pentest(that has to be done by an external company) is standing in the way of $1,000,000 in VC funds, so I'm kinda pissed off.
Ok 1,000,000 is a bit too expensive for a webapp. We don't even charge that much LOL, never cheap up on a pentest. It's protecting you from losing money rather than earning you money, which is important.
Burp suite pro is $400 for a year, so you could've ran that yourself on the website instead of paying $1500 for the exact same thing, without proper validation.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - Fishsticks - Mar 3, 2019
(Mar 3, 2019 09:21 AM)valetta Wrote: Ok 1,000,000 is a bit too expensive for a webapp. We don't even charge that much LOL, never cheap up on a pentest. It's protecting you from losing money rather than earning you money, which is important.
Burp suite pro is $400 for a year, so you could've ran that yourself on the website instead of paying $1500 for the exact same thing, without proper validation.
We had to use an external company otherwise we could spoof our results. The VCs required it.
RE: Pentesting company reported ruby code injection, but the server doesn't have ruby ins - valetta - Mar 3, 2019
(Mar 3, 2019 02:27 PM)Fishsticks Wrote: We had to use an external company otherwise we could spoof our results. The VCs required it.
Ah gotcha, yeah just something to keep in mind next time I guess! Good luck