Printable View
I was wondering if anyone knows of a site out there that could do some penetration testing other than grc.com. I'm not too sure if pentration testing is the right phrase I should really be using. Maybe scanning would be more appropriate. I just brought up a firewall with a web server sitting behind it, and would like to see how it holds up.
Any ideas?
Thanks!
scan.sygatetech.com offers a scanning service with lots more options than GRC.
Go ask an underground security firm. Hell, even people on this site might do it. but send an email to people at the cult of the dead cow ( http://www.cultdeadcow.com ) or attrition ( http://www.attrition.org ) , tell them what you are looking for and see if they direct you. NOTE: If you send an email to attrition, try NOT to sound like a jackass, they kindof "frown" upon that. And check this post, I'm sure you'll find some takers who are looking to flex their muscle.
OR you could do what Vladamir Putin did: Claim that NOBODY can hack your website and sit back and WAIT for it.
The stuff that grc.com does is NOT penetration testing, it just does a port scan of your system (or at least that is all I have seen it do). I definitely have not ever seen it try exploits. A simple thing you can do if you just want to test one system is to grab something like nessus and run it from behind your firewall against your webserver. Nessus is free and it pretty much is automatic and gives you at worst cryptic information on how to fix the vulnerability (although it can be somewhat of a pain to setup)...
IMHO, it is better to scan behind a firewall rather than through one, that way you get a truer idea of just how vulnerable your server is (especially from something like an insider threat), rather than allowing your firewall to give you a false sense of security. If your server can hold its own by itself you are much better off than relying on another device for your security...
Nebulus
The company I work for, SecureCore, does penetration testing. PM me for info.
hi
try pcflank.com. THERE it´s possible to let your connection to be scanned from port 0 to 65xxx
with or without fragmented packets.
Try this ;)
http://www.remingtonltd.com/r/assess.asp
Http://www.Blackcode.com scans ports 100 at a time,but I dont know that its any better than GRC.....
if you just wanna scan ports why dont you just get NMap? :/
www.dslreports.com has a decent set of scanning tools and a couple of good ones to optimize your connections too. It may not be EXACTLY what you're looking for, but it's worth the time to visit.
Hey thanks alot for all your help! All these were pretty much what I was looking for, and I'm gonna start playing with nessus too (thanks for that one nebulus!)