Quote:
|
Originally Posted by Oz
Hi all,
Just saw a penetration demonstration by Jesper Johannsen (Microsoft), where he penetrates a corporate domain controller (and therefor the HR database  ) through a dodgy authentication routine on a web server with a SQL back end. About 8 or 9 machines to get there, but it blew my mind. The web server had port 80 open and port 443 echoing, but nothing running. He managed to forward TS through the 443 port ad get full GUI access to the lot!!!
It's made me very, very paranoid about network security in general.
For all those who work in IT, if you ever get the opportunity to see him in action, jump on it.
 |
sounds like fun. Btw what server sofware was the domain controller using and what security measures were in place?
__________________
(\__/)
(='.'=) This is Bunny. Copy and paste bunny into your
(")_(") signature to help him gain world domination