Penetration Testing For Dummies
Book image
Explore Book Buy On Amazon
The types of design vulnerabilities often found on endpoints involve defects in client-side code that is present in browsers and applications. The defects most often found include these:
  • Sensitive data left behind in the file system. Generally, this consists of temporary files and cache files, which may be accessible by other users and processes on the system.
  • Unprotected local data. Local data stores may have loose permissions and lack encryption.
  • Vulnerable applets. Many browsers and other client applications often employ applets for viewing documents and video files. Often, the applets themselves may have exploitable weaknesses.
  • Unprotected or weakly protected communications. Data transmitted between the client and other systems may use weak encryption, or use no encryption at all.
  • Weak or nonexistent authentication. Authentication methods on the client, or between the client and server systems, may be unnecessarily weak. This permits an adversary to access the application, local data, or server data without first authenticating.
Identifying weaknesses like the preceding examples will require one or more of the following techniques:
  • Operating system examination
  • Network sniffing
  • Code review
  • Manual testing and observation

About This Article

This article is from the book:

About the book author:

Robert Shimonski is an ethical hacker and a professional IT leader who has led numerous efforts to design, strategize, and implement enterprise solutions that must remain secure. Rob has been involved in security and technology operations for more than 25 years and has written his books from the trenches of experience.

This article can be found in the category: