SYSTEM AND METHOD FOR PROVIDING NETWORK PENETRATION TESTING

• US 20080256638A1
• Filed: 04/14/2008
• Published: 10/16/2008
• Est. Priority Date: 04/12/2007
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Core SDI, Inc.
• Inventors: Eissler, Matias Ernesto, Weil, Alejandro David, Russ, Fernando Federico, Manrique, Hector Adrian, Dibar, Francisco Javier
• Granted Patent: US 8,365,289 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for providing network penetration testing from an end-user computer is provided. The method includes the step of determining at least one of a version of a Web browser of a target computer, contact information associated with an end-user that uses the target computer, and applications running on the target computer. The method also includes the steps of determining exploits that are associated with the running applications and that can be used to compromise the target computer, and launching the exploits to compromise the target computer. Network penetration testing may also be provided by performing the steps of determining an operating system of a target computer, selecting one of a group of modules to use in detecting services of the target computer, and detecting the services of the target computer.

Claims

1. A method of providing network penetration testing from an end-user computer, wherein the method comprises the steps of:

determining at least one of a group consisting of a version of a Web browser of a target computer, contact information associated with an end-user that uses the target computer, and applications running on the target computer;

determining exploits that are associated with the running applications and that can be used to compromise the target computer; and

launching the exploits to compromise the target computer.

2. The method of claim 1, wherein the contact information is selected from the group consisting of electronic mail addresses and usernames.

3. The method of claim 1, wherein the step of determining what applications are running on the target computer further comprises using an internet protocol address of the target computer and a network connectivity from the end-user computer to the target computer.

4. A method of providing network penetration testing from an end-user computer, wherein the method comprises the steps of:

determining an operating system of a target computer;

selecting one of a group of modules to use in detecting services of the target computer; and

detecting the services of the target computer.