Questions, questions. Penetration scoping.

Questions, questions. Penetration scoping.

by Mike Toreno -
Number of replies: 2
I have been asked to answer the following questions prior to a NCC penetration test on our web-facing systems, and I am not sure what answers I should give to the following:
  • What does the application do? (name/description/function)
  • How complex is it?
  • How many different user types are there and a brief description of the differences?
  • What are the biggest risks if compromise was achieved?
  • What technology is the application and its infrastructure based on?
Any suggested responses or comments gratefully received.
Average of ratings: -
In reply to Mike Toreno

Re: Questions, questions. Penetration scoping.

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Surely you can find some of this yourself? For example http://www.google.com.au/search?q=what+is+moodle. Normally people who do not appear to have tried to find answers themselves are less likely to get answers here, but I am feeling generous this morning.
  • What does the application do? (name/description/function)
The name is Moodle. It is a Course Management System/Learning Management System/Virtual Learning Environments (CMS/LMS/VLE) - pick you acronym. Description here: http://docs.moodle.org/en/About_Moodle.
  • How complex is it?
How long is a piece of string? It is pretty complicated. http://www.ohloh.net/projects/moodle is a nice site for generating numbers about how big open source projects are.
  • How many different user types are there and a brief description of the differences?
The roles system is configurable, so there are as many as you want, but by default there are 7: http://docs.moodle.org/en/Standard_roles.
  • What are the biggest risks if compromise was achieved?
Accessing or changing users' personal information, or executing arbitrary code on the server - which of those do you consider worse? This answer would be the same for any web application in PHP.
  • What technology is the application and its infrastructure based on?
PHP, web server, database (can be any of a number of databases or web servers, the most popular choice is probably Apache + MySQL). Being a web application, the front end is, of course, HTML + JavaScript + CSS.
Average of ratings: -
In reply to Tim Hunt

Re: Questions, questions. Penetration scoping.

by Mike Toreno -
Tim,

Thanks very much for your response. I have indeed tried to find answers, but I didn't want to risk preconceiving any responses, being concerned that my opinions might be more subjective than useful. Anyway, I thought that the scope of the questions themselves might be interesting or useful to other moodlers. However, your answers are authoritative, completely objective and most helpful, thanks again.
Average of ratings: -