I am pumped about this internal audit. This will be my second major audit, the difference between the first one and this one is my level of experience. I am more confident about my ability to hack now. While I still haven't owned a box, I think that this is going to be the trip where I break through. Sure I have gotten into web applications, and some database stuff, and found cross-site scripting vulnerabilities, and worked magic on a survey form so that it acted like an anonymous remailer -- but it is time to own a box!! The strategy this week: scan the entire internal network on port 80, find vulnerable default web pages on desktop machines, get the SAM file, crack it, use credentials to get into more important machines, elevate my privileges. Game over. Greg offered to play the game with me (see who can crack the most boxes)... I turned him down. I tried using that to motivate me last pen-test and fell flat on my face.
**Big Smiles** Hacking all day, relaxing on the beach at night *grin*
