I Pwned Your Server
Channel: Paco Hope
Date: 2014-01-31

I got a video of #ScumbagPenTester presenting results to the CISO.

Here's the script.
CISO: Good morning. I am the CISO. How can I help you?

TESTER: I am the penetration tester that has been working on the mega important project.

CISO: Right. How did it go?

TESTER: I pwned your server.

CISO: What?

TESTER: I pwned your server.

CISO: What does that mean?

TESTER: I can do anything I want. I pwned your server.

CISO: So you can do anything you want?

CISO: You can order thousands of dollars of product and have it shipped anywhere to anyone?

TESTER: In theory, yes.

CISO: No really. Can you do that?

TESTER: No. I pwned your server.

CISO: Can you get all our credit card numbers and passwords and customer data?

TESTER: Yes. In theory.

CISO: I'm not asking about god damned theory! You said you can do anything you want. Can you do that?

TESTER: No. I pwned your server!

CISO: At our edge provider we have WAFs, caching edge servers, and reverse proxies. We have 4 server farms across 4 global data centres. We run app servers, auth servers, and database servers. Which one of these things do you own?

TESTER: The server. I got a command shell on your server.

CISO: There are 32 fucking app server instances. Which fucking instance do you own?

TESTER: I pwned your server.

CISO: If you don't start making sense I am going to cut your balls off and put them in a trophy jar on my desk.

CISO: Tell me one real, actual thing you can do with this god damned server that you own?

TESTER: I can do 'ls'. I can see your files.

CISO: Finally we are getting somewhere. What is in the files?

TESTER: A standard unix password file where the passwords are all stars.

CISO: What can you do with the password file?

TESTER: Nothing. It proves that I pwned your server!

CISO: What the actual fuck?

CISO: If I wanted to strangle you with the power cord of the server that you own, which fucking power cord would I use?

CISO: I will gut you like a pig and drape your entrails over the server that you fucking "own." Do you even know what country they will find your rotting carcass in?

TESTER: You need to patch the server. This project is mega-important.

CISO: Oh god. I am going to kill you. Before I kill you, tell me, how would I patch the server?

TESTER: It runs an old version of PHP. You should run the latest version.

CISO: It will take us months to test on the new version and deploy it to production, to staging, to UAT, test and development. Would that fix the problem?

TESTER: No.

CISO: I quit. I just fucking quit.

TESTER: We will perform the next penetration test in six weeks. I hope they fix the server.