Late last week, Jim C and I took a bit of a security road trip down to Boston to hang out with the incredibly cool guys at Core Security. Those of you who have been around probably also remember them as "CORE SDI".
I hadn't seen Core's products in quite a while, and we got a great tour of their new digs in Boston, as well as the newest version of CORE Impact. I have to say, having spent significant time with Metasploit and Canvas, I wasn't really expecting to be that impressed. I was thinking that it would be YAPTT (Yet Another Pen-Testing Tool). I knew Ivan Arce by reputation (but, then who doesn't?), but I didn't know much about Core beyond their marketing material. And even with their great research background, I really wasn't expecting the tool to be that impressive.
And, yet, half-way through the discussion about where they're going and them showing me around the product for a little while, I found myself exclaiming: "What pen-tester wouldn't want one of these?!?" I felt like I was at a religious revival - to use the over-used phrase, I drank the Core kool-aid.
Seriously, I have long thought that most of these tools were most useful for either skilled (but lazy) pen-testers or by unskilled pen-testers who wanted to make a buck. But, having spent some time with Core, I bought the vision - these guys get what a pen-tester needs, and they have built it, for the most part. (Anybody who has used it who I have talked to has talked about the wish for better reporting capabilities - it comes with the standard set of bar graphs that every security scanner comes with).
I didn't expect to be impressed, and I was. Paul, Ivan and the guys have built a product that is worth a look at if you're doing any serious pen-testing.