External perimeter
Three external
checks
Each one was under contract and written permission, with no accounts and no password guessing. Below is what was found and how the test ended. Names, domains and steps are not published.
01 · Several days
Public site and service apps
The perimeter had a public site, neighboring apps, mail and remote desktops. Some services shared one host.
Code execution and an auth bypass from the outside were not achieved. A shared host was rate-limiting requests.
- 01
Unsupported versions
The site and a neighboring app ran lines the vendor no longer patches. Login and code from the street still did not open.
- 02
A debug page
A service page without a password returned configuration and internal addresses.
- 03
Wider than needed
Mail and remote desktop were visible from the street more broadly than daily work required. A desktop session without an account was not obtained.
- 04
Signup without a login
An open form created accounts that could not sign in. The activation mail never arrived.
- 05
Different form answers
The response code distinguished a real name from a made-up one, without guessing a password.
02 · One day
A storefront
The storefront, search, the admin panel and the place where a database copy lived. The host's mail server was only a neighboring node.
Code execution on the server without a password was not achieved. Reading the database through search was confirmed.
- 01
Search read the database
A public suggestion field placed input into a query. The catalog and admin password hashes were readable from the street. Writing to the database was not pursued.
- 02
A backup tool in the open
The tool that takes a database copy answered on an ordinary address. The dump itself was not taken without a password.
- 03
Admin from the street
The management login was reachable without a network restriction.
- 04
An old runtime
The version was unsupported and named itself in a header. Baseline protection headers were missing on the storefront.
03 · Two days
A platform with account areas
Several public account areas, integration addresses and internal development systems.
No login-form bypass was found. File reads and third-party keys from the perimeter were confirmed.
- 01
A file from a path
An integration address returned a file from disk when the request carried a path. No login was required. The test stopped at a minimal confirmation and did not inspect the contents.
- 02
A CRM key in a script
A public file held a working key. It could read and change records without signing into the account area.
- 03
A secret in an error
A messenger method answered without authentication. When the call to the messenger failed, the bot secret landed in the error text.
- 04
API docs on production
Interface documentation was open on the production address. On its own it did not expose data, but it mapped the methods.
What the quote is made of
The figure is in the reply, once the boundaries of the work are clear.
- Objects
- How many apps and roles, and whether the internal network is in scope, not only what is visible from the street.
- Access
- Addresses only, some accounts, or source as well. That decides which scenarios can be tested at all.
- Place
- Remote, or on site if a panel is not visible from outside.
- Time
- Usually from a few days to three weeks. You set the work window.
- Included
- A summary for the owner, cards for the developer, and a retest of the closed items.