Hypothetical Situation: I am conducting a penetration test for a client. A scope of engagement has been defined of what I can and cannot do. While performing a vulnerability scan I come across a known vulnerability that is outside my scope. How do I go about professionally handling this?

Legally, I cannot perform any more assessments as I would be intentionally working outside of the scope. However, haven't I technically already stepped outside my scope? If I was to report on this, without performing any other penetration testing, could I run into any legal ramifications?

If I am in the clear legally, how would one properly deal with this? Is it better to report it to my client as a regular use who found a vulnerability would or would it be better to include this is a report?

If I am in the threat of legally being in trouble, what is the proper way of dealing with this to protect myself?

  • 2
    Technically, if you step outside a scope of work, even accidentally, it could cause legal issues. Practically, they'd probably prefer that an ethical tester who they've vetted to some extent finds issues over a potential attacker. It comes down to the relationship you have with the client. – Matthew Dec 8 '16 at 7:21

It is not possible to answer this completely without knowing a lot more detail.

However, in general, the first thing I'd want to know is how good a relationship you have with the client. By the sound of the restrictions placed on you, I'm guessing not so good which limits your options. The "best" thing would be to talk to the client as soon as you come across something. But as the likes of Snowden and others have discovered, this is not always a wise move.

Ultimately, this comes down to your contract. Any pen-test contract should have clauses that cover you for situations where vulnerabilities outside scope are discovered as a consequence of your in-scope work.

However, to deal with contract and legal complexities, you must consult a suitably knowledgeable legal expert. If you are a member of a trade group, they may also be able to assist. This forum obviously cannot give legal advice even if anyone here wanted to.

  • Thank you for your answer, very helpful. However, I would like to remind you that this is simply a hypothetical situation so I can better understand what to do if this situation occurs in the filed. Therefor, I cannot provide you any more detail. – Gavin Youker Dec 8 '16 at 9:16
  • Haha, point taken, though I wasn't actually asking for information, only pointing out that without the additional information, any answer would be incomplete. Bottom line is make sure your contract is water-tight, join a trade organisation to get additional cover from them. – Julian Knight Dec 8 '16 at 9:22
  • Very true, I understand where you are coming from. Without getting into the specifics, its hard to answer the question. I was more looking for general answers/rules of thumb (which you did) Thanks! – Gavin Youker Dec 8 '16 at 9:25

Ethically, you should always disclose your findings. Legally, you cannot go outside your scope. You may end up in a position where your report is not as thorough as you would like.

It is appropriate to advise the customer immediately that you found a vulnerability but could not investigate it fully without exceeding your scope. Maybe your scope can be adjusted, even if it's only a singular exception for this particular vulnerability. You should make it clear to your client that more information allows you to deliver a better assessment---but do so politely since they may be unwilling to consider taking any risks at all with a critical system. Some clients take time to decide on scope changes, so these issues should be communicated as soon as feasible.

If you have an employer, they may have a policy. This situation is not unheard of, and you probably have a ready-made answer if you work for an established company.

Whether your scope is expanded or not, you would normally address the vulnerability in your report to the extent that your data permits. If further investigation is not authorized, you should note that. If you can suggest any mitigations/fixes based on what you do know, you still do that. If not, you should explicitly state that no suggested mitigations or fixes are possible without further investigation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.