I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I imagine that other candidates will perform a similar task, but is it a good idea?
A lot of companies are giving challenges as part of the interview process these days, mostly on sample apps, I've never heard of testing on a live site as part of an interview.
Do you have a paper trail? Is there an email from someone at a high level approving of this? If not I'd ask for an email from someone at the director level or higher that indicates you have permission. Then agree on a time and have everything in writing.
Are they looking for a free pen test? Maybe, but oh man is that shady if true.