I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I imagine that other candidates will perform a similar task, but is it a good idea?

  • 5
    Define "good idea" – schroeder Jun 22 '18 at 15:09
  • 1
    Testing a live company website as part of an interview process is illegal in the United States, even if they gave you permission. They cannot request free, unpaid work. Run away FAST if they are trying to get you to perform free penetration tests. – Mark Buffalo Jun 22 '18 at 16:55
  • Maybe they don't expect you to find anything, but just want to see your methodology. – multithr3at3d Jun 22 '18 at 17:10
  • @multithr3at3d Doesn't matter. This basically becomes "free consultation work" during an interview. If they wanted to see his methodology, they need to set up an environment in which to test this methodology. – Mark Buffalo Jun 22 '18 at 17:29
  • Yeah, you guys raise good points. Thanks for the input! – Satisfakshin Jun 22 '18 at 20:09

A lot of companies are giving challenges as part of the interview process these days, mostly on sample apps, I've never heard of testing on a live site as part of an interview.

Do you have a paper trail? Is there an email from someone at a high level approving of this? If not I'd ask for an email from someone at the director level or higher that indicates you have permission. Then agree on a time and have everything in writing.

Are they looking for a free pen test? Maybe, but oh man is that shady if true.

  • 1
    Unpaid consultation during a job interview can be illegal in many places. This is not good advice even if they sign off on it because the company may be trying to obtain work for nothing. It doesn’t take long to set up an exploitable web application or server, and there are many free services such as HackTheBox, so I highly recommend either moving on or saying no. – Mark Buffalo Jun 22 '18 at 17:38
  • There's an email trail, nothing on paper - which is another thing that makes me skeptical besides it being a live site and sort of free work. Anyway, I concluded that I won't go ahead if it's not a dedicated test environment that is not related to anything they want to or already have deployed. Thanks 😁 – Satisfakshin Jun 22 '18 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.