When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP doesn't always return anything and in some cases the IP address may be owned by a hosting company where the client is using shared hosting. Are there methods to verify this during recon?
1 Answer
It's always best to cover this during scoping calls, and if possible, get a list of owned assets, whether that's IP addresses domains, whatever.
However, it's best to reach out to the client directly for clarification if you believe that asset is worth pursuing but are unsure if it's in scope. If this is also not an option, some things you can try:
- How did you find the asset? Can you make a direct connection back to something you surely know is in scope?
- Reverse Whois
- DNS lookups
- Certificates
- OSINT
^ Some ideas to keep the recon non-invasive and light.
-
I agree with the start of this answer, but hard nope on the "light and non-invasive recon". You do not send a single packet to an out-of-scope host without explicit permission from your client contact. "Not sure if it's in scope" means out of scope until you get a confirmation. Without context you could be poking around on an extremely fragile system (old AS/400, ICS gear) and completely knock if over. This is also why it's important to ensure you've got correct contact details (and a backup contact, ideally) for someone responsible on the client side, for the entire test duration. Oct 11, 2021 at 4:44
-
I don't write the above lightly. I've caused outages a bunch of times while scanning stuff I was supposed to be scanning, and I've been on tests where a sev1 outage caused in part by authorised testing (equipment fault, oversight on the client's behalf, etc.) ended up costing the client upwards of £1M. I have far worse stories under NDA. You do not want to be sat in a meeting full of C-levels trying to explain how your unauthorised "light recon" just cost them a whole heap of money. Oct 11, 2021 at 4:49