In case of multiple websites using a single IP, and we have been asked to perform vulnerability assessment to ensure its security, how many to target

Question

When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.

If you find this IP, and then upon performing reverse-lookup of that IP, you find out that there are 33 different websites on that IP, I believe that means it is virtual hosting (of multiple websites).

My question is that generally in such a scenario, is the person/team performing vulnerability assessment usually required to do that for all those 33 subdomains/websites associated with that IP?

If not, what if the tester declares the website free of any critical vulnerabilities, and then the attacker attacks another of those 33 subdomains and laterally moves from there, compromising all other subdomains/websites hosted on that IP?

What should be the approach here? Should everything associated with that IP tested?

Answer 1

Your pentest needs to define a scope. You test within that scope. If the scope does not include the hosting environment, then you don't test it. You could raise it as a potential source of risk, but you need to be careful about pointing out specific risks outside of scope if they are not particularly relevant.

I'm a little concerned about your concern about lateral movement from the hosting environment. When you pentest and provide a report, you are never saying that "nothing bad could ever happen to your site". You are testing a specific set of things and reporting on those things.

You cannot pentest the universe.

If you worry about the hosting environment, are you also worried about the developers? Do you test if the developers might go rogue? Or the USB security of the machines the developers use in case someone in your client company uses an infected USB?

No.

You define the scope and test within that.