When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.
If you find this IP, and then upon performing reverse-lookup of that IP, you find out that there are 33 different websites on that IP, I believe that means it is virtual hosting (of multiple websites).
My question is that generally in such a scenario, is the person/team performing vulnerability assessment usually required to do that for all those 33 subdomains/websites associated with that IP?
If not, what if the tester declares the website free of any critical vulnerabilities, and then the attacker attacks another of those 33 subdomains and laterally moves from there, compromising all other subdomains/websites hosted on that IP?
What should be the approach here? Should everything associated with that IP tested?