When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.

If you find this IP, and then upon performing reverse-lookup of that IP, you find out that there are 33 different websites on that IP, I believe that means it is virtual hosting (of multiple websites).

My question is that generally in such a scenario, is the person/team performing vulnerability assessment usually required to do that for all those 33 subdomains/websites associated with that IP?

If not, what if the tester declares the website free of any critical vulnerabilities, and then the attacker attacks another of those 33 subdomains and laterally moves from there, compromising all other subdomains/websites hosted on that IP?

What should be the approach here? Should everything associated with that IP tested?

  • 1
    Do you have permission to test from all those domains? That's the only question here...
    – schroeder
    Aug 7 at 11:01

1 Answer 1


Your pentest needs to define a scope. You test within that scope. If the scope does not include the hosting environment, then you don't test it. You could raise it as a potential source of risk, but you need to be careful about pointing out specific risks outside of scope if they are not particularly relevant.

I'm a little concerned about your concern about lateral movement from the hosting environment. When you pentest and provide a report, you are never saying that "nothing bad could ever happen to your site". You are testing a specific set of things and reporting on those things.

You cannot pentest the universe.

If you worry about the hosting environment, are you also worried about the developers? Do you test if the developers might go rogue? Or the USB security of the machines the developers use in case someone in your client company uses an infected USB?


You define the scope and test within that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .