5

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might submit 20 or more comments with very strange input to check that.

How should I minimize the visibility of a penetration test to normal users? Should I request admin privileges from the site owner so that I can go through and delete anything that would be visible to regular users? Would it be better to request that a separate instance of the application be setup for testing purposes? Is there an accepted best practice for handling this type of thing?

Improve this question
1
  • 2
    There are possible victims other than normal users. I once found an XSS in a "contact support" form. I had asked for completely separate testing site to test and the customer claimed they gave me one but judging by the panicked phone call shortly into the test I deduced that it wasn't completely separate. It might be nice to include in any answers techniques for explaining to customers how isolated a separate instance needs to be.
    – Ladadadada
    Oct 30, 2013 at 18:02

2 Answers 2

Reset to default
6

In my opinion for application testing the best approach is to work on a mirror of the production site (either clone the prod. site if they're using Virtual machines or use a test environment). The key is that the code deployed should be the same as is in production. In that kind of environment you should be able to automate away without any concerns about the data created.

If you can't do that then the impact depends on the customer and the site. In many circumstances you can ask for test users, keep all the content under those users and then request that they are deleted at the end of testing.

If that's not possible then make sure you have the conversation about these side effects before you start testing. What you don't want to happen is that you get into the test, someone in the business notices their site filling up with "garbage" and they shut the test down.

Of course a security idealist would argue that they should have protected against the automation of form submission on their site, but that's not going to stop an irate marketing person wondering why they have several hundred emails about new comments on their blog :o)

Also as @johndeters says it's very important to keep track of the data and in the report explicitly recommend that they clean it up. I've had cases where someone came back to me 9 months after a test to complain that my test data had cause their upgrade to fail and I was very happy to be able to point them towards the section in my report where I told them to remove the test data.

Improve this answer
0

One approach is that you can simply do what you need to do, and observe how they deal with the fallout. Maybe their security team will respond and shut you down - that's a good outcome. Maybe their security team won't spot you no matter how many oddly-punctuated comments you post - that's a bad outcome.

Just keep track of them. When you're done, you should inform them of all the messes you made, and that they need to be cleaned up.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .