📑Infrastructure summary

Gather all of the information that we need to start the pentest.

Software Secured requires various information about your application infrastructure based on the type of pentest that you are receiving. Check the section that corresponds with your test type to see the information that we need to prepare for the test.

---

Web Application Pentest

Target application URLs

Provide a full and precise list of the application URLs that are targets in the testing scope, so we know exactly what needs to be tested (and what shouldn't be). Only include the base URLs of your applications in this list.

Application logs (optional)

To provide a more thorough test, provide several (2-3) days worth of application logs. This information helps us understand the application better and identify more vulnerabilities.

Documentation (optional)

If your application has any documentation, include a link to it. By using the documentation, we can gain a better understanding of your applications main use cases to help us model common threats against it.

---

Internal Network Pentest

IP addresses or ranges

Provide a full and precise list of IP addresses or ranges that are in the testing scope, so we know exactly what needs to be tested (and what shouldn't be).

For large target lists, you can upload a file containing your entire list in the pentest checklist. For more information, see the Checklist FAQ on the Pentest checklist page.

Access instructions

Include instructions for accessing the network where we are conducting the pentest. Often, internal networks are accessed through a VPN or bastion host.

---

External Network Pentest

IP addresses, IP address ranges, and hostnames

Provide a full and precise list of any IP addresses, IP address ranges, and hostnames that are in the testing scope, so we know exactly what needs to be tested (and what shouldn't be). Include a short description for each item, and specify the application environment—such as production or staging—as well as whether the item is publicly facing or not.

---

Secure Cloud Review

Cloud assets

Provide a full and precise list of any IP addresses, IP address ranges, and hostnames that are in the testing scope, so we know exactly what needs to be tested (and what shouldn't be).

Cloud architecture or topology (optional)

To help us better understand the cloud environment, provide an architectural diagram of your cloud infrastructure. This information allows testers to spend less time trying to map out your infrastructure and more time testing it.

---

Secure Code Review

Repository access

To complete the review, we need access to your code base. You can provide it to us either by giving us access to the repository (@SoftwareSecuredOperations on GitHub) or by sending us the source code directly.

To send us the code directly, upload it to the Pentest checklist in Portal.

---

Mobile Pentest

Supported OS versions

Provide the Android and iOS versions that your app supports, as applicable. This information allows us to ensure that we have the appropriate number of devices and install the supported OS versions to complete the test.

Mobile app binaries

Provide the app binaries—such as APK or IPA—that are going to be tested. To simplify the process, you can directly upload the binary in our Pentest checklist.

Another binary-sharing method is to give Software Secured CI/CD access; however, this method is not as streamlined as using the checklist.

Providing CI/CD access to Software Secured

If you use TestFlight, AppCenter, or a similar application—and if preconditions are satisfied—you might be able to give us access to the mobile binaries through that application.

For an iOS application, the target application must support iOS 13.0 (or later? or only 13?) to be compatible with the process required to extract the required files from TestFlight for pen-testing.

Grant access to the following email address: [e-mail]

Tamper or root detection information

Let us know if your application has tampering or root detection capabilities. This information changes how we conduct the portion of the test that focuses on rooted or jailbroken devices.

Phone features used by the application

Include a list of phone features that your application requires access to in order to function. Examples of phone features include, but are not limited to:

• Microphone

• Location

• Camera

• Bluetooth

Build version

To ensure that we are testing the correct version—and to track our work progression if you complete tests on different builds—include the build version or build ID of the application that we are testing.