Gathering all of the information you'll need to share with us to start a pentest.
We require various information about your application infrastructure based on the type of pentest you're receiving. The following is a summary of the information we need to prepare for each type pentest.
Web Application Pentest
1. Target Application URLs
We need a full list of target URLs that are in the testing scope. This is how we know exactly what needs to be tested (and what shouldn't be), so please be precise. This should contain only the base URLs of your applications.
2. Application Logs (optional)
To provide a more thorough test, we ask for a couple days worth of application logs. This helps us gain additional understanding of your application and identify more vulnerabilities.
3. Documentation (optional)
If your application has any documentation, please provide a link to it. A better understanding of your applications main use cases helps us model common threats against it.
Internal Network Pentest
1. IPs or IP ranges
For large target lists, you can upload a file containing your entire list in the pentest checklist.
We need a full list of IPs or IP ranges in the testing scope. This is how we know exactly what needs to be tested (and what shouldn't be), so please be precise.
2. Access Instructions
Please provide us with instructions on how to access the network we will be conducting the pentest inside. Typically, this is done through VPN or bastion host access.
External Network Pentest
1. IPs, IP ranges, and/or Hostnames
We need a full list of IPs, IP ranges, and/or hostnames in the testing scope. This is how we know exactly what needs to be tested (and what shouldn't be), so please be precise. Provide a small description for each item, and specify the application environment (production, staging, etc.) as well as whether it's publicly facing or not.
Secure Cloud Review
1. Cloud Assets in Scope
We need a full list of IPs, IP ranges, and/or hostnames in the testing scope. This is how we know exactly what needs to be tested (and what shouldn't be), so please be precise.
2. Cloud Architecture / Topology (optional)
We highly recommend providing us with an architectural diagram of your cloud infrastructure. It lets us spend less time trying to understand your environment and more time testing it.
Secure Code Review
1. Repository Access
We will need access to your code base. You can provide it to us by giving us access to the repository (@SoftwareSecuredOperations on GitHub) or directly providing us the source code. If you provide the code directly, you can upload it to the pre-assessment checklist.
Mobile Pentest
1. Supported OS versions
We need to know what Android / iOS versions your app supports. This allows us to ensure that we have enough devices available for your test.
2. Mobile App Binaries
We need to be provided with the the app binaries (APK / IPA) that will be tested. The easiest way to do this is to directly upload the binary in our pre-assessment checklist. You can also provide us CI/CD access, but it tends to be more complicated.
Providing CI/CD Access
If you use TestFlight, AppCenter, or a similar application, it may be possible to provide us access to the mobile binaries this way as long as preconditions are satisfied. For an iOS application the target application must support iOS13.0 to be compatible with the process required to extract the required files from TestFlight for pen-testing. Access can be granted through the id [email protected].
3. Tamper / Root Detection
We need to know whether your application has anti-tamper / root detection capabilities.
4. Phone Features Used By The Application
Provide us with a list of phone features that your application requires access to. Examples include:
Microphone
Location
Camera
Bluetooth
5. Build Version
Provide us with the build version / ID of the application that we will be testing. This will be used for tracking purposes.
