4 ms·

I’m a bit confused by who is doing what. Can you clarify? Was your friend the one paid to do the pentest? And during that 2 week period your friend was doing t

I’m a bit confused by who is doing what. Can you clarify? Was your friend the one paid to do the pentest? And during that 2 week period your friend was doing the pentest they found the 7 vuln chain RCE? Or did they find the vulns during a period in time someone else was pentesting the company?

tgsovlerkhgsel 4y ago
My understanding: There's three parties: 1. Cloud service provider, 2. Client, 3. Tester Client pays Tester to find vulns in Client's setup, including third party tools used by Client. Client notifies Cloud that there will be testing, and presumably the ToS allow such pentesting. In the process Tester discovers vulns in Cloud. The AWS rules are complicated https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/, for Google Cloud, you don't need to notify https://support.google.com/cloud/answer/6262505?hl=en#zippy=%2Cdo-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project https://support.google.com/cloud/answer/6262505?hl=en#zippy=..., Microsoft used to require notification but no longer does https://docs.microsoft.com/en-us/azure/security/fundamentals/pen-testing https://docs.microsoft.com/en-us/azure/security/fundamentals... and seems to allow pentesting their services as long as you don't DoS them or exploit found vulnerabilities beyond a proof of concept.
- dx034 4y ago
  Not sure how to think about that. I'd expect a pen tester to live of the money they get for the pentest and not make extra money with bounties from the time spent during that pentest. If the bug was in the software of another vendor then that's not as clear, but I'm still not sure if the pentester should be entitled to a bounty. If anything, maybe the client should get the bounty as they hired and paid for the pentester to find vulns?

tgsovlerkhgsel 4y ago

My understanding: There's three parties: 1. Cloud service provider, 2. Client, 3. Tester Client pays Tester to find vulns in Client's setup, including third party tools used by Client. Client notifies Cloud that there will be testing, and presumably the ToS allow such pentesting. In the process Tester discovers vulns in Cloud. The AWS rules are complicated https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/, for Google Cloud, you don't need to notify https://support.google.com/cloud/answer/6262505?hl=en#zippy=%2Cdo-i-need-to-notify-google-that-i-plan-to-do-a-penetration-test-on-my-project https://support.google.com/cloud/answer/6262505?hl=en#zippy=..., Microsoft used to require notification but no longer does https://docs.microsoft.com/en-us/azure/security/fundamentals/pen-testing https://docs.microsoft.com/en-us/azure/security/fundamentals... and seems to allow pentesting their services as long as you don't DoS them or exploit found vulnerabilities beyond a proof of concept.

dx034 4y ago
Not sure how to think about that. I'd expect a pen tester to live of the money they get for the pentest and not make extra money with bounties from the time spent during that pentest. If the bug was in the software of another vendor then that's not as clear, but I'm still not sure if the pentester should be entitled to a bounty. If anything, maybe the client should get the bounty as they hired and paid for the pentester to find vulns?