Re: Pen Testing for SMEs?
Harry Percival <[email protected]> Mon, 3 Jul 2023 18:48:08 +0100
| Newsgroups | gmane.comp.python.org.uk |
|---|---|
| Message-ID | <CACFvh983tKVMT-9WkMtr0YTFH2twZgOeYfXtPLmd8dck5YD=rg@mail.gmail.com> |
--===============1201925498471606481== Content-Type: multipart/alternative; boundary="00000000000093cd2105ff98c59d" --00000000000093cd2105ff98c59d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Have you considered bug bounty programmes? I think we used HackerOne back in the day and got a few actionable fixes out of it, without ever spending too much money. Iirc we'd pay out like $50 for little things that were arguably not real vulns but just missing best practices (rate limiting password reset requests was an example iirc? Bit worried someone will jump on me saying how insanely important that is lol) - the kinds of things you can find with an automated tool and minimal actual effort from the pentester -- and 10x that (or more? Cant remember. In anycase i'm guessing H1 have suggested payouts) for "real" bugs with PoC. You did have to deal with a bit of spam but overall it was worth it. Hp On Mon, 3 Jul 2023, 14:22 SW, <[email protected]> wrote: > I can also add https://istormsolutions.co.uk/ - I have a friend who > works there, though I've not used their services myself. > > Thanks, > S > > On 03/07/2023 15:03, Gautier Hayoun wrote: > > Hi William, > > > > I have dealt with Callum at Sencode (https://sencode.co.uk/) recently. > > They are a small company based in the UK, and I was perfectly > > satisfied when their pen test of a Django web application. > > > > Best, > > > > Gautier > > > > On 03/07/2023 13:55, William Mayor wrote: > >> Hi! > >> > >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out of le= ads on this > >> one. Any help is appreciated :) > >> > >> I=E2=80=99m looking for a penetration/security testing company that ca= n help > >> me with a product that we=E2=80=99re building. It=E2=80=99s an API (wr= itten using > >> FastAPI, so there is a python link in here :) ), with web and native > >> app front ends. > >> > >> I=E2=80=99d like to have some kind of certified test conducted, to fin= d all > >> the security edge cases that I=E2=80=99ve undoubtably missed. > >> > >> We=E2=80=99re a small company (a social enterprise), so our budget isn= =E2=80=99t great. > >> > >> So my question is, does anyone have any recommendations for a pen > >> testing company that could help? > >> > >> Thank you! > >> > >> > >> _______________________________________________ > >> python-uk mailing list > >> [email protected] > >> https://mail.python.org/mailman/listinfo/python-uk > > _______________________________________________ > > python-uk mailing list > > [email protected] > > https://mail.python.org/mailman/listinfo/python-uk > > _______________________________________________ > python-uk mailing list > [email protected] > https://mail.python.org/mailman/listinfo/python-uk > --00000000000093cd2105ff98c59d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Have you considered bug bounty programmes? I think we use= d HackerOne back in the day and got a few actionable fixes out of it, witho= ut ever spending too much money.<div dir=3D"auto"><br></div><div dir=3D"aut= o">Iirc we'd pay out like $50 for little things that were arguably not = real vulns but just missing best practices (rate limiting password reset re= quests was an example iirc? Bit worried someone will jump on me saying how = insanely important that is lol) - the kinds of things you can find with an = automated tool and minimal actual effort from the pentester -- and 10x that= (or more? Cant remember. In anycase i'm guessing H1 have suggested pay= outs) for "real" bugs with PoC.</div><div dir=3D"auto"><br></div>= <div dir=3D"auto">You did have to deal with a bit of spam but overall it wa= s worth it.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Hp</div><div= dir=3D"auto"><br></div><div dir=3D"auto"><br></div></div><br><div class=3D= "gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, 3 Jul 2023, 14:= 22 SW, <<a href=3D"mailto:[email protected]">[email protected]= </a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:= 0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I can also add <a h= ref=3D"https://istormsolutions.co.uk/" rel=3D"noreferrer noreferrer" target= =3D"_blank">https://istormsolutions.co.uk/</a> - I have a friend who <br> works there, though I've not used their services myself.<br> <br> Thanks,<br> S<br> <br> On 03/07/2023 15:03, Gautier Hayoun wrote:<br> > Hi William,<br> ><br> > I have dealt with Callum at Sencode (<a href=3D"https://sencode.co.uk/= " rel=3D"noreferrer noreferrer" target=3D"_blank">https://sencode.co.uk/</a= >) recently. <br> > They are a small company based in the UK, and I was perfectly <br> > satisfied when their pen test of a Django web application.<br> ><br> > Best,<br> ><br> > Gautier<br> ><br> > On 03/07/2023 13:55, William Mayor wrote:<br> >> Hi!<br> >><br> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out o= f leads on this <br> >> one. Any help is appreciated :)<br> >><br> >> I=E2=80=99m looking for a penetration/security testing company tha= t can help <br> >> me with a product that we=E2=80=99re building. It=E2=80=99s an API= (written using <br> >> FastAPI, so there is a python link in here :) ), with web and nati= ve <br> >> app front ends.<br> >><br> >> I=E2=80=99d like to have some kind of certified test conducted, to= find all <br> >> the security edge cases that I=E2=80=99ve undoubtably missed.<br> >><br> >> We=E2=80=99re a small company (a social enterprise), so our budget= isn=E2=80=99t great.<br> >><br> >> So my question is, does anyone have any recommendations for a pen = <br> >> testing company that could help?<br> >><br> >> Thank you!<br> >><br> >><br> >> _______________________________________________<br> >> python-uk mailing list<br> >> <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"n= oreferrer">[email protected]</a><br> >> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel= =3D"noreferrer noreferrer" target=3D"_blank">https://mail.python.org/mailma= n/listinfo/python-uk</a><br> > _______________________________________________<br> > python-uk mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noref= errer">[email protected]</a><br> > <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel=3D"= noreferrer noreferrer" target=3D"_blank">https://mail.python.org/mailman/li= stinfo/python-uk</a><br> <br> _______________________________________________<br> python-uk mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noreferrer= ">[email protected]</a><br> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel=3D"noref= errer noreferrer" target=3D"_blank">https://mail.python.org/mailman/listinf= o/python-uk</a><br> </blockquote></div> --00000000000093cd2105ff98c59d-- --===============1201925498471606481== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ python-uk mailing list [email protected] https://mail.python.org/mailman/listinfo/python-uk --===============1201925498471606481==--