Re: Pen Testing for SMEs?
William Mayor <[email protected]> Tue, 4 Jul 2023 17:17:20 +0100
| Newsgroups | gmane.comp.python.org.uk |
|---|---|
| Message-ID | <[email protected]> |
--===============4788190801504526926== Content-Type: multipart/alternative; boundary="Apple-Mail=_4D9BA33F-DC0E-4F1C-A52D-CC0902948E43" --Apple-Mail=_4D9BA33F-DC0E-4F1C-A52D-CC0902948E43 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Harry, that=E2=80=99s a really good idea! I=E2=80=99ll add that = to my list :) (P.S. Love your book BTW I give it to all of my juniors :) ) > On 3 Jul 2023, at 18:48, Harry Percival <[email protected]> = wrote: >=20 > Have you considered bug bounty programmes? I think we used HackerOne = back in the day and got a few actionable fixes out of it, without ever = spending too much money. >=20 > Iirc we'd pay out like $50 for little things that were arguably not = real vulns but just missing best practices (rate limiting password reset = requests was an example iirc? Bit worried someone will jump on me saying = how insanely important that is lol) - the kinds of things you can find = with an automated tool and minimal actual effort from the pentester -- = and 10x that (or more? Cant remember. In anycase i'm guessing H1 have = suggested payouts) for "real" bugs with PoC. >=20 > You did have to deal with a bit of spam but overall it was worth it. >=20 > Hp >=20 >=20 >=20 > On Mon, 3 Jul 2023, 14:22 SW, <[email protected] = <mailto:[email protected]>> wrote: >> I can also add https://istormsolutions.co.uk/ - I have a friend who=20= >> works there, though I've not used their services myself. >>=20 >> Thanks, >> S >>=20 >> On 03/07/2023 15:03, Gautier Hayoun wrote: >> > Hi William, >> > >> > I have dealt with Callum at Sencode (https://sencode.co.uk/) = recently.=20 >> > They are a small company based in the UK, and I was perfectly=20 >> > satisfied when their pen test of a Django web application. >> > >> > Best, >> > >> > Gautier >> > >> > On 03/07/2023 13:55, William Mayor wrote: >> >> Hi! >> >> >> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out = of leads on this=20 >> >> one. Any help is appreciated :) >> >> >> >> I=E2=80=99m looking for a penetration/security testing company = that can help=20 >> >> me with a product that we=E2=80=99re building. It=E2=80=99s an API = (written using=20 >> >> FastAPI, so there is a python link in here :) ), with web and = native=20 >> >> app front ends. >> >> >> >> I=E2=80=99d like to have some kind of certified test conducted, to = find all=20 >> >> the security edge cases that I=E2=80=99ve undoubtably missed. >> >> >> >> We=E2=80=99re a small company (a social enterprise), so our budget = isn=E2=80=99t great. >> >> >> >> So my question is, does anyone have any recommendations for a pen=20= >> >> testing company that could help? >> >> >> >> Thank you! >> >> >> >> >> >> _______________________________________________ >> >> python-uk mailing list >> >> [email protected] <mailto:[email protected]> >> >> https://mail.python.org/mailman/listinfo/python-uk >> > _______________________________________________ >> > python-uk mailing list >> > [email protected] <mailto:[email protected]> >> > https://mail.python.org/mailman/listinfo/python-uk >>=20 >> _______________________________________________ >> python-uk mailing list >> [email protected] <mailto:[email protected]> >> https://mail.python.org/mailman/listinfo/python-uk > _______________________________________________ > python-uk mailing list > [email protected] > https://mail.python.org/mailman/listinfo/python-uk --Apple-Mail=_4D9BA33F-DC0E-4F1C-A52D-CC0902948E43 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">Thanks Harry, = that=E2=80=99s a really good idea! I=E2=80=99ll add that to my list = :)<div><br></div><div>(P.S. Love your book BTW I give it to all of my = juniors :) )<br><div><br><blockquote type=3D"cite"><div>On 3 Jul 2023, = at 18:48, Harry Percival <[email protected]> = wrote:</div><br class=3D"Apple-interchange-newline"><div><div = dir=3D"auto">Have you considered bug bounty programmes? I think we used = HackerOne back in the day and got a few actionable fixes out of it, = without ever spending too much money.<div dir=3D"auto"><br></div><div = dir=3D"auto">Iirc we'd pay out like $50 for little things that were = arguably not real vulns but just missing best practices (rate limiting = password reset requests was an example iirc? Bit worried someone will = jump on me saying how insanely important that is lol) - the kinds of = things you can find with an automated tool and minimal actual effort = from the pentester -- and 10x that (or more? Cant remember. In anycase = i'm guessing H1 have suggested payouts) for "real" bugs with = PoC.</div><div dir=3D"auto"><br></div><div dir=3D"auto">You did have to = deal with a bit of spam but overall it was worth it.</div><div = dir=3D"auto"><br></div><div dir=3D"auto">Hp</div><div = dir=3D"auto"><br></div><div dir=3D"auto"><br></div></div><br><div = class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, 3 = Jul 2023, 14:22 SW, <<a = href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 = .8ex;border-left:1px #ccc solid;padding-left:1ex">I can also add <a = href=3D"https://istormsolutions.co.uk/" rel=3D"noreferrer noreferrer" = target=3D"_blank">https://istormsolutions.co.uk/</a> - I have a friend = who <br> works there, though I've not used their services myself.<br> <br> Thanks,<br> S<br> <br> On 03/07/2023 15:03, Gautier Hayoun wrote:<br> > Hi William,<br> ><br> > I have dealt with Callum at Sencode (<a = href=3D"https://sencode.co.uk/" rel=3D"noreferrer noreferrer" = target=3D"_blank">https://sencode.co.uk/</a>) recently. <br> > They are a small company based in the UK, and I was perfectly <br> > satisfied when their pen test of a Django web application.<br> ><br> > Best,<br> ><br> > Gautier<br> ><br> > On 03/07/2023 13:55, William Mayor wrote:<br> >> Hi!<br> >><br> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running = out of leads on this <br> >> one. Any help is appreciated :)<br> >><br> >> I=E2=80=99m looking for a penetration/security testing company = that can help <br> >> me with a product that we=E2=80=99re building. It=E2=80=99s an = API (written using <br> >> FastAPI, so there is a python link in here :) ), with web and = native <br> >> app front ends.<br> >><br> >> I=E2=80=99d like to have some kind of certified test conducted, = to find all <br> >> the security edge cases that I=E2=80=99ve undoubtably = missed.<br> >><br> >> We=E2=80=99re a small company (a social enterprise), so our = budget isn=E2=80=99t great.<br> >><br> >> So my question is, does anyone have any recommendations for a = pen <br> >> testing company that could help?<br> >><br> >> Thank you!<br> >><br> >><br> >> _______________________________________________<br> >> python-uk mailing list<br> >> <a href=3D"mailto:[email protected]" target=3D"_blank" = rel=3D"noreferrer">[email protected]</a><br> >> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> > _______________________________________________<br> > python-uk mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"_blank" = rel=3D"noreferrer">[email protected]</a><br> > <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> <br> _______________________________________________<br> python-uk mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank" = rel=3D"noreferrer">[email protected]</a><br> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> </blockquote></div> _______________________________________________<br>python-uk mailing = list<br>[email protected]<br>https://mail.python.org/mailman/listinfo/p= ython-uk<br></div></blockquote></div><br></div></body></html>= --Apple-Mail=_4D9BA33F-DC0E-4F1C-A52D-CC0902948E43-- --===============4788190801504526926== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ python-uk mailing list [email protected] https://mail.python.org/mailman/listinfo/python-uk --===============4788190801504526926==--