Re: Pen Testing for SMEs?
Harry Percival <[email protected]> Tue, 4 Jul 2023 18:12:09 +0100
| Newsgroups | gmane.comp.python.org.uk |
|---|---|
| Message-ID | <CACFvh9-RwXKjjuxC5iCEfk4V+-u9YLwg9wb0zFNK6tekyewpgQ@mail.gmail.com> |
--===============3802042502528488405== Content-Type: multipart/alternative; boundary="00000000000003127b05ffac638d" --00000000000003127b05ffac638d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable aw thanks for the compliment. 3E on the way (if you mean the goat book?) On Tue, 4 Jul 2023 at 17:17, William Mayor <[email protected]> wrote: > Thanks Harry, that=E2=80=99s a really good idea! I=E2=80=99ll add that to= my list :) > > (P.S. Love your book BTW I give it to all of my juniors :) ) > > On 3 Jul 2023, at 18:48, Harry Percival <[email protected]> wrote: > > Have you considered bug bounty programmes? I think we used HackerOne back > in the day and got a few actionable fixes out of it, without ever spendin= g > too much money. > > Iirc we'd pay out like $50 for little things that were arguably not real > vulns but just missing best practices (rate limiting password reset > requests was an example iirc? Bit worried someone will jump on me saying > how insanely important that is lol) - the kinds of things you can find wi= th > an automated tool and minimal actual effort from the pentester -- and 10x > that (or more? Cant remember. In anycase i'm guessing H1 have suggested > payouts) for "real" bugs with PoC. > > You did have to deal with a bit of spam but overall it was worth it. > > Hp > > > > On Mon, 3 Jul 2023, 14:22 SW, <[email protected]> wrote: > >> I can also add https://istormsolutions.co.uk/ - I have a friend who >> works there, though I've not used their services myself. >> >> Thanks, >> S >> >> On 03/07/2023 15:03, Gautier Hayoun wrote: >> > Hi William, >> > >> > I have dealt with Callum at Sencode (https://sencode.co.uk/) recently. >> > They are a small company based in the UK, and I was perfectly >> > satisfied when their pen test of a Django web application. >> > >> > Best, >> > >> > Gautier >> > >> > On 03/07/2023 13:55, William Mayor wrote: >> >> Hi! >> >> >> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out of l= eads on this >> >> one. Any help is appreciated :) >> >> >> >> I=E2=80=99m looking for a penetration/security testing company that c= an help >> >> me with a product that we=E2=80=99re building. It=E2=80=99s an API (w= ritten using >> >> FastAPI, so there is a python link in here :) ), with web and native >> >> app front ends. >> >> >> >> I=E2=80=99d like to have some kind of certified test conducted, to fi= nd all >> >> the security edge cases that I=E2=80=99ve undoubtably missed. >> >> >> >> We=E2=80=99re a small company (a social enterprise), so our budget is= n=E2=80=99t great. >> >> >> >> So my question is, does anyone have any recommendations for a pen >> >> testing company that could help? >> >> >> >> Thank you! >> >> >> >> >> >> _______________________________________________ >> >> python-uk mailing list >> >> [email protected] >> >> https://mail.python.org/mailman/listinfo/python-uk >> > _______________________________________________ >> > python-uk mailing list >> > [email protected] >> > https://mail.python.org/mailman/listinfo/python-uk >> >> _______________________________________________ >> python-uk mailing list >> [email protected] >> https://mail.python.org/mailman/listinfo/python-uk >> > _______________________________________________ > python-uk mailing list > [email protected] > https://mail.python.org/mailman/listinfo/python-uk > > > --00000000000003127b05ffac638d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">aw thanks for the compliment.=C2=A0 3E on the way (if you = mean the goat book?)<br></div><br><div class=3D"gmail_quote"><div dir=3D"lt= r" class=3D"gmail_attr">On Tue, 4 Jul 2023 at 17:17, William Mayor <<a h= ref=3D"mailto:[email protected]">[email protected]</a>> wrot= e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0= .8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Thanks H= arry, that=E2=80=99s a really good idea! I=E2=80=99ll add that to my list := )<div><br></div><div>(P.S. Love your book BTW I give it to all of my junior= s :) )<br><div><br><blockquote type=3D"cite"><div>On 3 Jul 2023, at 18:48, = Harry Percival <<a href=3D"mailto:[email protected]" target=3D"_b= lank">[email protected]</a>> wrote:</div><br><div><div dir=3D"aut= o">Have you considered bug bounty programmes? I think we used HackerOne bac= k in the day and got a few actionable fixes out of it, without ever spendin= g too much money.<div dir=3D"auto"><br></div><div dir=3D"auto">Iirc we'= d pay out like $50 for little things that were arguably not real vulns but = just missing best practices (rate limiting password reset requests was an e= xample iirc? Bit worried someone will jump on me saying how insanely import= ant that is lol) - the kinds of things you can find with an automated tool = and minimal actual effort from the pentester -- and 10x that (or more? Cant= remember. In anycase i'm guessing H1 have suggested payouts) for "= ;real" bugs with PoC.</div><div dir=3D"auto"><br></div><div dir=3D"aut= o">You did have to deal with a bit of spam but overall it was worth it.</di= v><div dir=3D"auto"><br></div><div dir=3D"auto">Hp</div><div dir=3D"auto"><= br></div><div dir=3D"auto"><br></div></div><br><div class=3D"gmail_quote"><= div dir=3D"ltr" class=3D"gmail_attr">On Mon, 3 Jul 2023, 14:22 SW, <<a h= ref=3D"mailto:[email protected]" target=3D"_blank">[email protected]= .uk</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"marg= in:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1e= x">I can also add <a href=3D"https://istormsolutions.co.uk/" rel=3D"norefer= rer noreferrer" target=3D"_blank">https://istormsolutions.co.uk/</a> - I ha= ve a friend who <br> works there, though I've not used their services myself.<br> <br> Thanks,<br> S<br> <br> On 03/07/2023 15:03, Gautier Hayoun wrote:<br> > Hi William,<br> ><br> > I have dealt with Callum at Sencode (<a href=3D"https://sencode.co.uk/= " rel=3D"noreferrer noreferrer" target=3D"_blank">https://sencode.co.uk/</a= >) recently. <br> > They are a small company based in the UK, and I was perfectly <br> > satisfied when their pen test of a Django web application.<br> ><br> > Best,<br> ><br> > Gautier<br> ><br> > On 03/07/2023 13:55, William Mayor wrote:<br> >> Hi!<br> >><br> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out o= f leads on this <br> >> one. Any help is appreciated :)<br> >><br> >> I=E2=80=99m looking for a penetration/security testing company tha= t can help <br> >> me with a product that we=E2=80=99re building. It=E2=80=99s an API= (written using <br> >> FastAPI, so there is a python link in here :) ), with web and nati= ve <br> >> app front ends.<br> >><br> >> I=E2=80=99d like to have some kind of certified test conducted, to= find all <br> >> the security edge cases that I=E2=80=99ve undoubtably missed.<br> >><br> >> We=E2=80=99re a small company (a social enterprise), so our budget= isn=E2=80=99t great.<br> >><br> >> So my question is, does anyone have any recommendations for a pen = <br> >> testing company that could help?<br> >><br> >> Thank you!<br> >><br> >><br> >> _______________________________________________<br> >> python-uk mailing list<br> >> <a href=3D"mailto:[email protected]" rel=3D"noreferrer" target= =3D"_blank">[email protected]</a><br> >> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel= =3D"noreferrer noreferrer" target=3D"_blank">https://mail.python.org/mailma= n/listinfo/python-uk</a><br> > _______________________________________________<br> > python-uk mailing list<br> > <a href=3D"mailto:[email protected]" rel=3D"noreferrer" target=3D"_= blank">[email protected]</a><br> > <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel=3D"= noreferrer noreferrer" target=3D"_blank">https://mail.python.org/mailman/li= stinfo/python-uk</a><br> <br> _______________________________________________<br> python-uk mailing list<br> <a href=3D"mailto:[email protected]" rel=3D"noreferrer" target=3D"_blank= ">[email protected]</a><br> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" rel=3D"noref= errer noreferrer" target=3D"_blank">https://mail.python.org/mailman/listinf= o/python-uk</a><br> </blockquote></div> _______________________________________________<br>python-uk mailing list<b= r><a href=3D"mailto:[email protected]" target=3D"_blank">python-uk@pytho= n.org</a><br><a href=3D"https://mail.python.org/mailman/listinfo/python-uk"= target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r></div></blockquote></div><br></div></div></blockquote></div> --00000000000003127b05ffac638d-- --===============3802042502528488405== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ python-uk mailing list [email protected] https://mail.python.org/mailman/listinfo/python-uk --===============3802042502528488405==--