Re: Pen Testing for SMEs?
William Mayor <[email protected]> Tue, 4 Jul 2023 20:16:50 +0100
| Newsgroups | gmane.comp.python.org.uk |
|---|---|
| Message-ID | <[email protected]> |
--===============2548973723588310087== Content-Type: multipart/alternative; boundary="Apple-Mail=_C3D76CCC-1035-49C0-99B3-19D8956267F4" --Apple-Mail=_C3D76CCC-1035-49C0-99B3-19D8956267F4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I do mean the goat book. I=E2=80=99ll keep my eyes out for 3e :) > On 4 Jul 2023, at 18:12, Harry Percival <[email protected]> = wrote: >=20 > aw thanks for the compliment. 3E on the way (if you mean the goat = book?) >=20 > On Tue, 4 Jul 2023 at 17:17, William Mayor <[email protected] = <mailto:[email protected]>> wrote: >> Thanks Harry, that=E2=80=99s a really good idea! I=E2=80=99ll add = that to my list :) >>=20 >> (P.S. Love your book BTW I give it to all of my juniors :) ) >>=20 >>> On 3 Jul 2023, at 18:48, Harry Percival <[email protected] = <mailto:[email protected]>> wrote: >>>=20 >>> Have you considered bug bounty programmes? I think we used HackerOne = back in the day and got a few actionable fixes out of it, without ever = spending too much money. >>>=20 >>> Iirc we'd pay out like $50 for little things that were arguably not = real vulns but just missing best practices (rate limiting password reset = requests was an example iirc? Bit worried someone will jump on me saying = how insanely important that is lol) - the kinds of things you can find = with an automated tool and minimal actual effort from the pentester -- = and 10x that (or more? Cant remember. In anycase i'm guessing H1 have = suggested payouts) for "real" bugs with PoC. >>>=20 >>> You did have to deal with a bit of spam but overall it was worth it. >>>=20 >>> Hp >>>=20 >>>=20 >>>=20 >>> On Mon, 3 Jul 2023, 14:22 SW, <[email protected] = <mailto:[email protected]>> wrote: >>>> I can also add https://istormsolutions.co.uk/ - I have a friend who=20= >>>> works there, though I've not used their services myself. >>>>=20 >>>> Thanks, >>>> S >>>>=20 >>>> On 03/07/2023 15:03, Gautier Hayoun wrote: >>>> > Hi William, >>>> > >>>> > I have dealt with Callum at Sencode (https://sencode.co.uk/) = recently.=20 >>>> > They are a small company based in the UK, and I was perfectly=20 >>>> > satisfied when their pen test of a Django web application. >>>> > >>>> > Best, >>>> > >>>> > Gautier >>>> > >>>> > On 03/07/2023 13:55, William Mayor wrote: >>>> >> Hi! >>>> >> >>>> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running out = of leads on this=20 >>>> >> one. Any help is appreciated :) >>>> >> >>>> >> I=E2=80=99m looking for a penetration/security testing company = that can help=20 >>>> >> me with a product that we=E2=80=99re building. It=E2=80=99s an = API (written using=20 >>>> >> FastAPI, so there is a python link in here :) ), with web and = native=20 >>>> >> app front ends. >>>> >> >>>> >> I=E2=80=99d like to have some kind of certified test conducted, = to find all=20 >>>> >> the security edge cases that I=E2=80=99ve undoubtably missed. >>>> >> >>>> >> We=E2=80=99re a small company (a social enterprise), so our = budget isn=E2=80=99t great. >>>> >> >>>> >> So my question is, does anyone have any recommendations for a = pen=20 >>>> >> testing company that could help? >>>> >> >>>> >> Thank you! >>>> >> >>>> >> >>>> >> _______________________________________________ >>>> >> python-uk mailing list >>>> >> [email protected] <mailto:[email protected]> >>>> >> https://mail.python.org/mailman/listinfo/python-uk >>>> > _______________________________________________ >>>> > python-uk mailing list >>>> > [email protected] <mailto:[email protected]> >>>> > https://mail.python.org/mailman/listinfo/python-uk >>>>=20 >>>> _______________________________________________ >>>> python-uk mailing list >>>> [email protected] <mailto:[email protected]> >>>> https://mail.python.org/mailman/listinfo/python-uk >>> _______________________________________________ >>> python-uk mailing list >>> [email protected] <mailto:[email protected]> >>> https://mail.python.org/mailman/listinfo/python-uk >>=20 --Apple-Mail=_C3D76CCC-1035-49C0-99B3-19D8956267F4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">I do mean the = goat book. I=E2=80=99ll keep my eyes out for 3e = :)<br><div><br><blockquote type=3D"cite"><div>On 4 Jul 2023, at 18:12, = Harry Percival <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><div dir=3D"ltr">aw thanks for = the compliment. 3E on the way (if you mean the goat = book?)<br></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" = class=3D"gmail_attr">On Tue, 4 Jul 2023 at 17:17, William Mayor <<a = href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div>Thanks Harry, that=E2=80=99s a = really good idea! I=E2=80=99ll add that to my list = :)<div><br></div><div>(P.S. Love your book BTW I give it to all of my = juniors :) )<br><div><br><blockquote type=3D"cite"><div>On 3 Jul 2023, = at 18:48, Harry Percival <<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>> = wrote:</div><br><div><div dir=3D"auto">Have you considered bug bounty = programmes? I think we used HackerOne back in the day and got a few = actionable fixes out of it, without ever spending too much money.<div = dir=3D"auto"><br></div><div dir=3D"auto">Iirc we'd pay out like $50 for = little things that were arguably not real vulns but just missing best = practices (rate limiting password reset requests was an example iirc? = Bit worried someone will jump on me saying how insanely important that = is lol) - the kinds of things you can find with an automated tool and = minimal actual effort from the pentester -- and 10x that (or more? Cant = remember. In anycase i'm guessing H1 have suggested payouts) for "real" = bugs with PoC.</div><div dir=3D"auto"><br></div><div dir=3D"auto">You = did have to deal with a bit of spam but overall it was worth = it.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Hp</div><div = dir=3D"auto"><br></div><div dir=3D"auto"><br></div></div><br><div = class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, 3 = Jul 2023, 14:22 SW, <<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I = can also add <a href=3D"https://istormsolutions.co.uk/" rel=3D"noreferrer = noreferrer" target=3D"_blank">https://istormsolutions.co.uk/</a> - I = have a friend who <br> works there, though I've not used their services myself.<br> <br> Thanks,<br> S<br> <br> On 03/07/2023 15:03, Gautier Hayoun wrote:<br> > Hi William,<br> ><br> > I have dealt with Callum at Sencode (<a = href=3D"https://sencode.co.uk/" rel=3D"noreferrer noreferrer" = target=3D"_blank">https://sencode.co.uk/</a>) recently. <br> > They are a small company based in the UK, and I was perfectly <br> > satisfied when their pen test of a Django web application.<br> ><br> > Best,<br> ><br> > Gautier<br> ><br> > On 03/07/2023 13:55, William Mayor wrote:<br> >> Hi!<br> >><br> >> This isn=E2=80=99t exactly on topic, but I=E2=80=99m running = out of leads on this <br> >> one. Any help is appreciated :)<br> >><br> >> I=E2=80=99m looking for a penetration/security testing company = that can help <br> >> me with a product that we=E2=80=99re building. It=E2=80=99s an = API (written using <br> >> FastAPI, so there is a python link in here :) ), with web and = native <br> >> app front ends.<br> >><br> >> I=E2=80=99d like to have some kind of certified test conducted, = to find all <br> >> the security edge cases that I=E2=80=99ve undoubtably = missed.<br> >><br> >> We=E2=80=99re a small company (a social enterprise), so our = budget isn=E2=80=99t great.<br> >><br> >> So my question is, does anyone have any recommendations for a = pen <br> >> testing company that could help?<br> >><br> >> Thank you!<br> >><br> >><br> >> _______________________________________________<br> >> python-uk mailing list<br> >> <a href=3D"mailto:[email protected]" rel=3D"noreferrer" = target=3D"_blank">[email protected]</a><br> >> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> > _______________________________________________<br> > python-uk mailing list<br> > <a href=3D"mailto:[email protected]" rel=3D"noreferrer" = target=3D"_blank">[email protected]</a><br> > <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> <br> _______________________________________________<br> python-uk mailing list<br> <a href=3D"mailto:[email protected]" rel=3D"noreferrer" = target=3D"_blank">[email protected]</a><br> <a href=3D"https://mail.python.org/mailman/listinfo/python-uk" = rel=3D"noreferrer noreferrer" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r> </blockquote></div> _______________________________________________<br>python-uk mailing = list<br><a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br><a = href=3D"https://mail.python.org/mailman/listinfo/python-uk" = target=3D"_blank">https://mail.python.org/mailman/listinfo/python-uk</a><b= r></div></blockquote></div><br></div></div></blockquote></div> </div></blockquote></div><br></body></html>= --Apple-Mail=_C3D76CCC-1035-49C0-99B3-19D8956267F4-- --===============2548973723588310087== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ python-uk mailing list [email protected] https://mail.python.org/mailman/listinfo/python-uk --===============2548973723588310087==--