Question

During pre-engagement scoping, a client provides a target IP range for an external penetration test. While reviewing the assets, the tester discovers that several in-scope web applications are hosted on infrastructure owned and operated by a third-party managed hosting provider, not the client. The client insists they own the applications and that this is sufficient authorization. What is the MOST appropriate action for the tester to take before beginning active testing against those systems?

Accepted Answer

Obtain written authorization from the third-party hosting provider before testing the shared infrastructure

Answer

Proceed with testing, since the client owns the applications and has authorized the engagement in the signed contract

Answer

Test only the application layer and avoid any activity that could affect the underlying hosting infrastructure

Answer

Exclude the hosted applications from scope entirely, since only client-owned infrastructure can be legally tested