Question

A financial services firm hires an external red team to conduct a penetration test against its customer-facing web application. Midway through the engagement, the testers discover that the application shares a database backend with an internal HR system that was explicitly excluded from the signed scope. The testers realize they could pivot to the HR data through a SQL injection flaw. What is the MOST appropriate action for the red team to take?

Accepted Answer

Halt exploitation of the out-of-scope system, document the finding, and contact the designated point of contact to request scope authorization

Answer

Exploit the pivot to fully demonstrate the impact, since the vulnerability originates from an in-scope system

Answer

Continue testing the HR system quietly and report it only in the final deliverable to avoid alerting the client prematurely

Answer

Immediately terminate the entire engagement because the scoping document is now invalid