A penetration tester discovers passwords in a publicly available data breach during the reconnaissance phase of the penetration test. Which of the following is the best action for the tester to take?
Upon discovering passwords in a publicly available data breach during the reconnaissance phase, the most ethical and constructive action for the penetration tester is to contact the client and inform them of the breach. This approach allows the client to take necessary actions to mitigate any potential risks, such as forcing password resets or enhancing their security measures. Adding the passwords to a report appendix (option A) without context or action could be seen as irresponsible, while doing nothing (option B) neglects the tester's duty to inform the client of potential threats. Using the passwords in a credential stuffing attack (option D) without explicit permission as part of an agreed testing scope would be unethical and potentially illegal.
Moon
15 days agoBrock
16 days agoFrancoise
2 days agoVenita
2 days agoSheridan
9 days agoLajuana
23 days agoProvidencia
27 days agoDomingo
1 months agoAbel
1 months agoBambi
19 days agoShizue
27 days agoLajuana
1 months agoMarjory
2 months agoNan
4 days agoJohnna
5 days agoMurray
6 days agoRoyal
15 days ago