Pentesting - Githubissues

zachChilders / just-add-water

ZeroConf Secure Infra for SMBs

BSD 2-Clause "Simplified" License

3 stars 4 forks source link

Pentesting #22

Closed zachChilders closed 4 years ago

zachChilders commented 5 years ago

Set up pentesting experiment leveraging hackerone/mics.

Should compare us vs baseline.

It may be valuable to compare today vs end of project

hmc-berk commented 5 years ago

Run Pen test prior to full pentester review.

zachChilders commented 5 years ago

We have Pascal signed up for 11/16 and Christian signed up for a week after. @hmc-berk do we have actual work we need to do for this before they hit it?

zachChilders commented 4 years ago

Pascal and Christian both hit us. Neither were able to get in, but after giving a password these are results of note:

Able to access our DB via a wordpress secret (unavoidable, we can't fix this)
Recommended using nginx #41
Could not pivot out of the container.