5. Common Scoping Mistakes

  • NOT THOROUGHLY reading the scope before testing

  • NOT STRICTLY following the scope

  • MISUNDERSTANDING the importance of scope

  • Reviewing asset scope, while FORGETTING bug scope.

Bugs and vulnerabilities CAN be OOS as well.

  • Assuming all subdomains are in scope - make sure you read well

  • Not verifying if third-party services are in-scope

  • Improperly configuring tools to adhere to scope

  • Reporting out of scope findings

Common OOS vulnerabilities

  • Physical attacks

  • Social Engineering

  • Denial of Service (DoS)

  • Outdated software

  • Missing headers / cookie flags if you can leverage an attack because of this then it can be reported

Look for things that actually you can prove the security impact of.

  • Brute-forcing credentials - check exactly if it's in scope or not to make sure to not randomly bruteforce some specific account and get restricted or purely not obtaining anything out of it.

  • Username enumeration - very low impact, not pose on a security risk on its own. Sometimes it might not be OOS like fx when personal data knowledge is really important e.g. on a Health Institution website.

  • Fingerprinting - finding software names or software versions used

  • Theoretical attacks

  • Leaked credentials - using dark web credentials do not work as a finding

    • If you get the credentials because you guessed it it's a different story