The scope, checks, safety constraints and references behind every ProteQon service, from web and APIs to OT networks, published so you know what a test covers before it starts.
34
test areas
202
tool references
9
service tracks
This is a reference for authorized testing only. Every technique here is used strictly within a written scope and rules of engagement agreed with the system owner.
00 · Engagement lifecycle
From authorization to retest
01
Scope and authorize
Targets, accounts, testing windows and rules of engagement are agreed in writing before any traffic is sent.
02
Map the surface
Reconnaissance builds an inventory of hosts, endpoints, parameters and technologies inside the agreed scope.
03
Test and exploit
Each class of weakness below is tested manually, with tools used to extend coverage rather than replace judgement.
04
Verify impact
Findings are reproduced and rated by priority so that what reaches the report is real and explainable.
05
Report
Evidence, impact and remediation for every finding, in a format engineering and audit can both use.
06
Retest
Fixes are verified and the report is updated with the result.
Priority model
How findings are ranked
P1
Critical
Remote code execution, authentication bypass, data breach at scale
P2
High
Significant data exposure, privilege escalation, stored XSS on sensitive pages
P3
Medium
Limited data exposure, reflected XSS, CSRF on sensitive functions
P4
Low
Information disclosure, minor misconfigurations, self-XSS
Identify all subdomains of the target to expand the attack surface. Combine passive (cert transparency, threat intel) with active (bruteforce) methods.
VRT Severity: High (P2) when sensitive data is accessible to arbitrary origins. Medium (P3) if limited impact. Check for wildcard + credentialed requests.
VRT Severity: High (P2) on state-changing sensitive actions (password change, fund transfer). Medium (P3) on lower-impact actions. Requires authenticated session.
VRT Severity: High (P2) when arbitrary file read is possible (e.g., /etc/passwd, source code, secrets). Critical (P1) if write access or RCE achievable.
Test checklist: Numeric ID → enumerate adjacent IDs · UUID → try GUID of other accounts · Horizontal + vertical privilege escalation · Mass assignment · API parameter tampering
VRT Severity: High (P2) when accessing other users' private data. Critical (P1) for mass data exfiltration. Low (P4) for publicly available data only.
VRT Severity: Medium (P3) standalone. High (P2) when chained with OAuth token theft or used in phishing at scale. Low (P4) if requires user interaction with no escalation path.
VRT Severity: Critical (P1) — can bypass front-end security controls, poison cache, hijack requests of other users, or achieve RCE in some configurations.
VRT Severity: Critical (P1) for internal network access, metadata service access, or pivoting to RCE. High (P2) for blind SSRF with limited impact. Medium (P3) for SSRF to non-sensitive internal endpoints.
VRT Severity: Critical (P1) for authentication bypass, data exfiltration, or OS command execution via SQL. High (P2) for read-only SQLi with limited data. Medium (P3) for blind/time-based with restricted access.
VRT Severity: Critical (P1) for SSRF or file read via XXE. High (P2) for blind/OOB XXE with confirmed data exfil. Medium (P3) for XXE without confirmed impact.
VRT Severity: Critical (P1) for algorithm confusion (RS256→HS256) leading to admin auth bypass. High (P2) for weak secret bruteforce. Medium (P3) for sensitive data in payload.
VRT Severity: High (P2) when postMessage leads to XSS or sensitive data extraction. Medium (P3) for misconfigured message handlers without proper origin validation.
Note: Severity ratings are defaults. Actual priority depends on application context, data sensitivity, exploitability, and business impact. ProteQon engineers should always justify ratings with evidence. Source: Bugcrowd VRT.
Server Security Misconfiguration17 itemsP2
Vulnerability
Priority
Description
Misconfigured DNS
P3
Misconfigured DNS records enabling zone transfer, cache poisoning, or subdomain hijacking
Directory Listing Enabled
P4
Web server exposes directory contents without authorization
Exposed Admin Panels
P2
Admin interface accessible without authentication or with weak credentials
Lack of Password Confirmation
P4
Sensitive actions (email/password change) performed without re-authentication