Okay so when performing a penetration test, you have done all your research, you have spent hours on the job to get your list of hosts and there open ports,
after performing your scan you manage to find 'x' amount of vulnerabilities and you also know how to exploit them,
E.g with a remote connection, command terminal execution or a buffer overflow.
How far do you go?
- Do you leave it as that, write/export your report and send it off.
- You exploit the system and then write your report, showing that you did the exploit (risking damage?)
- You perform the exploit and then have a look around? You might find something interesting...
What are your thoughts?
