The purpose of this type of testing is to focus on finding highly impactful vulnerabilities that can creep in between penetration tests and would have significant impact if left undiscovered.
Freeform Bug Hunting goes beyond the regular assessments of the Verified service and seeks to discover issues of a more creative nature, that are harder to find on any automated basis. This bug hunting service is run by qualified penetration testers, who spend a guaranteed number of security testing days over the term attempting to discover serious weaknesses in the systems in scope.
Freeform Bug Hunting is not as structured as a standard penetration test (i.e. we are not seeking to provide an audit log for every HTTP security header on the web server) and does not always involve a lengthy report. Testing focus and prioritisation of targets is encouraged, so Intruder’s testing efforts can be directed. For example, if focus can be directed toward a particular area such as a recently changed API.
Freeform Bug Hunting days do not need to be run as a Black Box test. Clients wishing for more in-depth testing can provide credentials, change notes or source code. Anything that the client feels will assist Intruder’s team in discovering weaknesses.
In addition to the billed number of guaranteed freeform bug hunting days, our consultants are given extra time each month to search for vulnerabilities across each of Intruder’s Verified clients’, just as bug hunters would as part of a Bug Bounty program.
Freeform Bug Hunting is performed from the perspective of an internet-based attacker but can include credentials or privileged information on systems beyond what’s available for regular users. Testing from this perspective can help to understand your cyber security posture as viewed by a determined attacker or one with inside information.
Freeform Bug Hunting aims to spend security testing time efficiently in order to discover as many impactful weaknesses as possible and does not aim perform an exhaustive test of the systems in scope. As such, a full penetration test report in the traditional sense is not a good fit. Instead, Intruder’s bug hunting team will write and deliver report snippets called ‘Verified Advisories’ for security issues discovered throughout the process.