School Website Gray-Box Pentest
Budget: $30 – $250 USD
My school’s website is live and fully integrated with its database, and I now need a thorough gray-box penetration test to be sure it can withstand real-world attacks. I will supply limited internal knowledge—dev credentials and an architecture overview—but I want you to approach the assessment as an informed outsider.
Scope of the test
• Concentrate on the login and authentication flow, database interactions, and every layer of user-role/permission management.
• Explicitly probe for SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) issues.
Tools and methods are up to you—Burp Suite, OWASP ZAP, custom scripts, manual code review—just use whatever gives solid, reproducible findings.
Deliverables
1. Executive-level summary highlighting critical, high, medium, and low risks.
2. Detailed technical report with proof-of-concept payloads, affected URLs or queries, and clear remediation advice.
3. Retest confirmation once fixes are applied (brief delta report).
Success is achieved when every listed vulnerability category has been tested, exploitable flaws are documented with viable fixes, and a clean retest shows the site secure.
Scope of the test
• Concentrate on the login and authentication flow, database interactions, and every layer of user-role/permission management.
• Explicitly probe for SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) issues.
Tools and methods are up to you—Burp Suite, OWASP ZAP, custom scripts, manual code review—just use whatever gives solid, reproducible findings.
Deliverables
1. Executive-level summary highlighting critical, high, medium, and low risks.
2. Detailed technical report with proof-of-concept payloads, affected URLs or queries, and clear remediation advice.
3. Retest confirmation once fixes are applied (brief delta report).
Success is achieved when every listed vulnerability category has been tested, exploitable flaws are documented with viable fixes, and a clean retest shows the site secure.
Related categories:
PHP
Linux
Web Security
SQL
MySQL
Internet Security
Penetration Testing
Network Security
Risk Assessment
Data Protection