A penetration tester is testing a company's public API and discovers that specific input allows the execution of arbitrary commands on the base operating system. Which of the following actions…

Question

Options

• AInclude the findings in the final report.
• BNotify the client immediately.
• CDocument which commands can be executed.
• DUse this feature to further compromise the server.

• A
  14% (6)
• B
  79% (34)
• C
  2% (1)
• D
  5% (2)

Explanation

Remote Code Execution (RCE) or OS command injection via a public API is a critical severity vulnerability - it gives an attacker full control of the underlying server. According to penetration testing professional standards (and exam scenarios), critical findings that pose immediate risk to the organization must be communicated to the client out-of-band as soon as they are discovered, without waiting for the final report. This is called an 'urgent finding notification' or 'real-time escalation.' The tester should not continue exploiting it further without authorization, should not simply document it quietly for the final report, and should not spend time cataloging all possible commands before alerting the client. Immediate notification allows the client to take emergency remediation action.

No community discussion yet for this question.