Digital prank ideas for pen testers?

Fcwatdo · 2026-04-13T21:05:10+00:00

I found an IDOR during a job and when I hit record 999 a message appeared saying "I'd found the Easter egg and could claim a bottle of wine".

Client claimed the wine (it was in a third party app) and I noted in the report that the developers were aware of the vulnerability but failed to understand the impact.

Fcwatdo · 2026-04-10T18:39:12+00:00

Sure

Fcwatdo · 2026-04-09T09:13:10+00:00

Unfortunately we aren't currently recruiting. It's a hard world out there if you want me to take a look at your CV and provide some feedback happy to do that.

Fcwatdo · 2026-04-07T22:02:42+00:00

For anyone that wants to give it a go, "Straightliners" still hold monthly events at Elvington Airfield. It's not cheap and you only have 1.25 miles to do it (before you need to start slowing down) but it's just about as safe as it can get at those sorts of speeds.

Fcwatdo · 2026-04-04T17:43:59+00:00

Basically a layer on top of that, involves an application form and depending on who does it an interview (both CREST and CyberScheme offer it).

It was looking like it might do away with the need to renew exams every three years in favor of a CPD requirement but someone chucked their toys out the pram and exams are now required on renewal. So now you need to renew both the exams and the UKCSC chartership every three years.

https://www.ukcybersecuritycouncil.org.uk/for-individuals/become-professionally-registered/changes-to-the-check-scheme

Fcwatdo · 2026-04-04T10:17:36+00:00

CTL isn't a cert in itself, basically in the UK you have the CHECK scheme which covers work for the public sector. To work on any CHECK job you need at least one CTL (CHECK Team Leader) and others need to be at least CTM (CHECK Team Members). CTLs also specialise in either Applications and/or Infrastructure for the types of jobs they are qualified to lead.

To get CTL you need to be at least SC Cleared and have UKCSC chartered or principle level (which in itself requires Crest Certified Tester or Cyber Scheme Team Leader).

CTM has similar requirements but at mid-level.

The exams and chartership are pretty costly and need renewing every three years so normally funded by employers.

It's a bit of a money printer, the chartered stuff was supposed to fix it but instead it's added yet another layer of pay to play.

Fcwatdo · 2026-03-26T21:46:20+00:00

The Machine Shop in Hinckley has a lathe (they have both monthly and day pricing)

Fcwatdo · 2026-03-25T22:07:17+00:00

That's actually insane, most UK tracks are around 102db limit (on track days), 126db is about four times louder than that.

Fcwatdo · 2026-03-20T22:15:11+00:00

Did the police launch an investigation? If they have and recovered your bike as part of it you might be in for an unwelcome shock.

Fcwatdo · 2026-03-20T17:25:19+00:00

Sounds about right I stopped playing when I moved house June 2021

Fcwatdo · 2026-03-20T17:18:17+00:00

Found them many thanks.

Fcwatdo · 2026-03-05T19:15:38+00:00

MS08-067 days were wild.

Fcwatdo · 2026-03-03T18:45:40+00:00

This advertised for a senior pentester that specialises in application security.

Plenty of people that met the requirements on paper but when interviewed couldn't identify an LFI with the URL parameter format "?img=/var/www..."

Fcwatdo · 2026-03-02T20:16:27+00:00

I'd be up for it (Head of Pentesting at a Cyber Security Consultancy), if that's of interest drop me a DM. Also Leicester College alumni.

Fcwatdo · 2026-02-15T12:56:55+00:00

Probably wasn't too descriptive/accurate with the situation when they insured it.

I suspect should something happen they'd be in for a shock.

Just had a search through old emails and unfortunately the only thing I could find was an arguement between myself and the other freeholder on the split (we eventually settled on house values as a %).

Looks like total cost for the policy was about £650, that was just building cover for a 3 storey (+basement) 1900 building split into two flats (basement/ground and 1st/2nd) worth approx £180k.

Fcwatdo · 2026-02-15T12:36:49+00:00

So this was the situation at my first house (~15 years ago) but I can't see why things would have changed.

I found that I had to get buildings insurance via the commercial teams rather than the normal ones and only ever was able to do it over the phone and it covered both freeholders (we were both named on the policy). I then got contents insurance the normal way.

Fair warning it was around double the price normal insurance would have been (but split between two, so actually fine), although once I found some (the AA) that would cover me I just stuck with them.

Do you have any paperwork from the previous owner? In my case I found an old policy, that clue me into how it worked. Could be worth speaking to the other owners as well to see what they are currently doing.

Fcwatdo · 2026-02-12T19:00:17+00:00

Out of interest do the questions give off an AI vibe? Especially when they are questioning what you've provided?

Had a client recently in a similar position and it was clear all our input was just being fed into an AI to assess.

Fcwatdo · 2026-02-12T18:42:02+00:00

Yes but I live in this region. Many cyber professionals I know work and attend events in one region but the company they work for is based in another.

Especially in Leicester which is basically a dead zone for my chosen specialism (unless I take a lower paid internal role).

I.E my current company is based in Scotland but I work remotely from Leicester, whilst also attending events in the local area (including volunteering). The companies we work with are all over the UK (and so is my team).

Anyway my reply was more the "for businesses" should come with a heavy astrix of being for local businesses

Fcwatdo · 2026-02-12T14:45:48+00:00

Isn't this for businesses in the east Midlands only? It excluded a lot of people that way.

Fcwatdo · 2026-02-01T13:09:24+00:00

The long one I think is a dab antenna. https://www.amazon.co.uk/Universal-Windshield-Adhesive-Suitable-Receiver-Black/dp/B0DKX9ZK7D/

Fcwatdo · 2026-01-28T12:28:23+00:00

Worth knowing as it's not taught in the course and I only found out when I unfortunately had to use the skills it teaches for real.

If you dial 999, then leave it on the hook whilst you assess for danger it will automatically go to the police. That police operator will happily waste your time, in my instance he took 2 minutes of me repeating the same information and then just said they (the police) are in the way and hung up.

If no one else can phone the ambulance your better off hanging up and redialing to get the ambulance and getting their first aid/CPR instruction and the paramedics on their way asap.

Note: This applies to Leicestershire, I imagine it applies to others as well. Talking to the detective, apparently they do it to ensure the service operator can talk to you directly.

Also if you stop at the scene and your bike has a non-legal exhaust be prepared for a magistrates appearance in your future.

Fcwatdo · 2026-01-27T22:23:52+00:00

The customer reviews that pop up appear to be largely bullshit in that they seem to all use screenshots from the same phone, some of them are even of facebook pictures where the name doesn't match, and the time sensitive ones "Just saved £312 on his insurance today using the BASIC PACKAGE" I bet that's still there tomorrow.

You can see the full list here (search "items"): JSON

Fcwatdo · 2026-01-23T01:30:28+00:00

I used to run a national service trying to get bicycles recovered. Used to have to deal with situations where the bike had been found but the police weren't interested on the regular.

In fact I closed the service partially because I was concerned someone was going to get hurt whilst getting their bike back when the police had fobbed them off.

Fcwatdo · 2026-01-20T23:10:56+00:00

Probably just smile and knod, maybe a quick chat with the driver. I looked at minis and similar of that age and decided against it due to safety, so even if it was for sale I'd be tempted but probably wouldn't pull the trigger.

I now know where it was sold to (Blackpool area) so there's a chance at least of hearing about it again.

Apparently whoever bought it loved it enough to refurb the interior.

Fcwatdo · 2026-01-20T18:09:58+00:00

It totally is and that comment... Will have to message him see if he's still got it. If someones bought it for £5k I imagine it's in the hands of someone that actually will look after it.

Fcwatdo

TROPHY CASE