Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All resources // SAMPLE DELIVERABLE

A real penetration test report, redacted

What you keep from a penetration test is the report, and that is hard to judge from a sales call. This is a genuine Ferres Systems penetration test report, published with the client's written permission and redacted, so you can judge the quality of the writing rather than the quality of the sales call. Every capture we had to remove is marked as a numbered figure describing what the original showed, because deleting the evidence silently and leaving you to guess how thin the original was would defeat the point. If you are comparing quotes, ask whoever else you are talking to for the same thing.

Redacted sample report · 21 pages. Free.

WHO THIS IS FOR
  • Anyone comparing penetration testing quotes and unable to tell them apart
  • Directors who will have to read the report and act on it
  • IT people who have been handed a scanner export and told it was a test
// READ IT BEFORE YOU BUY IT

One finding, exactly as we wrote it

A real page from the document. The black bars mark detail removed for publication, or space left for you to fill in.

WHAT IS INSIDE
Executive summary Written for a director, and the part we expect to be forwarded to an insurer or a board
Scope and authorisation What was tested, what was explicitly excluded, and what we were permitted to do
Findings, ranked by business impact With the scanner's own rating printed beside ours, so you can see where the two disagree
How findings are rated What moves a rating away from raw technical severity, and why the number is not objective
Two findings worked in full Reproduction steps, evidence, specific remediation and the retest capture for each
Remediation plan, retest and reissue Fix now, fix soon, accept, and what a clean reissue is actually evidence of
How this sample was redacted Six numbered figures marking where a capture sat, each describing what the original showed
If you are comparing quotes Seven things worth asking for from whoever else you are talking to
Ferres Systems Penetration Test Report
SAMPLE
SECTION 05 // F-01, A FINDING WORKED IN FULL
CLIENT Redacted allied health practice, Victoria
EXECUTIVE SUMMARY

Six findings, of which two required action that month. The most serious is not a single flaw but a chain. A low-rated predictability weakness made a medium-rated access control vulnerability reliably exploitable, by allowing valid record identifiers to be enumerated rather than guessed. The predictable identifiers make the exposure easier to exploit systematically, but the missing ownership check warrants urgent attention on its own.

FINDING F-01 HIGH

Appointment records reachable by changing a record number

A signed-in user can view another patient's record by altering the numeric identifier in the request. No additional privileges are required and the change is trivial to make by hand. That missing ownership check is serious by itself. Combined with F-05, valid identifiers can be enumerated rather than guessed, so the records can be collected systematically rather than one lucky guess at a time.

WHAT THE SCANNER SAID MEDIUM

The automated scan found both components of the chain, rated them medium and low, and reported no relationship between them. It rated the missing security headers higher than this finding, and it did not detect F-02 at all. That is the difference a manual test buys, and it is the reason we publish this sample.

BUSINESS IMPACT

This is unauthorised access to health information, which sits in the sensitive information category under the Privacy Act 1988. Any confirmed unauthorised access would require prompt assessment under the Notifiable Data Breaches scheme, and could constitute an eligible data breach where the circumstances indicate serious harm is likely and remedial action cannot prevent it.

EVIDENCE, FIGURE 2

The request as issued from the tester's own signed-in session, with only the record number altered, and the server returning a full appointment record. Note that it returned 200 rather than 403. That is the finding, and it is visible in one line.

Request and response pair, removed for publication
REMEDIATION
  • Enforce an ownership check server side on every record request, not in the interface. The interface hiding a record is not the same as the server refusing to return it
  • Do not rely on identifiers being hard to guess. Treat them as public
  • Log and alert on repeated failed ownership checks from one session, so the next attempt is visible while it is happening
RETEST PASS

Verified closed on retest. The server now returns 403 for records not owned by the authenticated user, and repeated failures raise an alert. A clean reissue was supplied for the practice's insurer.

Sample page. The full document continues. 1 / 8
// GET THE FULL VERSION

Send me the full report

One email, with the document attached. We use a work address because these are written for businesses, and because it tells us which of our writing is worth doing more of.

  • The document arrives within a few minutes
  • No follow-up emails unless you tick the box
  • Never sold or shared for anyone else's marketing. Delivery providers are named in the privacy policy
RELATED SERVICE Security Assessments and Penetration Testing Scope, timeline and what it costs

We use your details to send this document. Follow-up emails go only to people who tick the box above, and every one has an unsubscribe link.
Ferres Systems, PO Box 338, Geelong VIC 3220. ABN 98 663 151 710.

Rather just talk it through?

Get in touch
Shapes Shapes