Ethical Website Security Testing – Full Plan

1. Direct Client Method (Your Idea)

You contact the website owner, get a signed agreement, test only what is allowed, write a report, and get paid. This is a legal and professional way to work.

Step 2 – Testing Phases (With Permission Only)

Phase 1 – Information Gathering

Find what the site is built with and what assets exist.

# Technologies in use
whatweb https://clientsite.com

# Subdomains
sublist3r -d clientsite.com -o /mnt/usb/results/subdomains.txt

# DNS records
dig clientsite.com ANY

# WHOIS information
whois clientsite.com

Phase 2 – Port Scanning

nmap -sV -sC -oA /mnt/usb/scans/client-scan clientsite.com
# Example result: 3306/tcp open mysql 5.7.33  (Internet‑exposed DB = high risk)

Phase 3 – Directory Enumeration

gobuster dir -u https://clientsite.com \
  -w /mnt/usb/wordlists/common.txt \
  -o /mnt/usb/results/directories.txt \
  -x php,html,txt,zip,bak

Phase 4 – SQL Injection Check (Low-Risk Options)

sqlmap -u "https://clientsite.com/product.php?id=1" \
  --batch --level=1 --risk=1 \
  --output-dir=/mnt/usb/sqlmap/
# Only dump data if the agreement explicitly allows it.

Phase 5 – Security Headers

curl -I https://clientsite.com
# Look for missing: X-Frame-Options, CSP, HSTS, X-Content-Type-Options.

Phase 6 – SSL / TLS

openssl s_client -connect clientsite.com:443
# Check for: expired cert, weak ciphers, SSLv2/v3, etc.

Step 3 – Professional Report

SECURITY ASSESSMENT REPORT
Client: ABC Company
Website: https://clientsite.com
Date: [Date]
Tester: [Your Name]

Summary: 8 vulnerabilities (3 Critical, 2 High, 3 Medium)

Examples:
1. Exposed backup file: https://clientsite.com/backup.zip  [CRITICAL]
2. SQL injection: https://clientsite.com/product.php?id=1  [CRITICAL]
3. Exposed .git: https://clientsite.com/.git/              [CRITICAL]
4. MySQL 3306 open to internet                              [HIGH]
5. Missing security headers                                 [HIGH]
6. phpinfo.php exposed                                      [MEDIUM]
7. Directory listing on /uploads/                           [MEDIUM]
8. Weak SSL configuration                                   [MEDIUM]

Step 4 – Invoice

INVOICE

Service Provider: [Your Name]
Client: ABC Company
Date: [Date]

Services:
- Web application security assessment
- Vulnerability scanning
- Detailed report & remediation advice

Amount: ₹[5,000–50,000] (depends on scope)
Payment Terms: Upon receipt
Payment Method: UPI / Bank transfer

2. Bug Bounty Platforms (HackerOne, Bugcrowd etc.)

1. Sign up on hackerone.com (free).
2. Choose public programs (PayPal, Shopify, Twitter, GitHub, Uber, etc.).
3. Read each program's scope carefully:
   - What domains are allowed.
   - What is out of scope.
4. Test only in-scope targets using the same commands.
5. Report bugs through the platform.
6. Get paid when reports are accepted and validated.

3. Learning & Target Strategy (Short Version)

Month 1 – Practice Only

- TryHackMe: "Web Fundamentals"
- HackTheBox: 5 easy machines
- PortSwigger Academy: SQLi labs
- Practice on testphp.vulnweb.com

Months 2–3 – Build Skills & Portfolio

- Learn SQLi, XSS, auth bypass, logic flaws.
- Save screenshots and notes for portfolio.

Month 4 – Start Earning

- Join HackerOne/Bugcrowd OR
- Approach 3–5 local small businesses.
- Offer free initial scan, then paid full assessments.