We're running a web pentest on our live site — how to write a test plan to avoid downtime?

Watch out for form-filling features in automated scanners. If they hit your newsletter sign-up or contact forms, they can dump 20,000 dummy emails into your queue in 10 minutes and get your mail server blacklisted. Exclude those forms from the scan.

Set up dedicated test accounts with preloaded balances for the testing team. Whatever you do, do not let them test deletions or reserve items in their carts against real inventory, or your stock will get locked up.

We ran a test on prod two years ago, and while checking for SQL Injection, the pentester fired off a sleep query. The database connection pool was exhausted in 3 minutes, and checkout threw errors on the live site for 20 minutes straight. Having an on-call devops person is non-negotiable.

We scheduled ours between 02:00 and 06:00. On a site doing 1,000 orders a day, volume drops to maybe 15 orders overnight. If something locked up, the cost in lost sales was practically zero. Never run live tests during business hours.

How will they test the payment gateway? Are they going to charge tiny amounts on live POS terminals, or are you setting up a sandbox gateway? If this isn't crystal clear in the contract, finance will have a meltdown.

make sure you put a single authorized phone number in the test plan then i mean the moment anything feels off the pentester must shut down their tools as soon as that number calls to tell them to stop.

Not being able to match production with staging and doing a pentest on prod that basically turns into a stress test is such a classic thrill-seeking move unique to our industry. At least take a full backup an hour before the test so you don't wake up to a disaster scenario the next morning.

The test agreement to be drafted must clearly specify the responsibilities of both parties, explicitly stipulating that the contractor shall be liable for any commercial damages arising should the testing team deviate from the approved schedule and designated hours.

We experienced almost the exact same thing last year. When making a decision first look at what data you have on hand.

Proven by experience.

There are three things to check when doing this. The real issue isn't the number, but what it's based on.

Just because everyone does it doesn't mean it's right. If I were you, I'd go this route.

I agree.

Three different views emerged, they all complement each other. If you get three different answers on a topic, the question was asked wrong.

Correct me if I'm wrong.

Following.

There are three things to check when doing this. If you scold false alarms, nobody will report again.

This is my opinion, I'm not claiming it's absolute truth.

Exactly, and not many people know this. Trying to do this alone is the most expensive way.

We experienced almost the exact same thing last year. Solutions that work at a small scale collapse when you grow; I learned this late.

Hope this helps.

I've been dealing with this for a long time. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Just leaving this note, it might be useful.

Thanks for writing this, that's the right way. Having backups accessible on the same network and with the same identity makes them part of the target.

Mistakes made on the web pentest test plan side are usually reversible but expensive. If you have questions, write them; I'll answer as best I can.