Common External Pen Test Findings

User enumeration is frequently encountered during external penetration tests, particularly in law firms that publicly list their lawyers' email addresses. This practice can lead to easy exploitation, as attackers can harvest sensitive information directly from the HTML of the website. Similarly, personal information about individuals from various public sources contributes to security vulnerabilities, as this data can often serve as answers to security questions used elsewhere online. Many organizations underestimate the risks associated with publicly available information, enabling malicious actors to craft more convincing attacks.