Penetration testing a shared hosting estate
Hundreds of customer sites on shared infrastructure, where one weak account can affect its neighbours. Testing had to respect the operator's constraints and still find the flaws that matter.
- Client
- A hosting provider
- Sector
- Shared hosting and WordPress
- Engagement
- Administration and testing
- Timeline
- Two years
Shared hosting concentrates risk. A plugin vulnerability on one account is a cross-tenant problem, and hardening has to work without breaking customer sites.
The provider also ran its own PHP applications and WordPress installs, which were fair game for testing.
- 01
Administer the platform
Linux server hardening, service configuration, permissions and maintenance for the web-hosting environment behind the infrastructure.
- 02
Test the applications
Company PHP and WordPress applications plus client sites: plugin and theme vulnerabilities, authentication bypass, insecure file upload, privilege escalation and misconfiguration.
- 03
Read the code
PHP source review where access allowed, so a finding pointed at a line rather than a symptom.
- 04
Close the loop
Worked with developers to validate remediation and confirm the fix held on the live estate.
Tell me what yours looks like.
A short note about the system and the trigger is enough to say whether this pattern applies, and what a sensible scope would be.
Typically replies within one business day. NDA on request.
hello@enesismaili.com