eCommerce Security - Easy $1k/week! (NEWBIE friendly)

[Copax]

Good method OP. Are you also a reseller of Acunetix?

As a reseller I don't think Acunetix would take too kindly to me alerting people to the fact it's available as a torrent, for free.

 

[QuyLe]

Once I have a good understanding of what is wrong with the website I reach out to the freelancer .

Can i ask for the place you hire freelancer?

 

[Copax]

Can i ask for the place you hire freelancer?

I used PeoplePerHour (ideal for for UK mainly), however I also like UpWork.

 

[mogambo]

Damn I can't get to download Accunetix. It would be great if someone can share it here.

 

[Nullium]

Awesome, thank you for the elaboration! Very good method... I'm glad to see the Making Money section with intelligent ideas again!

 

[outsourcethis]

Ya I know I'm a new guy here but wanted to comment on this idea, which is not new and has been around for years. As a freelancer and Cybersecurity guy for the last 22 years, 15 of which as a pentester, this has some pitfalls not being discussed. You will find many of the ISP/webhosting companies will not take kindly to their infrastructure being scanned. Remember those ecommerce sites are sitting behind someones firewall, IDS/P, router, switches, on their servers. This happens with some of those cheap hosting providers.... Just something to think about.

Using more then one tool is also a good Idea Acunetix is good but does get things wrong and its always good to check with other tools. Many of which are free but have at least two to verify results.

Sometime its best to ask permission first before scanning someone's site. Shows a little more professionalism and can lead to more business. Remember after you scan the site and find problems someone will need to scan the site after those vulnerabilities are fixed. This could bring more business to you.

There is also the fly by night issue. Website is 4 days old and you want to charge some company $$$ for scanning their site. Without a reputation or consulting resuming behind you they may not be to accepting of you scanning their site. This can lead to your ISP being alerted to your activity. AT&T for example might limit your internet connection if they believe you are doing some sort of hacking/malicious scanning/activity. This happened to me couple years ago I had to contact the main AT&T security division and explanation what I did for a living. My connection was then unblocked.

I'm not saying these things will happen to you just my two cents from over the years...

 

[achfire]

great stuff man;

 

[Nderdog]

Awesome method. Just wondering how you handle the payments? Do you found an actual company? I imagine it's not trustworthy otherwise..

 

[kriwil]

surely will try this awesome method

 

[Vic Sage]

The method like this is being done via cold calling home it come such a harassment method in the uk it know on top on radar of top dog series for crooks.

also you can not send email to a company hassing them in this way it illegal
and un professional

earning money on lies is not in my eyes real internet marketing
my opionion sorry.

Well written but keep me out, i got morals

Mobile advertisers are doing this thing to promote antivirus apps all the time, if designed correctly, brings in crazy conversion.

I completely agree with you though, money without morals are blood money. That's why I stayed out of porn marketing/PPI promoting silent install apps from the very beginning.

 

[TI3GR]

Bookmarking this Awesome Guide!

 

[masterpuppet]

It says "3 307 458 estimated number of requests for current scan will complete in more than 63,74 days" (just 1 website)! What do I do with that?

 

[qazer101]

Looks like a great idea, I'll be giving it a go later this week and will report with my results. Quick question though, have you had any angry replies to your emails? If so how did you deal with them?

Thanks!

 

[mulcahy43]

Thanks for this amazing thread! I have set up a pretty good system for it.

I only have one question.

What kind of landing page did you use for your domain. What did it (in general) contain and show potential clients? Thanks again!!

 

[cooltoad125]

Looks like a great idea, I'll be giving it a go later this week and will report with my results. Quick question though, have you had any angry replies to your emails? If so how did you deal with them?

Thanks!

I would like to the know the answer to this question too.
Please do share your results with us. It will motivate many us to do the same.

 

[qazer101]

Any update OP? Also are there any alternatives for Accunetix that are good? I'm a bit worried about profiting off a torrented $10k software.

 

[Boriss]

WPScan for linux.

 

[freebird101]

Hi. Major cred to you for sharing man. I'm a newb and been wondering what i should start with. I think I'm gonna start with this one.

One question though. What payment method do you use, and do you treat this as a company or just freelance under-the-table style?

 

[Makaveli the Don]

The thing is, if they pay upfront and then you say it's a "false flag", do they want their money back? Because that would sound like a scammer.

-"Hey, you have problem, I can fix it"
-"Ok here is $250"
-"Oh wait, it is actually a false flag...heh...it doesn't really need a fix...heh..."

You get it?

 

[kboxer7]

Be careful with pen-testing without prior written consent from the site owner. You may actually break some computer abuse laws depending on the country, and as mentioned, at the very least piss of the server company hosting the site. Both of which are not good situations.

Ideally you'd want to give away free scans after first obtaining legal consent from the site owner to do so, and after they notify their host provider that they will be running some tests. Otherwise a solid business model.

Regards,