You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed to find interesting data, such as files with usernames and passwords. You find a hidden folder that has the administrator’s bank account password and login information for the administrator’s bitcoin account. What should you do?

Do not report it immediately, continue the penetration test, and add it to the report submitted when testing is complete

Do not transfer the money but steal the bitcoins

Report immediately to the administrator

Transfer money from the administrator’s account to another account

Explanation

Any personal information should be reported immediately following the initial findings of the test, but the penetration test should continue and a more complete report should be given before sounding alarms. Alarming the target without a more complete picture of the vulnerability status is professionally irresponsible. Report immediately to the administrator and Report individual vulnerabilities immediately are same thing.