https://vijilan.com/assets/PentestScoping-VjExk1s1.js

1import{r as l,j as e}from"./react-vendor-DrGzqrnz.js";import{S as ue,b as ge}from"./Seo-Do1ZBOua.js";import{R as D}from"./Reveal-C8E4OVfr.js";import{S as f}from"./SectionHeader-GQyNHTtY.js";import{N as je}from"./navisec-mark-Ct_wQEzE.js";import{t as _,s as Ne}from"./index-BOFQHVFW.js";import{i as be}from"./freeEmailDomains-CPWVIHU4.js";import{S as H,C as M,a as O}from"./layout-DD0v7MF6.js";import{F as ve,C as ye,A as q,a as fe,T as G,P as U}from"./lucide-Bw0On9Ex.js";import{L as J}from"./router-CU-PWdLv.js";import"./brandTitle-Bkl8JyE8.js";import"./framer-DfUSSQP-.js";import"./radix-D9JVX4kL.js";import"./sentry-psh_Yu-q.js";const we=["VMware","VirtualBox","Hyper-V","Azure","AWS","GCP"],Y=["Yes","No","Not sure"],K=()=>({name:"",subnet:"",hosts:""}),Q=()=>({name:"",pages:"",roles:"",access:"",content:"",api:"",endpoints:"",staging:"",payments:"",uploads:"",sourceReview:"",loc:""}),i="w-full rounded-lg border border-white/10 bg-white/[0.03] px-3 py-2 text-[15px] text-white/90 outline-none placeholder:text-white/25 focus:border-cyan-400/50",n="block text-[13px] font-medium text-white/70";function c({name:m,value:h,options:x,onChange:I}){return e.jsx("div",{className:"flex flex-wrap gap-1.5",children:x.map(d=>e.jsx("button",{type:"button","aria-pressed":h===d,onClick:()=>I(h===d?"":d),className:`rounded-lg border px-3 py-1.5 text-[13px] transition-colors ${h===d?"border-cyan-400/60 bg-cyan-400/15 text-cyan-100":"border-white/10 text-white/60 hover:border-white/25 hover:text-white/80"}`,children:d},d))})}function ze(){const[m,h]=l.useState(""),[x,I]=l.useState(""),[d,X]=l.useState(""),[F,Z]=l.useState(""),[w,ee]=l.useState(""),[C,se]=l.useState(""),[u,g]=l.useState([K()]),[k,ae]=l.useState(""),[j,te]=l.useState(""),[V,ne]=l.useState(""),[S,le]=l.useState(""),[A,ie]=l.useState(""),[N,re]=l.useState([]),[$,oe]=l.useState(""),[b,E]=l.useState([Q()]),[P,ce]=l.useState(""),[W,de]=l.useState(""),[z,L]=l.useState(!1),[pe,me]=l.useState(!1),[B,R]=l.useState(null),T=l.useMemo(()=>[{id:"sc-you",label:"You",done:!!(d||x||m)},{id:"sc-external",label:"External",done:!!(w||C)},{id:"sc-internal",label:"Internal",done:!!(k||j||S||A||$||N.length||u.some(s=>s.name||s.subnet||s.hosts))},{id:"sc-apps",label:"Web apps",done:b.some(s=>s.name)},{id:"sc-retest",label:"Retest",done:!!P}],[d,x,m,w,C,k,j,S,A,$,N,u,b,P]),v=T.filter(s=>s.done).length;function xe(s){re(a=>a.includes(s)?a.filter(t=>t!==s):[...a,s])}function o(s,a){E(t=>t.map((p,r)=>r===s?{...p,...a}:p))}async function he(s){if(s.preventDefault(),R(null),!m.trim()){R("We need an email address to send the scoping call invite to.");return}if(be(m)){R("Please use your work email so we can route this to the right engineer.");return}L(!0);const a=await Ne({type:"contact",name:x||void 0,email:m,company:d||void 0,website:F,message:`Pen-test scoping checklist submitted. ${v} of 11 sections answered.`,meta:{intent:"pentest_scoping",source:"pentest_scoping_form",workEmailOnly:!0,scoping:{external:{liveIps:w||null,domains:C||null},internal:{vlans:u.filter(t=>t.name||t.subnet||t.hosts),routable:k||null,edr:j||null,edrProduct:V||null,ipsIds:S||null,otScadaIcs:A||null,hypervisors:N,changeWindows:$||null},webApps:b.filter(t=>t.name),retestWithin90Days:P||null,notes:W||null}}});if(L(!1),!a.ok){R(a.error);return}_("pentest-scoping-submitted"),me(!0)}return e.jsxs(e.Fragment,{children:[e.jsx(ue,{path:"/penetration-testing/scoping",title:"Penetration test scoping checklist",description:"The questions a penetration test scoping call will ask, answerable in the browser. Ten minutes of prep saves a week of back and forth. Answer what you know and leave the rest.",breadcrumbs:[{name:"Penetration testing",path:"/penetration-testing"},{name:"Scoping checklist",path:"/penetration-testing/scoping"}],jsonLd:[ge([{name:"Penetration testing",path:"/penetration-testing"}])]}),e.jsx(H,{space:"major",children:e.jsx(M,{size:"4xl",children:e.jsxs(D,{children:[e.jsx("span",{className:"chip",children:"Scoping"}),e.jsxs("h1",{className:"mt-6 text-4xl font-semibold tracking-tight sm:text-5xl",children:["Get ready for your",e.jsx("span",{className:"block text-cyan-gradient",children:"scoping call."})]}),e.jsx("p",{className:"mt-6 max-w-2xl text-lg leading-relaxed text-white/65",children:"Ten minutes of prep saves a week of back and forth. Answer what you can. Anything you are unsure of, leave blank and we will c

1over it together on the call."}),e.jsxs("p",{className:"mt-4 flex flex-wrap items-center gap-x-4 gap-y-2 text-[14px] text-white/45",children:[e.jsxs("span",{className:"inline-flex items-center gap-2",children:["Testing delivered with ",e.jsx(je,{className:"h-3.5"}),", a Vijilan Elite Partner."]}),e.jsxs("a",{href:"/downloads/vijilan-pentest-scoping-checklist.pdf",target:"_blank",rel:"noreferrer",onClick:()=>_("pentest-scoping-pdf"),className:"inline-flex items-center gap-1.5 text-cyan-300 hover:text-cyan-200",children:[e.jsx(ve,{size:14,"aria-hidden":!0})," Prefer paper? Get the PDF"]})]})]})})}),e.jsx(H,{divider:!0,space:"roomy",children:e.jsx(M,{size:"4xl",children:pe?e.jsx(D,{children:e.jsxs(O,{pad:"xl",full:!0,children:[e.jsx(ye,{className:"h-8 w-8 text-emerald-300","aria-hidden":!0}),e.jsx("h2",{className:"mt-4 text-2xl font-semibold tracking-tight",children:"That is with us."}),e.jsx("p",{className:"mt-3 max-w-xl text-[15px] leading-relaxed text-white/65",children:"An engineer reads it before anyone calls you, so the scoping conversation starts from what you have told us rather than from the beginning. If something was left blank, that is what the call is for."}),e.jsxs("div",{className:"mt-6 flex flex-wrap gap-3",children:[e.jsx(J,{to:"/penetration-testing",className:"btn-ghost inline-flex items-center gap-2 rounded-xl px-5 py-2.5 text-sm font-semibold",children:"Back to offensive security"}),e.jsxs(J,{to:"/contact",className:"btn-primary inline-flex items-center gap-2 rounded-xl px-5 py-2.5 text-sm font-semibold",children:["Book the call now ",e.jsx(q,{size:15})]})]})]})}):e.jsxs("form",{onSubmit:he,className:"space-y-10",children:[e.jsx("input",{type:"text",value:F,onChange:s=>Z(s.target.value),name:"website",tabIndex:-1,autoComplete:"off","aria-hidden":"true",className:"absolute left-[-9999px] h-0 w-0 opacity-0"}),e.jsxs("nav",{"aria-label":"Scoping progress",className:"sticky top-16 z-20 -mx-2 mb-2 flex flex-wrap items-center gap-1.5 rounded-xl border border-white/10 bg-ink-900/85 px-2.5 py-2 backdrop-blur",children:[e.jsxs("span",{className:"mr-1 font-mono text-[10.5px] uppercase tracking-[0.16em] text-white/40",children:[e.jsx("span",{className:"num-tick",children:v})," of ",e.jsx("span",{className:"num-tick",children:T.length})]}),T.map(s=>e.jsxs("a",{href:`#${s.id}`,className:s.done?"inline-flex items-center gap-1 rounded-lg border border-cyan-400/40 bg-cyan-400/10 px-2 py-1 text-[12px] text-cyan-200":"inline-flex items-center gap-1 rounded-lg border border-white/10 px-2 py-1 text-[12px] text-white/50 hover:border-white/25 hover:text-white/80",children:[s.done&&e.jsx(fe,{size:11,"aria-hidden":!0}),s.label]},s.id)),e.jsx("span",{className:"ml-auto pr-1 text-[11.5px] text-white/35",children:"Only the email is required"})]}),e.jsxs("div",{id:"sc-you",className:"scroll-mt-28",children:[e.jsx(f,{eyebrow:"You",title:"Who we are",italic:"talking to."}),e.jsxs("div",{className:"mt-6 grid gap-4 sm:grid-cols-3",children:[e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-company",children:"Company"}),e.jsx("input",{id:"sc-company",className:i,value:d,onChange:s=>X(s.target.value)})]}),e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-name",children:"Your name"}),e.jsx("input",{id:"sc-name",className:i,value:x,onChange:s=>I(s.target.value)})]}),e.jsxs("div",{className:"space-y-1.5",children:[e.jsxs("label",{className:n,htmlFor:"sc-email",children:["Work email ",e.jsx("span",{className:"text-cyan-300/80",children:"required"})]}),e.jsx("input",{id:"sc-email",type:"email",className:i,value:m,onChange:s=>h(s.target.value)})]})]})]}),e.jsxs("div",{id:"sc-external",className:"scroll-mt-28",children:[e.jsx(f,{eyebrow:"1 · Network",title:"External",italic:"attack surface."}),e.jsxs("div",{className:"mt-6 grid gap-4 sm:grid-cols-2",children:[e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-ips",children:"Number of live external IP addresses"}),e.jsx("input",{id:"sc-ips",className:i,value:w,onChange:s=>ee(s.target.value),placeholder:"e.g. 24, or an estimate"})]}),e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-domains",children:"Number of domains"}),e.jsx("input",{id:"sc-domains",className:i,value:C,onChange:s=>se(s.target.value)})]})]})]}),e.jsxs("div",{id:"sc-internal",className:"scroll-mt-28",children:[e.jsx(f,{eyebrow:"2 · Network",title:"Internal",italic:"estate."}),e.jsxs("div",{className:"mt-6 space-y-3",children:[u.map((s,a)=>e.jsxs("div",{className:"grid gap-3 sm:grid-cols-[1fr_1fr_140px_auto]",children:[e.jsx("input",{"aria-label":`VLAN ${a+1} name and function`,className:i,placeholder:"VLAN and its function",value:s.name,onChange:t=>g(p=>p.map((r,y)=>y===a?{...r,name:t.target.value}:r))}),e.jsx("input",{"aria-label":`VLAN ${a+1} subnet`,className:i,placeholder:"Subnet",value:s.subnet,onChange:t=>g(p=>p.map((r,y)=>y===a?{...r,subnet:t.target.value}:r))}),e.jsx("input",{"aria-label":`VLAN ${a+1} estimated live hosts`,className:i,placeholder:"Est. live hosts",value:s.hosts,onChange:t=>g(p=>p.map((r,y)=>y===a?{...r,hosts:t.target.value}:r))}),u.length>1&&e.jsx("button",{type:"button",onClick:()=>g(t=>t.filter((p,r)=>r!==a)),className:"inline-flex items-center justify-center rounded-lg border border-white/10 px-3 text-white/50 hover:border-red-400/40 hover:text-red-200","aria-label":`Remove VLAN ${a+1}`,children:e.jsx(G,{size:15,"aria-hidden":!0})})]},a)),e.jsxs("button",{type:"button",onClick:()=>g(s=>[...s,K()]),className:"inline-flex items-center gap-1.5 text-[13px] text-cyan-300 hover:text-cyan-200",children:[e.jsx(U,{size:14,"aria-hidden":!0})," Add another VLAN"]})]}),e.jsxs("div",{className:"mt-8 grid gap-6 sm:grid-cols-2",children:[e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Are your VLANs routable from one location?"}),e.jsx(c,{name:"routable",value:k,options:["Yes","No, segmented","Not sure"],onChange:ae})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Is EDR in place?"}),e.jsx(c,{name:"edr",value:j,options:Y,onChange:te}),j==="Yes"&&e.jsx("input",{className:`${i} mt-2`,placeholder:"Which product?",value:V,onChange:s=>ne(s.target.value),"aria-label":"Which EDR product"})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Is IPS or IDS in place?"}),e.jsx(c,{name:"ips",value:S,options:Y,onChange:le})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Any OT, SCADA or ICS systems?"}),e.jsx(c,{name:"ot",value:A,options:Y,onChange:ie}),e.jsx("p",{className:"text-[12.5px] leading-relaxed text-white/40",children:"These are excluded from testing and listed as out of scope."})]})]}),e.jsxs("div",{className:"mt-8 space-y-2",children:[e.jsx("span",{className:n,children:"Where can we run a small virtual appli

1ance?"}),e.jsx("div",{className:"flex flex-wrap gap-1.5",children:we.map(s=>e.jsx("button",{type:"button","aria-pressed":N.includes(s),onClick:()=>xe(s),className:`rounded-lg border px-3 py-1.5 text-[13px] transition-colors ${N.includes(s)?"border-cyan-400/60 bg-cyan-400/15 text-cyan-100":"border-white/10 text-white/60 hover:border-white/25 hover:text-white/80"}`,children:s},s))}),e.jsx("p",{className:"text-[12.5px] leading-relaxed text-white/40",children:"Your IT team receives the exact network requirements for the appliance during onboarding."})]}),e.jsxs("div",{className:"mt-8 space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-windows",children:"Change-control timelines or blackout windows we should know about"}),e.jsx("textarea",{id:"sc-windows",rows:2,className:i,value:$,onChange:s=>oe(s.target.value)})]})]}),e.jsxs("div",{id:"sc-apps",className:"scroll-mt-28",children:[e.jsx(f,{eyebrow:"3 · Applications",title:"Web apps",italic:"in scope."}),e.jsxs("div",{className:"mt-6 space-y-5",children:[b.map((s,a)=>e.jsxs(O,{pad:"md",full:!0,children:[e.jsxs("div",{className:"flex items-center justify-between gap-3",children:[e.jsxs("h3",{className:"text-[15px] font-semibold text-white/85",children:["Application ",a+1]}),b.length>1&&e.jsxs("button",{type:"button",onClick:()=>E(t=>t.filter((p,r)=>r!==a)),className:"inline-flex items-center gap-1 text-[13px] text-white/45 hover:text-red-200",children:[e.jsx(G,{size:14,"aria-hidden":!0})," Remove"]})]}),e.jsxs("div",{className:"mt-4 grid gap-4 sm:grid-cols-3",children:[e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:`app-${a}-name`,children:"Application name"}),e.jsx("input",{id:`app-${a}-name`,className:i,value:s.name,onChange:t=>o(a,{name:t.target.value})})]}),e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:`app-${a}-pages`,children:"Approx. pages"}),e.jsx("input",{id:`app-${a}-pages`,className:i,value:s.pages,onChange:t=>o(a,{pages:t.target.value})})]}),e.jsxs("div",{className:"space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:`app-${a}-roles`,children:"Number of user roles"}),e.jsx("input",{id:`app-${a}-roles`,className:i,value:s.roles,onChange:t=>o(a,{roles:t.target.value})})]})]}),e.jsxs("div",{className:"mt-5 grid gap-5 sm:grid-cols-2",children:[e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Access"}),e.jsx(c,{name:`acc-${a}`,value:s.access,options:["Authenticated","Unauthenticated"],onChange:t=>o(a,{access:t})})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Content"}),e.jsx(c,{name:`con-${a}`,value:s.content,options:["Mostly dynamic","Mostly static","Both"],onChange:t=>o(a,{content:t})})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Uses an API?"}),e.jsx(c,{name:`api-${a}`,value:s.api,options:["Yes","No"],onChange:t=>o(a,{api:t})}),s.api==="Yes"&&e.jsx("input",{className:`${i} mt-2`,placeholder:"Roughly how many endpoints?",value:s.endpoints,onChange:t=>o(a,{endpoints:t.target.value}),"aria-label":"API endpoint count"})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Staging access?"}),e.jsx(c,{name:`stg-${a}`,value:s.staging,options:["Yes","No"],onChange:t=>o(a,{staging:t})})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Takes payments?"}),e.jsx(c,{name:`pay-${a}`,value:s.payments,options:["Yes","No"],onChange:t=>o(a,{payments:t})})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"File or document uploads?"}),e.jsx(c,{name:`upl-${a}`,value:s.uploads,options:["Yes","No"],onChange:t=>o(a,{uploads:t})})]}),e.jsxs("div",{className:"space-y-2",children:[e.jsx("span",{className:n,children:"Source code review wanted?"}),e.jsx(c,{name:`src-${a}`,value:s.sourceReview,options:["Yes","No"],onChange:t=>o(a,{sourceReview:t})}),s.sourceReview==="Yes"&&e.jsx("input",{className:`${i} mt-2`,placeholder:"Projects, integrations, approx. lines of code",value:s.loc,onChange:t=>o(a,{loc:t.target.value}),"aria-label":"Source review scale"})]})]})]},a)),e.jsxs("button",{type:"button",onClick:()=>E(s=>[...s,Q()]),className:"inline-flex items-center gap-1.5 text-[13px] text-cyan-300 hover:text-cyan-200",children:[e.jsx(U,{size:14,"aria-hidden":!0})," Add another application"]})]})]}),e.jsxs("div",{id:"sc-retest",className:"scroll-mt-28",children:[e.jsx(f,{eyebrow:"4 · Retesting",title:"The free",italic:"90-day retest."}),e.jsxs("div",{className:"mt-6 space-y-2",children:[e.jsx("span",{className:n,children:"Planning to use the free retest within 90 days?"}),e.jsx(c,{name:"retest",value:P,options:["Yes","No","Undecided"],onChange:ce}),e.jsx("p",{className:"max-w-2xl text-[12.5px] leading-relaxed text-white/40",children:"The free retest covers all identified findings, retested at once, when scheduled within 90 days of report delivery. Retests after 90 days, or done a few findings at a time, are billed."})]}),e.jsxs("div",{className:"mt-8 space-y-1.5",children:[e.jsx("label",{className:n,htmlFor:"sc-notes",children:"Anything else we should know"}),e.jsx("textarea",{id:"sc-notes",rows:3,className:i,value:W,onChange:s=>de(s.target.value)})]})]}),B&&e.jsx("p",{role:"alert",className:"rounded-lg border border-red-400/30 bg-red-400/10 px-4 py-3 text-[14px] text-red-100",children:B}),e.jsxs("div",{className:"flex flex-wrap items-center gap-4 border-t border-white/10 pt-6",children:[e.jsxs("button",{type:"submit",disabled:z,className:"btn-primary inline-flex items-center gap-2 rounded-xl px-6 py-3 text-base font-semibold disabled:opacity-60",children:[z?"Sending…":"Send it over"," ",e.jsx(q,{size:16,"aria-hidden":!0})]}),e.jsx("p",{className:"text-[13px] text-white/45",children:v===0?"You can send this with only an email address. Blanks are what the call is for.":`${v} section${v===1?"":"s"} answered. Blanks are fine.`})]})]})})})]})}export{ze as default};