A municipal web app uses certificate pinning that breaks the tester’s TLS interception. What is the sound methodological response?
Select an answer to reveal the explanation.
Short Explanation
Pinning slamming the door on your proxy is a known roadblock, not a license to nuke PKI. Good testers note the limit, pick alternate in-scope methods, and stay inside the RoE. Breaking the city’s trust fabric to “win” interception is the wrong kind of creativity.
Full Explanation
Certificate pinning and similar TLS controls can prevent classic man-in-the-middle interception by testing proxies. Professional response is to document the limitation and shift to approved alternative techniques — such as instrumented clients, staging builds without pinning, or other RoE-approved methods — rather than destructive infrastructure changes. Ending without documenting the constraint also fails the engagement. Methodology adapts to interception limits without unauthorized unsafe workarounds.