A penetration tester discovers a critical Remote Code Execution vulnerability during business hours. Per the Rules of Engagement, all critical findings must be immediately reported. What should the tester do?
-
A
Continue testing to find more vulnerabilities before reporting
-
B
Immediately notify the client's designated contact per the agreed escalation procedure
-
C
Post the finding to the final report and wait until the engagement ends
-
D
Attempt to exploit the vulnerability further to demonstrate full impact