Description

A Web Application Penetration Test is the simulation of an attacker against a website, portal or web application. Initially the testing consists in identifying all the resources exposed on the target.

At the same time the auditor will perform a business logic analysis to verify that there are no conceptual problems impacting security.

At this point, before testing the actual web application, the infrastructure is checked to look for known and unknown vulnerabilities.

Once some valid attack points are spotted (entry points) we can proceed with the actual hack attempt. The goal is an extensive endangerment, as much deep and vast as possible.

Afterwards, both manually and with the help of tools, each parameter is tested with defined attack vectors. Generic attack techniques for the given platform will also be executed.

If some sort of access is obtained we will perform normally unauthorized and unexpected actions, but still inoffensive for the system and application. This is in order to create an evidence of exploitability. An action could be to dump data from a backend database or access files and sources from the disk. With proper authorization can extend the scope of the test and modify information or obtain the full control of the machine and adjacent ones.

Output

The Report is a simple and detailed document that summarizes the results of the activity and it is divided in three different areas, as described previously:

Executive Summary
It is placed at the beginning of the Report and it is no longer than one page. It consists in a non-technical overview, destined to Management.

Vulnerability Details
It consists in a technical part describing the discovered vulnerabilities and their impact in detail. It is dedicated to the Security Manager.

Remediation Plan
A technical section with detailed and precise instructions on how to resolve the identified problems. Dedicated to the Developers.