Web Application Penetration Testing
Web applications have become common targets for attackers. Attackers can leverage relatively simple vulnerabilities to gain access to confidential information, frequently containing personally identifiable information.
What is Web Application Penetration Testing?
Web application penetration testing is the process of using penetration testing techniques on a web application to detect its vulnerabilities.
It is similar to a penetration test and aims to break into the web application using any penetration attacks or threats.
Web application penetration testing works by using manual or automated penetration tests to identify any vulnerability, security flaws or threats in a web application. The tests involve using/implementing any of the known malicious penetration attacks on the application. The penetration tester exhibits/fabricates attacks and environment from an attacker’s perspective, such as using SQL injection tests. The web application penetration testing key outcome is to identify security weakness across the entire web application and its components (source code, database, back-end network). It also helps in prioritizing the identified vulnerabilities and threats, and possible ways to mitigate them.
Why do you need to test Web Applications?
- A web application is any program that can be accessed through a web server, such as online banking portals, websites managed by CMS, e-commerce websites, etc. As web applications often provide access to sensitive data this makes them high value target for attackers.
- Internet-based applications are globally accessible, making them easily probed.
- If you are going to be attacked, the most common vector is your web application.
What you gain from this testing
- By conducting a penetration test, you’ll receive a thorough understanding of the business risks posed by your web applications.
- Detailed knowledge about the security posture of your web applications.
- A comprehensive report showing the real and likely attacks that relate to your application.
- This report details the priority order for security improvements, outlining how to increase the security of your web applications.
- Enhanced protection of your business intelligence, data and IT systems, brand and reputation.
Falconer Security's Approach
Falconer Security performs full unauthenticated and authenticated testing based on strict OWASP guidelines. Our engineers focus on identifying weak points across the entire web application to ensure your applications and data stay safe. Testing activities include hunting OWASP Top 10 Vulnerabilities, website mapping and enumeration, testing for injection attacks (SQL, JavaScript, LDAP, etc.), testing for remote code execution, malicious file upload abuse testing, and more.
All testing performed follows the OWASP v4 guidelines and checklist.
Our Methodology
All testing performed is based on the NIST SP 800-115 Technical Guide to Information Security Testing and Assessment, OWASP Testing Guide (v4), and customized testing frameworks.
• Planning – Customer goals are gathered and rules of engagement obtained.
• Discovery – Perform scanning and enumeration to identify potential vulnerabilities, weak areas, and exploits.
• Attack – Confirm potential vulnerabilities through exploitation and perform additional discovery upon new access.
• Reporting – Document all found vulnerabilities and exploits, failed attempts, and company strengths and weaknesses.
Tools Used
• Burp Suite Pro
• Nessus Vulnerability Scanner
• nmap
• Nikto
• Dirbuster / Dirb / Dirsearch
• sqlmap
• BeEF
• Metasploit
• Qualys SSL Scanner
• BuiltWith / whatweb
All of the above-mentioned tools will be used by professional ethical hackers who have a unique understanding of security.
What You Will Get:
