WEB APPLICATION TESTING
Web applications are one of the most common types of software in use today. Due to their complexity and ubiquity, web applications represent a unique challenge to the security posture of any organisation. Modern web applications handle increasingly sensitive data, so it is important to ensure that they do not introduce significant risk to an organisation.
Nettitude has a large team of CREST certified penetration testers who specialise in web application penetration testing. The Nettitude penetration testing team is diverse and contains a wealth of experience in both security and software development.
Nettitude are highly capable of penetrating testing web applications, web services, APIs and more, across an extremely large range of technologies.
For rigorous assurance, Nettitude recommends testing applications using the methodology set forth in the Application Security Verification Standard (ASVS). This ensures appropriate depth and breadth of testing is achieved when assessing the security posture of your web application.
What Are The First Stages Of Web Application Testing?
Based on the individual organisation’s requirements, Nettitude will first formalise an appropriate testing strategy. Various levels of simulated attack are possible, each with their own points of merit. It is important, before technical delivery commences, to identify primary security concerns such that the overall security posture of the web application can be accurately evaluated.
Because of these factors, the very first step is to receive an in-depth consultation with a Nettitude web application penetration testing expert, so that a strategy appropriate to the goals of the engagement can be designed and proposed.
Technical Delivery
Both breadth and depth of findings must be achieved during most engagements. Consequently, Nettitude use a combination of manual and automated tools and techniques throughout each engagement. The toolsets used vary from well configured off the shelf software to custom made tools, depending on the task at hand.
Nettitude utilises a methodology that moves from initial discovery exercises through to in-depth exploitation:
- Reconnaissance and threat intelligence gathering
- Enumeration
- Vulnerability Discovery
- Exploitation
- Post Exploitation
Once the full attack surface of a web application has been mapped, Nettitude proceed to probe for vulnerabilities.
Design, implementation and operational vulnerabilities are all analysed and exploited in a standard web application penetration test. Nettitude go far beyond basic lists such as the OWASP Top 10 and ensure that all possible weaknesses are analysed.
Understanding each web applications functionality from an end users perspective is important to Nettitude and allows flaws to be uncovered that are often missed by others. Each engagement is unique and Nettitude ensures that priority is given to those flaws that directly affect the primary security concerns described by the client organisation, ahead of the test.
It is not uncommon for Nettitude to uncover methods of remote code execution and advanced data exfiltration, even in commercial off the shelf web applications. Nettitude specialise in identifying application attack chains; it is often the case that the overall impact of a series of flaws is greater than the sum of its parts.
Reporting And Output
It is important for each web application penetration test to result in clear and actionable output. Nettitude delivers a management report and a technical report at the end of each engagement. The management report is designed to be consumed by a business audience and describes the engagement in terms of risk. The technical report is typically a longer document that describes each of the findings in detail, along with appropriate remedial advice. These reports are subjected to a rigorous quality assurance process before final delivery.
At the request of the client ahead of the engagement, Nettitude can tailor the web application penetration testing output in a multitude of ways to meet organisation specific requirements.
Remedial Advice
Nettitude’s web application penetration testers all have robust programming ability and typically have professional developer backgrounds. This ensures that the advice given and the tests performed are useful and relevant.
Importantly, Nettitude are able to provide robust and actionable remedial advice for all levels of vulnerability. Nettitude understands that one of the most valuable portions of any engagement is the formulation of remedial and preventative strategy. Nettitude consultants are on hand, both during and after the engagement, to provide in depth guidance based on years of unique experience.
Debriefs And Beyond
Nettitude believe that it is important to ensure that full comprehension of the engagement has been achieved. All web application penetration testing engagements come with a debrief or ‘readout’ as standard. The reports will be delivered in advance of the debrief in order to give time for the organisation to digest the content and to formulate any questions or thoughts ahead of time.
Get a free quote