Web Site & Application Vulnerability Testing

Introduction

Today’s battleground is the application. Whether it is hostile Internet users going after your Web site or a rogue employee abusing an internal application, ensuring that your applications are secure requires vigilance. Most organizations adopt a proactive approach; they know they are better off finding and fixing exposures before they are exploited.

Generally, application vulnerability testing is intended to answer clear business questions. The specific testing service you choose depends on which of these questions you care about and whether the application is internal or outward facing.

• Is the web site reasonably secure as configured and deployed?
• Are there readily found exposures that an intruder could take advantage of without having to log in?
• Can an unauthorized rogue user access data intended only for authorized users?
• Can an authorized user perform inappropriate actions on his own account?
• Can a user obtain any information about the accounts of other users?
• Can a user perform any actions on the accounts of other users?

Application Vulnerability Test & Web Application Vulnerability Test

An Application Vulnerability Test (AVT) or a Web Application Vulnerability Test (Web AVT) is the most thorough application testing that SystemExperts performs. The only difference in methodology between an AVT and Web AVT is that a Web AVT is conducted remotely against a web site from the Internet where as an AVT is typically conducted on-site.

A small team of consultants spends an agreed upon amount of time (typically ten consulting days, but sometimes 3 days or 5 days depending on budget constraints and site complexity) assessing the platform associated with the customer's application as a skillful attacker and documenting their findings and recommendations. During the analysis, the consultants look to exploit deficiencies in the application or web pages themselves, to escalate privileges, access other network systems or services, or identify instances where customer-private data may be exposed.

We test two primary scenarios: as a determined intruder with no credentials and as a legitimate authenticated user with a valid User ID and password.

During this testing, the consultants focus on finding exposures in the web or application server and the application: they look for weaknesses, technical flaws, or vulnerabilities. The consultants access the services using standard web mechanisms (such as a browser, browser proxy, and generating standard HTTP requests) or thick client technologies and try to determine whether the application properly limits their activities or whether they can inappropriately escalate their capabilities.

The objective of the analysis is to develop a general sense of the level of security exposure and risk in the web infrastructure and web application. Most problems discovered can be attributed to poor configuration of the web server, weak authentication, authorization, or access control mechanisms, improper session management, insufficient input validation, or general business logic flaws.

At the conclusion of the testing portion of the project, SystemExperts prepares a concise AVT or Web AVT report (approximately 10-12 pages) that outlines our findings and recommendations.

Web Site Review

SystemExperts offers a Web Site Review (WSR) as an alternative to a full blown Web AVT. It is a simpler, lower cost option appropriate for sites that do not require user authentication or where budget constraints put the more thorough Web AVT out of reach.

The objective of the WSR is to develop a general sense of the level of security exposure and risk in the web front-end infrastructure and associated web application.

One SystemExperts consultant spends an agreed upon amount of time (typically three consulting days) assessing the designated web site as a skillful attacker on the Internet and documenting his findings and recommendations.

During the WSR the consultant evaluates the web site and its content without any login credentials, accessing the site from the Internet, with no prior information about the web host or web server. He performs this work using public domain and custom tools, and spends some time manually reviewing the site attempting to identify possible exposures or vulnerabilities. He then validates the results and documents the findings.

At the conclusion of the project, the consultant prepares a concise WSR letter-style report (approximately 1-3 pages) that outlines our findings and recommendations.

Learn more about Website and Application Vulnerability Testing. View our Technical Tutorials online.

Free Consultations on Web Site & Application Vulnerability Testing

Contact SystemExperts to learn more about our web site and application vulnerability testing services and to receive your free consultation.