What is Website Penetration Testing ?

A web application penetration test aims to identify security issues resulting from vulnerabilities in the design, coding and publishing of software or a website.

This can include:

•    Testing user authentication to verify that accounts cannot compromise data;
•    Assessing the web applications for flaws and vulnerabilities, such as XSS (cross-site scripting);
•    Confirming the secure configuration of web browsers and identifying features that can cause vulnerabilities; and
•    Safeguarding web server security and database server security.

The vulnerabilities are presented in a format that allows an organisation to assess their relative business risk and the cost of remediation. These can then be resolved in line with the application owner’s budget and risk appetite, inducing a proportionate response to cyber risks.

We take a first principals approach to application vulnerability detection, and therefore we are not bound to any platform or signature database.

Rather than use a database of static signatures, we approach each test in the same way a hacker or penetration tester would and apply a testing methodology. The vast majority of application security flaws, such as SQL Injection and Cross-Site Scripting arise from insecure processing of input supplied by the client. We adopt a first principals approach when testing each input by examining the original expected value and the servers response when the value is modified. By adopting this methodology, we are able to determine how data may be being processed by the server and can then dynamically evolve each test to identify vulnerabilities. This approach results in more accurate testing and allows us to identify security flaws that may be masked by security filters and Intrusion Prevention Systems (IPS), but could still be exploited by a real-world attacker.

Open source intelligence gathering

Temporary components such as micro-sites and marketing landing pages can become forgotten and unmaintained. These no-longer linked components may hide a critical security flaw and therefore it is important we test every component an attacker may target. We query search engines such as Google and other online indexing services to gather a list of URLS both past and present to factor into the attack discovery phase.

Key Features...