Web Application Penetration Testing Services

Web Application Penetration Testing Information Gathering

Perform information gathering/reconnaissance piece to identify the application’s primary purpose and logic. Our pen testers will navigate the web application as a normal user and employ enumeration techniques to create a blueprint of the application that will be used during the next stages. The pen test will attempt to find out information regarding a target in a completely passive manner. This will help us understand the full framework of the application and allow us to tailor our testing methods to your particular deployment.

Identity Management Testing

Usually, we will test web applications from various roles, such as standard user, un-authenticated user and administrator. This will also form part of the authorisation testing, but can also include the testing of the actual provisioning process. Do you have a standardised username assignment policy, is it easy to guess usernames?

Authentication Testing

Authentication methods are used to verify something or someone are indeed authentic. Authenticating a person or object validates their identity. These have many forms, however, a common example is that of a login process such as via a web form or application popup.

Common web application penetration testing parameters utilised are examining how credentials are transported over the wire, are they encrypted, is the transport mechanism self-encrypted? Can the credentials be easily extracted or un-encrypted? Is it possible to bypass the authentication process entirely? Is there a suitable lockout process for failed attempts? These are just a few examples of our extensive application pen testing. We will attempt to uncover any potential weakness in your whole application authentication schema.

Authorisation Testing

Once a user is verified via authentication, what can that user or indeed object or service gain access to?

We will attempt to break out of the given authorisation profile and view content or web application features that should not be enabled for the particular posture we are testing. This could include direct file access testing or full authorisation schema bypass.

We will also attempt privilege escalation, i.e turn our standard account into an admin account.

Session Management Testing

Just as important as authentication and authorisation, web application penetration testing will determine how secure your authenticated and authorised session management is.

Is it possible for a malicious non-authorised user to hijack an authenticated or authorised session.

Our security experts will attempt a full bypass, test the use of cookies as session management objects, check for cross-site request forgery and other session scheme bypass techniques.

Session timeouts and logout functionality will also be covered.

Input Validation Testing

When web applications are deployed, it’s a common need to collect data from the users of the system. This is performed utilising input fields.

Input fields, if not deployed correctly, can be used to pass direct code or commands to the underlying systems.

Our web application penetration testers will attempt the most widely talked about and still common exploits such as SQL injection, Cross-site scripting, HTTP parameter pollution and overflow testing, to name just a few.

Following the web application penetration test you will know if your input fields are robust and secure.

Testing For Weak Cryptography

Any cyphers SSL/TLS will be analysed against the latest recommended standards.

Is any sensitive information sent via unencrypted or weak encrypted channels?

Testing For Error Handling

Our security professionals examine how your web application displays errors or handles incorrect input.

Does the application give away sensitive information about the underlying platform upon error?

Client-Side Testing

In this part of the web application penetration testing, we are looking at the functionality and various building blocks that make up the overall application.

We will check if the application is vulnerable to Cross-Site Scripting, HTML Injection, ClickJacking. Our pen testing service will ensure the JavaScript execution is secure including a number of other exploitable conditions.

Report/Analysis, client walkthrough.

Our security experts will complete a comprehensive report that will detail the technical issues and explain the impact these have on your organisation. The report is tailored to two audience types, technical and senior executives. It’s important that both of these audiences clearly understand the business impact caused by the vulnerabilities identified. This enables you to prioritise the mitigation steps to reduce the greatest impact on the organisation fist.

Unlike other providers, DigitalXRAID understands that a report can sometimes be overbearing so we will ensure our customers receive a full handover with the report, ensuring every part is explained and the business impact of each issue found is fully understood.