A web application penetration test is a controlled assessment that identifies and safely exploits vulnerabilities in your web apps using industry-standard tooling and well-documented techniques.
At Exe Security, we incorporate the OWASP Top Ten and Web Security Testing Guide into our testing workflow to ensure thorough coverage. We take your organisation’s unique context into account to tailor the test and the report to you. As a CREST accredited penetration testing provider, we will deliver your detailed report within 3 working days of the end of the test so that you can focus on what matters most – protecting your organisation.
Modern web applications face a sophisticated landscape of cyber threats. At Exe Security, we follow a rigorous, standardised methodology whenever we carry out an assessment. This helps to give us great coverage when identifying vulnerabilities that could lead to data breaches or service disruptions. While automated scans are a useful baseline, they consistently miss some of the most serious vulnerabilities.
We manually hunt for these complex issues, which include:
Web applications can be the primary gateway to your organisation’s – and your customers’ – data. A penetration test provides a proactive “attacker’s eye view” of your security posture, allowing you to take the necessary steps to protect your intellectual property and client data. Testing with Exe Security will provide you with:
Ready to secure your web applications? Partner with Exe Security, a CREST accredited provider. Get in touch today to discuss your testing requirements.
Exe Security follows a CREST approved security testing methodology that outlines a systematic approach to assessing the security posture of a system/ service by simulating real world attacks. Our methodology has been based upon the NIST Special Publication 800-115, the Penetration Testing Execution Standard (PTES), the OWASP Security Testing Guidelines and Verification Standards, and best practices from the National Cyber Security Centre (NCSC).
The first significant step for any engagement is deciding exactly what is going to be tested. We will work with you to understand your requirements, and what needs to be done to meet those requirements. For a web application we need to consider more than just the website itself and will look to get information about where the web application is hosted, does it have any other servers or services it communicates with and who owns those, amongst other things.
All of this will give us a clearer picture of what needs to be included within the scope for testing to make sure that everything is covered, and nothing gets tested that’s not meant to be. The scoping information then gets recorded in the Rules of Engagement document which is signed by both yourselves and us, so that everything is covered from a legal and contractual standpoint. The document also defines when and how testing will take place.
Once testing commences, we get started with the Discovery phase, which is sometimes also referred to as the Information Gathering phase. Information about the target is gathered using online, passive sources to help us understand what we’re up against, as well as some active methods, so that we can identify any obvious attack vectors to map out the digital attack surface.
A surprising amount of valuable insight can be gained without ever fully interacting with web applications, though the more we interact with it, the more we learn.
Based on what we find during the Discovery phase, an analysis of all of that information is carried out to identify the most valuable parts of the application. This might include areas for credit card information or personal data, as an example. Understanding the most logical places to attack is also key to a targeted approach. By Threat Modeling, we are thinking like an attacker and coming up with a strategic plan of what to attack and why.
This is where we move from theory to practice. The Vulnerability Analysis phase is a mixture of automated tools and manual testing where we begin to actively hunt for vulnerabilities. The aim is to prove the existence of exploitable flaws whilst eliminating false positives. For web applications we make sure to incorporate the OWASP Top 10 vulnerabilities into our methodology, following industry best practices.
Once we have a proof-of-concept from the Vulnerability Analysis phase, we want to be able to demonstrate what the potential impact is. Attacks are built upon in a controlled manner to show what the real world risk of the vulnerability is. A couple of examples might be the taking over of accounts on the application, the extraction of sensitive data, or even gaining access to the underlying web server. If an exploit carries a high risk of causing system instability, we will always coordinate with your team before proceeding.
Where exploitation is successful, the process starts again from the Discovery phase. By doing this, we can explore any avenues that only become available from the perspective of whatever new permissions we might have gained. Quite often, different users will have access to different things. We want to make sure that as much is covered as possible.
The end product. Our reports provide a high level overview to help senior leadership understand where to focus resources, as well as the technical detail needed to understand individual issues, how to replicate them, and – most importantly – what to do about them. Every finding in our report takes into account the context of your organisation, rather than just providing a generic risk score. To do this, we work to gain an understanding throughout the engagement of what’s important to you and where the real risk lies.
A certificate is also provided with each report stating what was tested and when, so that you can satisfy compliance requirements without sharing sensitive details.
You can speak to an expert member of our team by either getting in touch, or filling out our quick enquiry form. We look forward to hearing from you soon!
