There are many methods for performing a pen test against the web application layer and cloud services. Web applications combine several applications, network, and operating systems elements. Each of these elements often become targets of cyber criminals and hackers. Application security testing or APPSEC is a required domain for organizations to adopt to account for the known and unknown issues with system elements.
Web application pen testing comprises four major steps including:
- Information collection
- Threat research and application performance expectations
- Compliance reporting
- Continuous remediation of vulnerable systems
Strategy Penetration Testing of Post Remediated Systems
Experienced pen testers perform these tests to determine a security posture risk level during the lifecycle of the application or platform. Coding misconfiguration and developers that depart from the main purpose of performing tests during the Software development life cycle (SDLC) become the most exposed areas during a pen test.
Web Application Pen Testing: Tools, Method and Best Practices
Web applications never stop being developed. A company may receive everything from a bug fix request from support to a series of enhancements to win or deal or avoid losing an important client. Most often, security testing is not something that is common with application development lifecycle. Reluctantly, developers leave off security controls because of impact on performing the application or platform. Pen testing is essential to validate this concern. A pen test would be extremely valuable to determine the risk posture of these edge devices and their exposure to sensitive data being collected.
Pen Tester Web Application Penetration Testing Method
Pen testing web application systems focus on a risk-based approach to identify critical application security flaws. Web application pen tests combine the results with manual testing to enumerate and validate application vulnerabilities, misconfiguration errors, and business workflow flaws.
A solid Web Application Penetration Test covers the classes of vulnerabilities outlined in the Open Web Application Security Project (OWASP) Top 10 and beyond:
- Injection (Code and buffer overflow)
- Broken Authentication (Poorly designed MFA strategy)
- Sensitive Data Exposure (vulnerable web application)
- XML External Entities (XXE)
- Broken Access Control (brute force attack surface)
- Security Misconfiguration (Most common attack surface in the DEVOPS and SECOPS world)
- Cross-Site Scripting (XSS) (Very specific to API Testing)
- Insecure Deserialization
- Using Components with Known Vulnerabilities (APIs, Virtual firewalls, IDS, and Host based intrusion technology)
- Insufficient Logging & Monitoring(Syslog and NETFLOW overload)
Selecting a well experienced 3rd party testing firm is critical to the success of the engagement. The clients should fully know the pen tester team’s methods, experience, and background prior to any engagement.
Reporting
An experienced pen tester, along with compliance professionals, will generate a clear and actionable report, complete with evidence, for the project stakeholders. If the report is incomplete, inaccurate, or lacks a true evaluation for the environment, the client may consider holding off remediating a critical system; resulting in a breach and data exfiltration attack.
Critical steps taking during a pen test engagement:
- Accurate reporting of all findings regardless of level of severity.
- Completed web application penetration test report, including the evidence collected.
- Detailed remediation advice and walkthrough
Threat Modeling and Risk Evaluation
Threat modeling has become a proven method to help system and application architects think about the security threats that their systems and applications will be subject to. Threat modeling is a risk assessment tool for applications. It enables the application developer a strategy for dealing with potential vulnerabilities and helps them focus on their limited resources and requirements that need the most attention.
Pen testing has proven to be effective in network security. However, this rarely translates to applications. When pen testing executes against the networks and devices, most of the discovery is around issues not found on the application layer. Pen testing in the web application arena is more connected to pure research. Automated pen testing tools have developed, but considering web applications, their effectiveness alone can be poor. Human interaction is critical to the success of the pen test engagement.
Developing a Threat Model for the Pen Test
During the threat modeling creation, assets become identified and categorized into threat categories. These categories will also have sub-categories may include:
- Sensitive information
- Trade secrets
- Financial documents
The pen testing team will collect the following data and content elements:
- All open source libraries, including commercial and internally developed tools. (Scope targets)
- Leveraging Spidering to collect and build a map of each of the features, components, and dependencies. (Application footprinting)
- Send fuzzing requests to be used to analyze error codes that may disclose valuable information that could launch a more targeted attack. (Application fingerprinting)
- Build the application’s threat model using the information gathered in previous work streams to plan the attack in later sections of the penetration test. (Attack Chains)
- Upload vulnerability information into the collective and evidence locker to be used for reporting and remediation recommendations. (application testing reports)
Exploitation
Exploit testing involves establishing connections to the application or other components by bypassing security controls and exploiting vulnerabilities to determine their risk. Throughout this step, the pen testers will perform several real-world exploits. During a web application penetration test, the exploitation phase comprises several manual testing tactics and is often the most time-intensive phase.
During the Exploit phase:
- Attempt a manual to exploit the vulnerabilities identified.
- Capture and log evidence
- Notify the client of any critical findings.
- Report validated exploits and their corresponding evidence with remediation recommendations.
Moving Pen Testing From a Tactical to a Strategic Work Flow.
When considering the whole point of pen testing; the 3rd party pen teams focus on three fundamental challenges and weaknesses within any system:
- People
- Process
- Technology
People are human and they will continue to make mistakes. Users will click on the wrong email link, share their passwords, and forget to log out of their remote systems. Processes fail because the users forget to patch a system, update a password file, or most times backup their data to unsecure systems. Technology by itself is also an enormous risk to an organization. Deploying too much technology without having properly trained personnel along with not staying up on the vendor best practices or hoping the migration to the cloud will make the client’s system more secure, all lead to increased attack surfaces. Pen testing as a strategy work steam identified focuses on these areas and helps to determine the level of risk to the organization over a period.
Pen testing helps close the window of vulnerability that every system has.
Test Early and Test Often
