Web security test

Web security was so far most overlooked aspect of companies' security targets, but nowadays is becoming a priority in any organisation. The most vulnerable are web-based applications (e.g., shopping carts, login pages, dynamic content etc.), which are accessible 24/7 and contain valuable data such as customer databases.

>> look at security measureses dedicated to money/information transfer

Basic security test

The basic security test cover most exposed and endangered areas by using most update scanning security programs such as paros, xssme, qlinjectionme, nikto, xsss, sqlmap, xsss, maltego, css-screaming, metasploit and others.

The result will be short security report with suggestions for improvement.

Quick penetration test

The quick penetration test consists of passive security inspection and scanning plus use of the weakest point to test hackability of particular web application or server. This test uncovers most critical threats such as SQL injections, cross site scripting (XSS) , Cross Site Request Forgery attacks (CSRF) and threats connected to buffer-overflows.

The test is most suitable when your automatic security systems backfired as is performed manually. The result is a medium long report containing the weakest points of your sites and areas that need to strengthened.

Detailed resistance test by QASP

Detailed resistance test is performed according to security guide QASP and it includes the quick penetration test.

This detailed resistance test is focused especially on 10 most critical threats:

• A1 Cross Site Scripting (XSS)
• A2 Injection Flaws
• A3 Malicious File Execution
• A4 Insecure Direct Object Reference
• A5 Cross Site Request Forgery (CSRF)
• A6 Information Leakage and Improper Error Handling
• A7 Broken Authentication and Session Management
• A8 Insecure Cryptographic Storage
• A9 Insecure Communications
• A10 Failure to Restrict URL Access

The result of this test is:

• Deep report including all found threat
• Meeting with project assigned manager and project team, where all found threats and vulnerable areas will be examined and presented to you.
• Practical guide for safe application development
• Real time example of   how your web site can be penetrated and abused (e.g., company compromise, database dumping, false email to clients, etc.).

Print page Share on Facebook Linkedin Delicious