Pen testing for web applications

Question 1

What are the steps for a successful web application test?

Answer 1

1. Understand the application you are testing
   - google
   - Access to application code
   - talk to people
2. Check for low-hanging fruits
   - scanners and tools
3. Spend time diving into what makes sense

Question 2

How do you know what to look for during a pen test?

Answer 2

Good resources:
- OWASP top 10
- OWASP Application Security Verification Standard (ASVS)

Question 3

What is a weakness of only using scanners or only working through a check list?

Answer 3

You have to be aware of how an application is supposed to work, and the context which you can see information. This could not be found by a scanner, and is easily missed when working through a checklist.

Question 4

What are some weaknesses with tools?

Answer 4

Limited coverage

Can provide a false sense of security

As frameworks become better, automated scanners are less effective

Question 5

What causes vulnerabilities?

Answer 5

When developer have a limited view of what the application is actually doing.

This can be caused by having layers of libraries and frameworks that abstracts away what is actually happening under the hood.

Make stuff without knowing how it works

Question 6

How to be an ethical pentester

Answer 6

Don’t hack things you don’t have explicit permission to or own yourself. Only use applications normally to see how they work, which may sometime reveal security issues.

If someone asks you to hack something, make sure they have the authorization to give you that task.

Keep within scope

Only go as far as necessary to demonstrate a risk

Question 7

What information is gathered during reconnaissance?

Answer 7

What information is public:
- open source
- google
- shodan
- certificate transparency logs

Can you decompile the code

Look at network traffic (burp, browser dev tool)

Question 8

What is important to consider during testing?

Answer 8

Because there are lots of grey areas - document your research

Regulations very between legal jurisdictions

If you are testing a system made by a company with different nationality, you may need to behave with your own country’s law, the company’s law and possibly EU

is reverse engineering allowed