Web application penetration testing refers to a set of services used to detect various security issues with web applications and identify vulnerabilities and risks, including:
- Known vulnerabilities in COTS applications
- Technical vulnerabilities: URL manipulation, SQL injection, cross-site scripting, back-end authentication, password in memory, session hijacking, buffer overflow, web server configuration, credential management, Clickjacking, etc.,
- Business logic errors: Day-to-Day threat analysis, unauthorized logins, personal information modification, pricelist modification, unauthorized funds transfer, breach of customer trust etc.
OWASP, the Open Web Application Security Project, an open source web application security documentation project, has produced documents such as the OWASP Guide and the widely adopted OWASP Top 10 awareness document.
The Firefox browser is a popular web application penetration testing tool, with many plugins specifically designed for web application penetration testing.
Foundstone's Hacme Bank simulates a banking application. It helps developers and auditors practice web application attacks, including input validation flaws such as SQL injection and Cross Site Scripting (XSS).
Read more about this topic: Penetration Test
Famous quotes containing the words web, application and/or testing:
“The web of our life is of a mingled yarn, good and ill
together.”
—William Shakespeare (1564–1616)
“I think that a young state, like a young virgin, should modestly stay at home, and wait the application of suitors for an alliance with her; and not run about offering her amity to all the world; and hazarding their refusal.... Our virgin is a jolly one; and tho at present not very rich, will in time be a great fortune, and where she has a favorable predisposition, it seems to me well worth cultivating.”
—Benjamin Franklin (1706–1790)
“Traditional scientific method has always been at the very best 20-20 hindsight. It’s good for seeing where you’ve been. It’s good for testing the truth of what you think you know, but it can’t tell you where you ought to go.”
—Robert M. Pirsig (b. 1928)