What is Web Application Pentesting?

Web application security should be a consideration throughout every stage of application development, including technical design, testing, implementation, and post-implementation.

Computer security can be grouped into four categories: risk avoidance, prevention, detection, and response and recovery. To achieve these objectives, organizations must assess their security level, which can be accomplished through penetration testing. However, proper execution of the test is critical for success.

Penetration testing is a subject of debate among security experts, with some advocating for it and others arguing that it simply measures the tester’s skills. In this post, a unique perspective on the purpose and benefits of penetration testing is presented.

A penetration test can be described as a security assessment that emulates a genuine attacker’s actions to identify potential vulnerabilities in a system through a series of tests under various conditions.

The purpose of a penetration test is not to demonstrate that the system has no weaknesses, which would merely assess the tester’s abilities. Instead, a thorough and systematic approach is used to answer fundamental questions about the system’s security.

Why would someone attack my organization?

Typically, hackers may have various motivations for targeting an organization, such as for personal satisfaction, as a stepping stone to attack other systems, or for political and revenge reasons. However, the worst-case scenario is when the hacker aims to access the organization’s assets. Therefore, a valuable penetration test should primarily focus on this scenario. Regardless of the hacker’s motivation, the consequences of a system breach can be substantial, from losing trust to suffering financial losses.

It is important to note that every penetration test has limitations, including time, human resources, and budget constraints, and it provides only a snapshot of the current security situation, which can change at any moment in the future. Therefore, it is crucial to concentrate on the scenario where the hackers aim to seize the organization’s assets and understand their motives and tactics.

What assets would the hackers target?

In order to determine the potential motives and targets of attackers, a penetration tester must possess a comprehensive understanding of the organization, its infrastructure, and the specific system being targeted. Depending on the type of test, this may involve collaborating with the target system’s owners or conducting independent research. Identifying the assets of the organization is also crucial to understanding the potential reasons for attacking the target system.

This pre-test activity is crucial in developing effective scenarios for the actual penetration test and enables the creation of targeted tests tailored to the organization’s specific needs. Without this crucial step, the penetration test merely measures the tester’s skill level.

Top penetration testing firms invest significant time and resources in this stage of the process. Whether conducting a black-box or white-box penetration test, the pen tester will gather as much information as possible about the organization to identify critical assets and focus the test on them.

What would the hackers do with the assets of the organization?

This particular inquiry pertains to the attacker’s motives, which are significant in determining the potential impact of a system breach on an organization. While most organizations are aware of the possible implications of a security breach, they tend to prepare for worst-case scenarios. A well-organized and systematic penetration test should consider the level of exploitability of identified vulnerabilities, which can help develop a profile of the attacker who could compromise the system.

If a vulnerability can be easily exploited, the system could be compromised by inexperienced attackers, such as script kiddies, or skilled attackers executing targeted attacks. In the former case, the attacker may not target the organization’s most valuable assets and may instead deface a webpage, run a bot, or delete information, resulting in a smaller impact and less damage. In contrast, targeted attacks could have devastating effects. Therefore, a penetration test must assess the potential impact on the organization in either scenario by identifying which assets are being targeted and why. With this knowledge, the focus of the test can be directed towards these critical assets.

What would the hackers do to get them?

The most interesting and essential part of a penetration test for a tester is the ability to use creativity and imagination to compromise a system and gain access to assets. While security auditors emphasize methodology and standardized approaches, the creativity of a skilled penetration tester is crucial in figuring out how to get to the necessary assets. Automated tests and following scripts are only a small part of the test. Imagination and creativity are vital in every stage of the test, from information gathering to cleaning up after the attack. A skilled tester should be passionate and determined, just like a real attacker.

Simply identifying and exploiting vulnerabilities is not enough. A good penetration test should also consider what a real attacker could do if they wanted the system for themselves. For example, they could patch a vulnerability to prevent competitors from gaining access while creating a backdoor for themselves. The creativity of the tester is crucial in answering such questions.

What should I do to detect them?

Detecting and responding to security incidents is critical for organizations, and this should be implemented at every stage of the security response. Even the most advanced detection systems can miss some attacks, which is why penetration tests can be essential in testing an organization’s detection and incident response capabilities. Penetration testers can be tasked with identifying and bypassing security controls to test an organization’s CIRT. If this is included in the scope of the test, the final report should include the testers’ approach, actions, and recommendations on how to improve detection and response to security incidents.

Ultimately, the penetration test should answer the most crucial question:

What should I do to protect my organization?

The ultimate result of any penetration test is the conclusion report, which should provide suggestions on how to resolve all identified issues. The severity of the issues should determine the necessary actions that need to be taken to address them.

To summarize, if your organization is about to undertake a penetration test, you should:

• ask or work with the penetration company to identify the assets of your organization that could be targeted by attackers;
• request and approve scenarios and profiles of potential attackers;
• check the technical level of the testers by requesting a proof of concept on a system injected with known defects of non-trivial severity;
• request a sample report and verify that it contains recommendations on how to detect attacks and prevent incidents.

The penetration test is essentially a matter of trust, requiring confidence in the testers’ skills and integrity. A reputable penetration testing company should offer a customized test that takes into account the specific needs of your organization, carried out with expertise, ingenuity, and comprehension.

While it may not uncover all the bugs in your system, a good test should identify vulnerabilities in various areas, including platform and technology, configuration and deployment, data validation and filtering, authentication and authorization, error handling, and more. Such vulnerabilities, if successfully exploited, could jeopardize the security of your system. The test should evaluate the risk and potential impact of these vulnerabilities, test your readiness and response in case of a confirmed security incident, and provide insight into how a determined and motivated attacker could potentially breach your organization.