Application pen testing basics Guide : In our previous tutorials, we have discussed about Application penetration testing and learned lot of Practical methods to perform application pen testing. We received a great response and feedback from users. Most of them showed interest in learning Penetration testing and asked us to write about Basics of Application Penetration testing. So friends, today we are going to learn very basics of Application pen testing basics like What is Application penetration testing? What is a penetration test? and much more. So friends lets learn Application Security Testing from very basics.
Before understanding what penetration testing actually is? One has to understand What is a Security Test or Penetration test? An Application Penetration Test is basically a method of evaluating the security posture of an application by simulating an attack from malicious hackers who would not otherwise have authorized access.
OWASP describes Application Security test as :
A method of evaluating the security of a computer system or network by methodically validating and verifying the effectiveness of application security controls.
So you can say Application Penetration testing (also called app pen testing) is the practice of testing application to find vulnerabilities that an attacker or hacker could exploit. But what’s the process involve in this evaluation and how penetration testers really do this? The process involves an analysis of the application for any weaknesses, technical flaws, or vulnerabilities. Any vulnerabilities that are found at any stage of Penetration testing will be presented to the system owner, together with an assessment of the impact which is usually called Security Testing Report, a proposal for mitigation or a technical solution i.e. how we can overcome this is some patch or technical solution. We will learn more about how to perform a penetration test and prepare a penetration test report in later articles.
Below are some Generic terms which you will regularly deal with if it comes to Penetration testing:
Vulnerability : A vulnerability is a flaw or weakness in a system’s design, implementation, operation or management that could be exploited to compromise the system’s security objectives. By above statement, we mean that issue can present at any stage of application development cycle.
No matter how secure application you will make it will have flaws. Simple reason is audience. Application is usually made by few set of developers, they can try to minimize the risk but when application is published on web, millions of users uses that and this is where users become application testers indirectly.
Threat : A threat is anything (a malicious external attacker, an internal user, a system instability, etc) that may harm the assets owned by an application (resources of value, such as the data in a database or in the file system) by exploiting a vulnerability.
NVD : National Vulnerability Database, If you want to pursue your career in Penetration testing world then you will keep of hearing this term. The National Vulnerability Database is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, misconfigurations, product names, and impact metrics. NVD supports the Information Security Automation Program (ISAP).
CVE : The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. CVE Identifiers (also called “CVE names”, “CVE numbers”, “CVE-IDs”, and “CVEs”) are unique, common identifiers for publicly known information-security vulnerabilities in publicly released software packages.
CVSS : The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat. Scores are calculated based on a formula that depends on several metrics that approximate ease of exploit and the impact of exploit. Scores range from 0 to 10, with 10 being the most severe. While many utilize only the CVSS Base score for determining severity, Temporal and Environmental scores also exist, to factor in availability of mitigations and how widespread vulnerable systems are within an organization, respectively.
You can read about how to use CVSS here :
OWASP : The Open Web Application Security Project (OWASP) is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. OWASP seeks to educate developers, designers, architects and business owners about the risks associated with the most common Web application security vulnerabilities. OWASP, which supports both open source and commercial security products, has become known as a forum in which information technology professionals can network and build expertise. The organization publishes a popular Top Ten list that explains the most dangerous Web application security flaws and provides recommendations for dealing with those flaws.
That’s all for today, we will learn more basics is part 2 of application pen testing tutorials series. Keep Learning!! Keep Connected!!