What is Web Application Penetration Testing?

by Sarah Harvey / August 15th, 2019

According to Verizon’s 2019 DBIR, web applications are the top hacking vector in breaches. What does this mean for your business? Is your organization defending its web applications from hackers and cyber threats? Are you performing penetration testing on your web applications to validate your security efforts? Let’s discuss the risks associated with web applications and how KirkpatrickPrice’s penetration testing methodologies are effective and necessary for securing your business.

Why Test Web Applications?

Web applications are unique constructs, mixing various forms of technology and providing an interactive front for others to use. Some web applications are made public, while others might be internal applications existing on an intranet. No matter the location, there are always security variables. How well does your application handle input? Does it work with backend servers in a secure manner? Do you have default configurations? Do you have an effective incident response plan? Will your session management scheme hold up to penetration testing?

According to OWASP, the 10 most critical security risks to web applications are the following:

Injection Flaws
Broken Authentication Methods
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Controls
Security Misconfigurations
Cross-Site Scripting (XSS) Flaws
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging & Monitoring

Has your organization analyzed the security of your web applications against these 10 risks? In order to accurately identify and prioritize risks specific to your organization’s web applications, OWASP recommends that you consider a risk’s exploitability, weakness prevalence, weakness detectability, technical impacts, and business impact.

The key vulnerability in Capital One’s breach was traced back to a misconfigured web application firewall. KrebsOnSecurity reported that Paige Thompson was a former employee of the web hosting company involved (presumed to be AWS) and “allegedly used web application firewall credentials to obtain privilege escalation.” Thompson illegally accessed and downloaded the PII of 106 million Capital One users, data that included approximately 140,000 Social Security numbers and approximately 80,000 bank account numbers on U.S. consumers, and roughly 1 million Social Insurance Numbers (SINs) for Canadian credit card customers. All of this because one former employee knew how this web application misconfiguration could be massively exploited.

How is Penetration Testing Performed on Web Applications?

In the past, web applications proven to be problematic for many security analysts. With all the types of technology available to organizations across different industries, there is a lot of ground to cover and a lot of expertise required to properly perform penetration testing on web applications. We often see other firms blindly assign an analyst to a web application project, assuming that their knowledge, skill, and ability will transfer to or fit whatever the web application requires. This is not the case, so you must be careful about who you hire to perform penetration testing on your web applications. Without the proper knowledge and expertise, a penetration tester can miss important findings. That’s why web application penetration testing methods at KirkpatrickPrice include the following:

Application Logic Flaws
Forced Browsing
Access and Authentication Control Flaws
Session Management
Cookie Manipulation
Horizontal Escalation
Vertical Escalation
Brute-Force Attacks
Poor Server Configuration
Sensitive Information Leakage
Source Code Disclosure
Response Splitting
File Upload/Download Attacks
Parameter Tampering
URL Manipulation
Injection Attacks for HTML, SQL, XML, SOAP, XPATH, LDAP, Command
XSS
Fuzzing
Manual Testing

So, how will our methodologies help secure your organization’s web applications? KirkpatrickPrice’s web application penetration testing methodologies are unique and efficient because they do not rely on static techniques and assessment methods. Effective penetration testing requires a diligent effort to find enterprise weaknesses, just like a malicious individual would. Our advanced, web application penetration testing methodology is derived from various sources including the OSSTMM, Information Systems Audit Standards, CERT/CC, the SANS Institute, NIST, and OWASP.

What is web application penetration testing and how could it secure your organization? If you want to avoid the consequences of a compromised web application while working with an expert ethical hacker, contact us today.