Application Security

WEB APPLICATION TEST

We carry out an application level penetration test of the given web application.

Application level tests focus on typical application security errors (e.g. Cross-Site Scripting, SQL injection or Cross-Site Request Forgery) and application logic flaws in the authentication and authorization.
– Anonymous Testing (Black-Box)
In the course of an Anonymous test, no information is provided by the client regarding the application or the environment.
– User Level Testing (Grey-Box)
User Level testing assumes having been provided with test accounts to applications under review. The team acts as an authorised user attempting to gain illegitimate privileges on the system.

Area	Tests
Basic tests	HTTP response disclosure	Directory traversal	Download function misuse	Browser cache weaknesses	Fingerprint the web application and the framework	Error dumps
Authentication and sessions management	Password complexity/ reminder	Session fixation/ puzzling/mixing	Cookies properties	Authentication bypass	CSRF	Account lock-out
Injections and input validation	Strictness check	Content spoofing	Open redirecion	XSS injection attacks	SQL injections	XML / XEE injections
Encryption	HTTP vs HTTPS	SSL and TLS
Authorization	Horizontal privilege escalation	Vertical privilege escalation

Typically between 2 and 20 MDs

Typical :requirements

– URL of the application
– Two test users from each major role/group (e.g. reviewer, normal user, admin user)
– Test environment (we prefer coducting the tests on a test environment)

MOBILE APPLICATION TEST

Our methodology aims to cover all aspects of mobile security, including issues of stored sensitive data (consider the case of physical theft of a victim device), protection of communication channels and the server side components of a mobile application infrastructure.

Typically a mobile application test includes the assessment of the server side of the application as well.

Areas	Tests
Common	– Obfuscation – Memory management	Evaluation of the usage of the cryptographic tools	Authentication scheme and authorization methods	– Logging – Access to local storage – Error handling	Evaluate SSL related security controls
Android	Use of Android IPC (intents, broadcast listeners etc.) – evaluation of the potential impact of a piece of malware	Use of Android related security controls	Handling of screenshots
iOS	Potential bypass of jailbreak detection routines	Consequences of inmemory patching using the MobileSubstrate framework	– Anti-debugging techniques – Handling of screenshots	Protection classes of the stored data files	Usage of custom protocol handlers

Typically between 10 and 30 MDs

Typical requirements

– Source code of the application
– Interview with the developers / application managers
– Available technical documentation

EXTERNAL INFRASTRUCTURE TEST

The external infrastructure level penetration test aimed at identifying vulnerabilities in your defenses that might allow an attacker to penetrate the network and potentially to either gain unauthorised access to internal applications and sensitive information, or to cause disruption to critical services.

This test does not include the security assessment of the identified (web) applications, but focuses only on the infrastructure level.

Areas	Tests
Intelligence gathering	-Document all active nodest -Document stealth nodes	– Determine. OS type and/orconfiguration – Determin known and zero day expolits	– Enumerate active services – Enumerate any trust relationship
Vulnerability analysis	Identify exposures using commercial tools / open source and known tools	Identify exposures using proprietary tools	Identify zero day exploits with customized scripts
Vulnerability exploitation	– Verify accuracy of identified weakness – Repeat identifications of exposures manually	– Attempt a controlled compromise of hosts – Attempt a controlled compromise of trust relationships	– Attempt to escalate privilegess – Collect evidences and document all compromises

Typically between 2 and 10 MDs

Typical requirements

– The list of the in-scope IP addresses
– Whitelisting of tester IPs on the IDS/IPS/firewall system

INTERNAL INFRASTRUCTURE TEST

An internal penetration test is a security assessment from the standpoint of an internal employee with malicious intentions, or an attacker who has successfully gained access to an internal network endpoint.

During the assessment, we attempt to determine which vulnerabilities can be exploited within the client’s infrastructure and assess the impact of a possible exploitation.

This test does not include the security assessment of the identified (web) applications, but focuses only on the infrastructure level.

Areas	Tests
Intelligence gathering	-Document all active nodest -Document stealth nodes	– Determine. OS type and/orconfiguration – Determin known and zero day expolits	– Enumerate active services – Enumerate any trust relationship
Vulnerability analysis	Identify exposures using commercial tools / open source and known tools	Identify exposures using proprietary tools	Identify zero day exploits with customized scripts
Vulnerability exploitation	– Verify accuracy of identified weakness – Repeat identifications of exposures manually	– Attempt a controlled compromise of hosts – Attempt a controlled compromise of trust relationships	– Attempt to escalate privilegess – Collect evidences and document all compromises

Typically between 5 and 20 MD

Typical requirements

– Network access without any limitations (e.g. .1X, rate limit etc.)
– Proper network configuration for the Ethernet ports to access the target ranges
– Whitelisting of our IP addresses
– In-scope IP addresses or network ranges
– Internet access for our testers onsite
– Access to the building (e.g. temporary access card)
– Room to host 2 people

Contact us

WEB APPLICATION TEST

Typically between 2 and 20 MDs

MOBILE APPLICATION TEST

Typically between 10 and 30 MDs

EXTERNAL INFRASTRUCTURE TEST

Typically between 2 and 10 MDs

INTERNAL INFRASTRUCTURE TEST

Typically between 5 and 20 MD

Application Security Assessment

Container Security Assessment

Cloud Security Assessment

Governence