Introduction To Penetration Testing for Web Applications

What is Web Application Penetration Testing?

Web application penetration testing is also known as pentesting or ethical hacking. Web Application Penetration Testing will protect your web applications from simulated attacks and help you identify possible security flaws, weaknesses, and vulnerabilities to remedy them. You can use penetration tests to discover vulnerabilities and weaknesses across web application components and APIs, including the back end server, the database, and the source code. 

What is the benefit of doing Penetration Testing for Web applications? 

Penetration testing is essential for web applications as most businesses depend on web applications considering many web applications are mission-critical systems. Most of the time, web applications store sensitive data such as personal identifier information, payment details, medical details, and so on and may generate revenue directly or indirectly.  

A web application breach can directly cause financial damages, disclose sensitive information, damage business reputation, disclose the business plan and strategy and may cause the organization to breach its compliance obligations.  

Types of Penetration Testing for Web Applications 

When you do a penetration test for web applications, there are several aspects you need to consider. These aspects determine which location (internal or external) and type of penetration test is required. 

There are two main types of penetration testing by location of the attack. 

1. Internal penetration testing 

These are attacks coming from within the organization as an internal attacker. This is usually performed through LAN. The goal is to identify vulnerabilities that might exist within the firewall, simulating an attack like a malicious insider. 

2. External penetration testing  

Attacks the application externally as an external attacker. The test simulates how an external attacker would behave when stating an attack. You can perform an external pentest to check firewalls, servers and users. 

In addition to the above two testings, there are three other types of penetration testing through different aspects, such as access levels and scope of knowledge:

1. Black box penetration testing 

This type of pentest that simulates attacks starts as an external attacker with no prior knowledge of the targeted system without any user credential. 

2. Gray box penetration testing 

This type of pentest that simulates attacks starts as an internal attacker, with user-level access to specific systems knowledge. 

3. White box penetration testing 

This type of pentest that simulates attacks starts with complete knowledge of the source code and system. 

How do you do web application penetration testing? 

Web application penetration testing is mainly done in three phases: 

1. Planning Phase 
2. Exploitation Phase 
3. Post-Exploitation Phase

Pentester should comply with the following aspects during the planning phase: 

1. Define the scope of the test  

We identify and define the scope of pentesting prior to starting the pentest. 

2. Determine success criteria for pentest  

Where expected results can be derived from user requirements, pentesting works on a different model. The success criteria or test case passing criteria need to be defined. 

3. Review any available results from previous tests, if applicable  

If any prior testing was done, it is essential to review those test results to understand what vulnerabilities existed in the past and what remediation and controls were taken to resolve. This always gives a better picture to the pentesters. 

4. Assess and learn as much as possible about the tested environment 

Pentesters should gain thorough knowledge about the environment before starting the testing. This step should ensure that pentesters understand business logic, firewalls, or other security protocols required to be disabled to perform the testing. 

Pentester should comply with the following aspects during the exploitation phase: 

1. Threat modelling. 

2. Do the test using several different roles, if required. 

3. Follow the pre-defined success criteria and reporting procedure when discovering new vulnerabilities. 

4. Create a clear and detailed report explaining the measures taken, which types of vulnerabilities were detected, and the severity level of each vulnerability. 

Pentester should comply with the following aspects during the post-exploitation phase:

1. Provide recommendations for securing the vulnerabilities that are found in the explosion phase. 

2. Re-test to check if those vulnerabilities were remediated correctly by the developer. 

3. Once all the tests are done, revert all changes to the original configuration, including enabling firewall and other security protocols, if it disables in the explosion phase. 

Web Penetration Testing Methodology for successful Penetration Testing

The methodology is a set of security industry guidelines and standards on how the testing should be done. Some of the most famous methodologies and standards can be used for testing. However, each web application demands different types of tests to be performed. Moreover, testers can create their methodologies by referring to the standards available in the market. 

Below are some of the most popular security testing methodologies and standards that a pentester needs to follow while testing: 

1. OWASP (Open Web Application Security Project)  
2. OSSTMM (Open Source Security Testing Methodology Manual) 
3. NIST (National Institute of Standards and Technology) 
4. PTES Framework (Penetration Testing Methodologies and Standards Framework) 
5. PCI DSS (Payment Card Industry Data Security Standard) 

Conclusion

Considering that many businesses depend on web applications, it’s important to do penetration testing to safeguard web applications from simulated cyber attacks and identify potential security flaws, weaknesses and vulnerabilities to remedy them. In this manner, it’s important for a pentester to have knowledge on the types of penetration testing, the 3 phases of penetration testing as well as the security testing methodologies and standards adopted while testing.