Penetration Testing Scope – Best Practices

Penetration Testing Scope – Application Server-Side

  • Information Leakage – Tests should be carried out to detect network system verbosity and promiscuity.
  • Business Logic  – Mistakes made in implementing business logic can lead to security holes.
  • Authentication – Authentication testing should ensure that security requirements (credential expiry, revocation, reuse etc.) are implemented correctly and the protection of security functions and cryptographic keys is robust.
  • Authorization – Tests should be conducted to verify that the security access matrix works correctly in various permutations.
  • Input Data Validation – Proper data validation should include the following:
    • Every input to the applications should be validated.
    • All forms of data (such as text boxes, select boxes and hidden fields) should be checked.
    • The handling of null and incorrect data input should be verified.
    • Content formatting should be checked.
    • Maximum length for each input field should be validated.
  • Exception / Error Handling – Leakage of sensitive information should not be an outcome of a system failure.
  • Session Management – To ensure secure session management, the following conditions should be specified:
    • Sensitive information that is passed in the cookies is encrypted.
    • Session identifier should be random and unique.
    • Session should expire after a pre-defined length of time.
  • Cryptography – The implementation of cryptography must be rigorously tested covering all cryptographic functions (encryption, decryption, hashing, signing) and key management procedures (generation, distribution, installation, renewal, revocation and expiry).
  • Vulnerability Testing – Testing against common vulnerabilities such as the OWASP Top Ten.

Penetration Testing Scope – Mobile App/Client

  • Environmental Analysis – Business case surrounding the application will be studied.
  • Architectural Analysis
  • Static Analysis
  • Dynamic Analysis
  • File System Analysis

Penetration Testing Scope – Network

  • Information gathering
  • Network Surveying
  • Port Scanning
  • System and Service Scanning
  • Vulnerability Assessment
  • Platform misconfiguration
  • Patch Management
  • Authentication Mechanisms

 

Penetration Testing Scope – Best Practices