4.0

27Web Application Penetration Testing4WebApplicationSecurity TestingThe following sections describe the 12subcategories of the Web ApplicationPenetration Testing Methodology:Testing: Introduction and objectivesThis section describes the OWASP web application security testingmethodology and explains how to test for evidence of vulnerabilitieswithin the application due to deficiencies with identified security controls.What is Web Application Security Testing?A security test is a method of evaluating the security of a computersystem or network by methodically validating and verifying the effectivenessof application security controls. A web application securitytest focuses only on evaluating the security of a web application. Theprocess involves an active analysis of the application for any weaknesses,technical flaws, or vulnerabilities. Any security issues that arefound will be presented to the system owner, together with an assessmentof the impact, a proposal for mitigation or a technical solution.What is a Vulnerability?A vulnerability is a flaw or weakness in a system’s design, implementation,operation or management that could be exploited to compromisethe system’s security objectives.What is a Threat?A threat is anything (a malicious external attacker, an internal user, asystem instability, etc) that may harm the assets owned by an application(resources of value, such as the data in a database or in the filesystem) by exploiting a vulnerability.What is a Test?A test is an action to demonstrate that an application meets the securityrequirements of its stakeholders.The Approach in Writing this GuideThe OWASP approach is open and collaborative:• Open: every security expert can participate with his or her experiencein the project. Everything is free.• Collaborative: brainstorming is performed before the articles arewritten so the team can share ideas and develop a collective visionof the project. That means rough consensus, a wider audience andincreased participation.This approach tends to create a defined Testing Methodology thatwill be:• Consistent• Reproducible• Rigorous• Under quality controlThe problems to be addressed are fully documented and tested. It isimportant to use a method to test all known vulnerabilities and documentall the security test activities.What is the OWASP testing methodology?Security testing will never be an exact science where a complete listof all possible issues that should be tested can be defined. Indeed,security testing is only an appropriate technique for testing the securityof web applications under certain circumstances. The goal of thisproject is to collect all the possible testing techniques, explain thesetechniques, and keep the guide updated. The OWASP Web ApplicationSecurity Testing method is based on the black box approach. The testerknows nothing or has very little information about the applicationto be tested.The testing model consists of:• Tester: Who performs the testing activities• Tools and methodology: The core of this Testing Guide project• Application: The black box to testThe test is divided into 2 phases:• Phase 1 Passive mode:In the passive mode the tester tries to understand the application’slogic and plays with the application. Tools can be used for informationgathering. For example, an HTTP proxy can be used to observe allthe HTTP requests and responses. At the end of this phase, the testershould understand all the access points (gates) of the application (e.g.,HTTP headers, parameters, and cookies). The Information Gatheringsection explains how to perform a passive mode test.For example the tester could find the following:https:/www.example.com/login/Authentic_Form.htmlThis may indicate an authentication form where the application requestsa username and a password.The following parameters represent two access points (gates) to theapplication:http:/www.example.com/Appx.jsp?a=1&b=1In this case, the application shows two gates (parameters a and b). Allthe gates found in this phase represent a point of testing. A spreadsheetwith the directory tree of the application and all the accesspoints would be useful for the second phase.