Antisyphon KB

Getting Started with Web App Testing

Nov 04, 20244 min read

author: Melissa Bruno

Getting Started with Web Application Penetration Testing

Introduction

Web application penetration tests (aka web app pentests) focus on identifying and exploiting vulnerabilities affecting web applications. Most web app pentests at BHIS are scoped so that one web application will be tested over a period of five business days, but depending on the size of the in-scope application(s), the testing period may be longer or shorter.

Web app pentests may be performed with or without authentication, with the former being more commonly requested. Credentials are provided by the client to the tester prior to the start of the engagement. Whenever possible, clients should provide two sets of credentials and a description for each user privilege level (standard, admin, etc.), so that the access controls between privilege levels can be tested.

Protective capabilities such as web application firewalls (WAFs) may sit in front of a web app and block requests that it deems to be potentially malicious, such as requests containing cross-site scripting or SQL injection payloads. Testers should work with clients to ensure that IP addresses used for testing are added to the WAF’s allow list. Some clients may decline to do this, but it should be strongly encouraged so that the web application itself is tested.

Testers may be asked to test a web application’s testing, staging, or production environment. Testing a staging environment that closely mimics production is ideal. Extra precautions should be taken (throttle scans, err on the side of caution if you think something might break, keep a close eye out for a sudden increase in errors during scans) when testing production environments, as any downtime caused by testing can be costly for the client.

Identifying Common Vulnerabilities

All new web application penetration testers should familiarize themselves with the OWASP Top 10, which describes the ten most common security vulnerabilities affecting web applications. The issues described in this list should be checked for during every test. Due to their prevalence, you are likely to find multiple issues described in the OWASP Top 10 per web application assessment.

Testers should also familiarize themselves which each of the web application findings in the BHIS Report Findings Tool, as many of these findings are commonly encountered during testing.

Review the Web App Checklist from WAHH for a comprehensive list of issues to look for during a test.

Honing Your Testing Skills

Resources Specific to BHIS Employees

The Web App section of the Good Reports folder has examples of well-written and technically strong reports. Reviewing all of these will provide a good idea of how to effective perform web app tests at BHIS.

The Web App and API channel on Microsoft Teams is a good resource for reaching out with questions and problems related to web app testing.

General Web App Testing Resources

PortSwigger’s Web Security Academy is a great free resource which focuses on using Burp Suite to identify vulnerabilities.

The online, 16-hour training course Modern WebApp Pentesting w/ BB King is offered by BHIS’s sister company Antisyphon and can be taken for free by BHIS employees. The course is developed and taught by a BHIS employee, BB King, making the content especially relevant to BHIS testers.

The BHIS Blog’s Web App tag has useful blog posts written by BHIS employees.

Tools

Graph View

Backlinks

  • No backlinks found