Security testing. VRN. 20.02.2013
26
Penetration Testing Roman Denisenko, 20 February 2013
Transcript of Security testing. VRN. 20.02.2013
Penetration Testing
Roman Denisenko, 20 February 2013
Agenda
• Theoretical part:– What is Security Testing? Classification.– When? Who? For what purposes?– Workflow of penetration testing of web application.– Common vulnerabilities.
• Toolkit of penetration testers:– Review and classification of necessary tools.
• Practical part.
Security testing(by final goal):• Vulnerability Assessment.• Penetration testing.• Code Review.• Vulnerability Scan.• Security review.
Security testing(by impact level):• Application level.• Network level.• Physical level.
When should we perform ST?
1. Within development cycle.
2. As additional service after deployment.
Who should perform?
1. Ordinary testers.
3. Developers.
2. Specialist of Security expertise.
Client level
HTTP level
Web service level
Database level
Algorithm of penetration testing:
• Information gathering.• Mapping.• Vulnerability Assessment.
• Automation testing.• Manual testing.
• Creation of report.
Information gathering.
www.target.es
Mapping.
/manage
/admin/calculate
/upload
/registration
Run automation vulnerability scanners.
Manual testing.
Creation of report.
Common vulnerabilities.
SQL injection
SQL injection
Stored XSS
Stored XSS
Privilege escalation.
Insecure Direct Object References.
CSRF.
CSRF.
Necessary toolkit.• Gathering tools.
– nmap.– nikto
• Automation vulnerabilities scanners.– Acunetix– Nexuss– WebInspect– w3af
• Manual testing tools.– BurpSuite– Sqlmap
• Sniffing tools.– Wireshark– Fiddler.
Penetration testing of the test site...
