Penetration Testing #1

A penetration test is one method of finding security vulnerabilities of a web application. It works by simulating potential web attacks. So the test is done from the perspective of a potential intruder. This means that the source code of the web application is not used as a resource to find weaknesses. Before continuing, it is important to know the relationship between a vulnerability and a threat. A vulnerability is a flaw or weakness in the application. A threat is an attack that exploits the vulnerability.

Penetration testing has two modes:
Passive mode: this is more information gathering. We are trying to find more about the system while also looking for access points of the application. We can use various tools for information gathering.
For example, let's say that a user is trying to login to a system with this url (http://example.com/?login=username=1&pass=2).
In the above system, there are two access points or gates: Username and password. 

The other mode is called Active Mode: This is were we actually do all the different type of penetration testing.
OWASP describes 9 different sub-categories for active mode testing

• Configuration Management testing 
• Business Logic Testing 
• Authentication Testing 
• Authorization Testing 
• Session Management Testing 
• Data Validation Testing 
• Denial of Service Testing 
• Web Service Testing 
• Ajax Testing 

For the rest of this blog post, I'll be focusing on the passive side. As mentioned earlier, the passive mode is all about finding information through various methods. Information gathering can be done by public tools such as search engines or private tools that can be used to connect to the application and send specific information requests. Even something as error messages can reveal a lot of information about the application (version #, database type, etc…). So just how do we find information? The next blog post will have more information about some of these methods.