#Conquest Security
Web Application Penetration Testing
Why Web Application Penetration Testing?
Nowadays 80% of all technical attacks are aimed at the Web Application layer.
Symantec reports in 2021 that a rising number of applications have exploitable flaws.
- Compliance regulations may require regular pen testing
- Customers and partners may require proof of regular pen testing
- Proactive security investment instead of reactive repair costs
- Avoid legal action and reputational damage following a breach
Service Description
This service examines websites and web applications, portals, APIs and backend database storage from a coding and implementation flaw perspective, and also looks at technical issues such as described in the OWASP Top 10 framework. It involves attempts to actively exploit vulnerabilities in order to demonstrate data leakage and gaining access to the web application, underlying database services, APIs (Application Programming Interfaces) and the hosting environment itself.
Tests performed
Our testing methodologies are aligned with the following frameworks: NIST, OWASP Top 10 (Web and API) as well as SANS Top 25. This includes testing for OS Command Injections, XXE, Oauth, SSO, SQLi, XSS, CSRF, SSRF, credential brute forcing, IDOR, Business logic, Click Jacking, DOM based flaws, CORS, HTTP Request Smuggling, Server-Side Template injection, Directory Traversal, Access Control, Authentication, Web Sockets, Web Cache Poisoning, Insecure Deserialization, Information Disclosure and HTTP Host Headers.
Deliverables
Flexible Options
Why us?
- Consultants with 10+ years of ethical hacking experience
- Consultants certified to highest levels such as OSCP, OSCE, OSWE, GIAC
- Experience across all industry and government sectors
- We are an independent third party concerned with finding & fixing flaws
- No conflict of interest. We are not embedded with HW/SW vendors
- Dedicated Red Team approach with specialists in all technologies