Conquest

#Conquest Security

Web Application Penetration Testing

Why Web Application Penetration Testing?

Nowadays 80% of all technical attacks are aimed at the Web Application layer.
Symantec reports in 2021 that a rising number of applications have exploitable flaws. 

  • Compliance regulations may require regular pen testing
  • Customers and partners may require proof of regular pen testing
  • Proactive security investment instead of reactive repair costs
  • Avoid legal action and reputational damage following a breach

Service Description

This service examines websites and web applications, portals, APIs and backend database storage from a coding and implementation flaw perspective, and also looks at technical issues such as described in the OWASP Top 10 framework. It involves attempts to actively exploit vulnerabilities in order to demonstrate data leakage and gaining access to the web application, underlying database services, APIs (Application Programming Interfaces) and the hosting environment itself.

Tests performed

Our testing methodologies are aligned with the following frameworks: NIST, OWASP Top 10 (Web and API) as well as SANS Top 25. This includes testing for OS Command Injections, XXE, Oauth, SSO, SQLi, XSS, CSRF, SSRF, credential brute forcing, IDOR, Business logic, Click Jacking, DOM based flaws, CORS, HTTP Request Smuggling, Server-Side Template injection, Directory Traversal, Access Control, Authentication, Web Sockets, Web Cache Poisoning, Insecure Deserialization, Information Disclosure and HTTP Host Headers.

Deliverables

Full report (Executive summary and in-depth technical report)
Mitigation Advice on encountered vulnerabilities

 

Instant notification of critical vulnerabilities found during testing phase
Secure report delivery by encrypted email

Flexible Options

Vulnerability Assessment (Identification without exploitation)
Black-box Pen Test (from an attacker’s perspective without credentials)
Grey-box Pen Test (from a malicious user’s perspective with user credentials)
White-box Pen Test (with full admin credentials & access to underlying source code)

 

External testing (Internet facing) or internal testing via VPN
Packages for recurring and continuous automated testing available
Impact minimization by protection from malicious exploits or DDoS tests
Fine grained scoping and testing only during agreed schedule

Why us?

  • Consultants with 10+ years of ethical hacking experience
  • Consultants certified to highest levels such as OSCP, OSCE, OSWE, GIAC
  • Experience across all industry and government sectors
  • We are an independent third party concerned with finding & fixing flaws
  • No conflict of interest. We are not embedded with HW/SW vendors
  • Dedicated Red Team approach with specialists in all technologies