Web Application Penetration Testing

Web applications are the most attractive targets for hackers because they are easy to reach and programmers, even when they have several years of experience are often unintentionally writing vulnerable, easy to exploit, code.

Manual Web Application Penetration Testing is essential when searching for vulnerabilities.

Automated tools simply cannot discover all the flaws.

XCELIT’s Web Application Penetration Testing team runs both manual and automated Manual Web Application Penetration Testing on any assignment.

The goal of Web Application Penetration testing is to identify and repair web application security flaws.

Conducting a Web Application Penetration Test protects customer loyalty and company image. Web Application Penetration testing helps an organization avoid data incidents that may put the company’s reputation and reliability at stake.

Web Application Penetration Testing protects the integrity of assets in case of existing malicious code hidden. Our Web Application Penetration Testing team experts can investigate line by line the code of the applications in order to detect code vulnerabilities or backdoors.

Web Application Penetration Testing involves methodological series of steps aimed at gathering information about the target system, finding vulnerabilities or faults in them, researching for exploits that will succeed against those faults or vulnerabilities and compromise the web application.

In our testing we include everything:
– Injections: SQL, XSS, CSRF
– Authentication tests and Session Management
– Sensitive Data Exposure checks
– Broken Access Control
– Security Misconfigurations

Our Web Application Penetration testing process

Scoping – tell us what you need, or we can send you a scoping sheet for completion.

Attacking – our Web Application Penetration Testing Team attack your applications to discover vulnerabilities.

Reporting – We present all the weaknesses and vulnerabilities identified during the Web Application Penetration Test and recommendations on how to fix the weaknesses and vulnerabilities found.

Retesting – Once you have remediated all weaknesses and vulnerabilities, we retest to verify for you, for Free.

Why our approach to Web Application Penetration Testing is best for you

Our Web application Penetration Testing service is based on PTES, NIST and OWASP standards combined with over 10 years experience per certified security engineer, setting us apart from any other Web Application Penetration Testing team you may come across.

Open Box Penetration Testing

Open Box Penetration Testing may also be referred to as:
– Crystal Box Penetration Testing
– Oblique Box Penetration Testing
– Clear Box Penetration Testing
– Transparent Box Penetration Testing
– White Box Penetration testing

In an Open Box Penetration Test, the Penetration Tester is provided some information ahead of time regarding the target company’s security info.

The degree of information shared is dependent on the clients needs and can include full network and system information, including network maps and login credentials.

In an Open Box Penetration Test the aim is to expose the systems details under the test, and can be used to reveal what a Threat Actor may gain access to, or how visible they are to defences once they have breached the network.

In many cases, the Blue Team (the team charged with protecting the network) are advised to not stop the penetration test if observed. In other cases, the Blue Team are not warned of the Open Box Penetration Test.

The Penetration Tester does not (at least deliberately) damage the network in any way, but rather exposes weaknesses that may be exploited by a Threat Actor, so these weaknesses may be remediated.

Sharing full network and system information with the tester, including network maps and login credentials helps to save time and reduce the overall cost of an engagement.

When to undertake a Open Box Penetration test

Open Box Penetration Testing is normally undertaken during software development, or web application development, before releasing the finished product. Open Box Penetration Testing at this stage allows weaknesses and vulnerabilities to be fixed before release.

Many organisations choose to undertake a Open Box Penetration Testing annually, or on another predefined schedule. Software and Web Application changes are a common reason for instigating an Open Box Penetration Test. If your organisation is undertaking regular Open Box Penetration Testing, XCELIT recommends our subscription model to save cost.

Open Box Penetration Testing Considerations

One of the criticisms of an Open Box Penetration Test is that sharing of information with the Penetration Testing team results in the Penetration testers not moving through the network in a way that Threat Actors would. This, however, tends to be minimal when considering closing of weaknesses and vulnerabilities, and a combination of Closed Box Penetration testing and Open Box Penetration testing can be used over time, closing this gap.

The main advantage of an Open Box Penetration Test is that it takes significantly less time than a Closed Box Penetration Test, saving cost.

Our Open Box Penetration Testing process

Scoping – confirm that you want the Open Box Penetration Test. A scoping sheet can be provided for relevant information sharing.

Attacking – our Open Box Penetration Testing Team undertake tasks as a Threat Actor would.

Reporting – We present all the weaknesses and vulnerabilities identified during the Open Box Penetration Test and recommendations on how to fix the weaknesses and vulnerabilities found.

Retesting – Once you have remediated all weaknesses and vulnerabilities, we retest to verify for you, for Free.

Why our approach to Open Box Penetration Testing is best for you

Our Open Box Penetration Testing team has over 10 years’ experience per certified security engineer, setting us apart from any other Open Box Penetration Testing team you may come across.

Internal Network Penetration Testing

In an Internal Network Penetration Test, the ethical hacker performs the test from the company’s internal network.

Internal Network Penetration Testing works from the premise that the Cyber Threat Actor already has access to your network.

This kind of test is useful in determining how much damage a disgruntled employee, ex-employee with legacy access, or a Cyber Threat Actor could potentially cause from behind the company’s firewall.

An Internal Network Penetration Test generally takes two broad forms:
Black Box – where little or no information is provided to the Penetration Testing Team.
White Box – where the organisation discloses some information to the Penetration Testing Team.

An Internal Penetration Test is useful for determining what assets are at risk and how they may be compromised. Areas of weakness can then be patched before a real-world Cyber Threat Actor finds this weakness and exploits it.

A key requirement for an Internal Network Penetration Test is to relax security measures to allow the Penetration testing Team some latitude in finding weaknesses. Doing so, allows more weaknesses and therefore more opportunities for patching and countermeasures to be put in place, thereby improving security against real world Cyber Threat Actors.

Our Internal Network Penetration Testing process

Scoping – confirm that you want the Internal Network Penetration Test. A scoping sheet can be provided for relevant information sharing.

Attacking – our Internal Network Penetration Testing team undertake tasks as a Threat Actor would.

Reporting – We present all the weaknesses and vulnerabilities identified during the Internal Network Penetration Test and recommendations on how to fix the weaknesses and vulnerabilities found.

Retesting – Once you have remediated all weaknesses and vulnerabilities, we retest to verify for you, for Free.

Why our approach to Internal Network Penetration Testing is best for you

Our Internal Network Penetration Testing team has over 10 years’ experience per certified security engineer, setting us apart from any other Penetration Testing team you may come across.

Purple Teaming

A purple team will integrate both the Blue Team Strategy of defence, and also include the risks and vulnerabilities gathered from the Red Team.

What is Purple Teaming?

In cybersecurity, a purple team is doing both the role of the Red Team and Blue Team. The Red Team simulated the Threat Actor, and the Blue Team is the defence.

The process involves going through both of these scenarios gathering the relevant information from each.

In a Purple Teaming exercise the Red Team and Blue Team work together in such way that the end result is more refined and provides a deeper understanding of the company’s security.

Our Purple Teaming process

Scoping – confirm that you want a Purple Teaming exercise and what to include in the scope.

Attacking – our Penetration Testing team undertake tasks as a Threat Actor would, refer Red Teaming for more specific details.

Reporting – We present all the weaknesses and vulnerabilities identified during the Cloud Security Penetration Test and recommendations on how to fix the weaknesses and vulnerabilities found.

Retesting – Once you have remediated all weaknesses and vulnerabilities, we retest to verify for you, for Free.

Why our approach to Purple Teaming is best for you

Our Purple Team has over 10 years’ experience per certified security engineer, setting us apart from any other Purple Team you may come across.

iOS Penetration Testing

Securing mobile applications is more important than ever.

What to Expect in our iOS Penetration Testing Service

The iOS application attack surface consists of all components of the application, including the supportive material necessary to release the app and to support its functioning.

– Mobile App Authentication Architectures

– Network Communication

– Data Storage on iOS

– Cryptographic APIs

– Local Authentication on iOS

– Network APIs

– iOS Platform APIs

– Code Quality and Build Settings for iOS Apps

– Tampering and Reverse Engineering on iOS

– iOS Anti-Reversing Defences

Our Methodology for iOS Penetration Testing

Our approach to iOS Penetration testing includes reviewing how application reacts against common input attacks, server-side controls, data communication paths and client-related issues.

Static Testing

Search for sensitive information disclosures & decompile to source code.

Analysing Config files: reveals URL, Server credentials, Cryptographic keys, Hard coded passwords.

Reverse Engineering: Using reversing tools, Device Binding, Impede Comprehension, Impede Dynamic Analysis and Tampering.

Dynamic Testing

Attempt to inject and bypass authentication controls & review data communications functionality.

Input Validation: Injection, Malicious Input acceptance, Command Injection.

Buffer Overflow, File Upload, Business logic validations, Error handling/ Info Leakage, Session management, Log tampering.

Server side Testing

Vulnerabilities specific to web servers: Directory Traversal, Command injection, Remote code execution, SQL injection, Sensitive file exposure, Web server miss configuration exploitation.

API/Webservices testing: authorization, IDOR, Injections and exploits, API business logic bypass like skipping payments, API misconfigurations.

Identify potential for denial of service (DOS) attacks.

Our IOS Application Penetration Testing process

Scoping – confirm that you want the IOS Application Penetration Test. A scoping sheet can be provided for relevant information sharing.

Attacking – our IOS Application Penetration Testing Team undertake tasks as a Threat Actor would.

Reporting – We present all the weaknesses and vulnerabilities identified during the IOS Application Penetration Test and recommendations on how to fix the weaknesses and vulnerabilities found.

Retesting – Once you have remediated all weaknesses and vulnerabilities, we retest to verify for you, for Free.

Why our approach to IOS Application Penetration Testing is best for you

Our IOS Application Penetration Testing team has over 10 years’ experience per certified security engineer, setting us apart from any other IOS Application Penetration Testing team you may come across.

Compromise Audit

A Compromise Audit is used to identify an ongoing or past attack incident in your business environment.

Get a complete review of your organization’s infrastructure to identify any instances of compromise, undetected backdoors, unauthorized access, and any malicious activities.

Our Compromise Audit Methodology

Endpoint & Network Inspection – Our engineers will conduct a thorough inspection of targeted or vulnerable end-points present in you environment. Specifically we are seeking indicators of malicious actives, such as sensitive data unauthorised access and remote access.

Seek Indicators of Compromise – We apply our comprehensive library of indicators of compromise to evaluate network traffic, servers, workstations, laptops, and critical log data for evidence of current and past attacker activity.

Analyze evidence – Our team will perform an extensive analysis on all findings and will provide you (the client) with recommendations on how to stay safe. Our engineers will confirm initial findings to minimize false positives prior to reporting them.

Detailed Report – We provide a detailed report that summarizes the steps taken during the assessment, the major findings and their risks, and any appropriate recommendations for next steps.

Cyber Security Gap Assessment

A Cyber Security GAP Assessment will make sure that your security measures are meeting all the specific requirements in the industry that you’re active in.

Some industries have specific requirements and standards, it is essential to understand the industry’s best standards and apply them in order to be secure, compliant and gain customers trust, not to mention, build resilience against Threat Actors.

Our Cyber Security Gap Assessment Methodology

We deploy a Cyber Security Gap Assessment methodology built from many years of proven experience, as well as constant vigilance and adaption of new international standards.

The Security Framework Standard

An industry-standard security framework is a benchmark of best practices that can measure and compare your security measures with the standards.

ISO/IEC-27002 standard is specific framework provides best practices for information security management, covering key security areas such as assessment, access control, physical security, and change management.

The ISO standard provides a good framework to compare your security policies and network controls.

We will help you get compliant with the international standards of security applied to you field or industry.

Evaluation of the People and Processes

Many risks related to security breaches are caused by human intervention, such as an employee clicking a phishing email without knowing it. Do you provide employee training to keep your organization aware of changing security threats? Are standard procedures and approvals required before implementing changes?

More importantly, if you encounter a problem, is there an exit procedure? How do you handle access rights for new employees and dismissals?

We help you understand exactly how people access your organization’s network and existing security control.

Data

The goal of data collection is to understand the effectiveness of your existing security procedures operating within the technical framework. In this step, your organizational controls will be compared with best practice standards (such as ISO 27002 and NIST 800-53) and related requirements. This allows you to see how your security process matches other processes that have proven successful.

To discover gaps and vulnerabilities within your organization, obtain samples of network equipment, servers, and applications. Data collection will help to fully understand your technical environment, the security measures that have been implemented, and your overall security effectiveness.

We will help you understand how processes and data are affecting your security.

Analyzing the Cyber Security Program

The last step is a detailed analysis of your safety procedures. Our engineers will correlate the findings and create your IT security profile, including strengths and weaknesses that need improvement. Armed with this information, we can make recommendations for a security plan tailored specifically for you company. A robust security plan should consider cyber risks, staffing, budget requirements, and a timetable for completing security improvements.

We will help you optimize your security measures and will recommend the best practices in order to be fully secured.

Load / Stress Testing

Realistic simulation of peak loads before go live.

We are cyber security engineers with expertise in software performance testing and we can help you identify performance issues before your customers do.

Stress Testing Service

Stress Testing can help verify the stability and reliability of a system.

Our research led approach differentiates us from common penetration testing approaches with an objective to determine a systems robustness and error handling under extremely heavy load conditions.

Our approach includes stress testing well beyond the normal expected operating point and to evaluate how a system works under extreme conditions, to ensure that a system will not crash under heavy load situations.

Under Stress Testing (also known as Endurance Testing) as per our approach, the Application Under Testing (AUT) is stressed for a short period of time to know its withstanding capacity. Our core focus is to determine the limit, at which the system or software or hardware breaks and whether the system demonstrates effective error management under extreme conditions.

Depending on the scale that we will need to run, we can create a master-slave architecture on the AWS and do the same type of tests, distributed, built on-demand, depending on the amount of traffic that we will do the simulation with.

Services that we have conducted so far, are related to Application Layer simulations (simulation normal user different actions with different thresholds of users, different times, spikes etc.) or Volumetric attacks where we simulated with a specific nr of users/visitors decided together with the client (calculating the bandwidth that we will want to achieve).

Type of tests, all of them in conjunction with different agents operating under a master:

– Slowloris attack (different methods and headers)

– HTTP POST/GET flood

– UDP flood

– SSL/TLS renegotiation technique

Focus during Stress Testing

– To accommodate such abnormal traffic spikes.

– To check whether the system works under abnormal conditions.

– Displaying appropriate error message when the system is under stress.

– System failure under extreme conditions.

– It is better to be prepared for extreme conditions by executing Stress Testing.

Goal of Stress Testing

When Stress Testing our goal is to analyse the behaviour of the system after a failure.

For stress testing to be successful, the tested system should display an appropriate error message while it is under extreme conditions.

When undertaking Stress Testing, sometimes, massive data sets are used which may get lost during Stress Testing. Our Stress Testers check parameters to ensure they don’t lose security-related data while under stress testing.

The main purpose of stress testing is to check how fast system recovers after failure.

Load Testing Vs Stress Testing

Methodologies and Best Practices

We follow different approach’s while performing Stress testing depending on the goal(s) to be achieved as set by the client at commencement of project.

Performance Modelling and performance testing on scaled environments are very useful and provide very good analysis of potential performance issues.  However, network testing to actual volumes provides the highest level of risk mitigation when verifying the capacity and performance requirements of a system.

The most reliable and risk adverse approach is to load test to the most realistic concurrent volumes.

Distributed Stress Testing

In this image the server can connect with 2 clients (Client 1 and Client 2), but it cannot send or receive a signal from Client 3 & 4.

In distributed client-server systems, testing is done across all clients from the server.

The role of server under stress testing is to distribute a set of stress tests to all stress clients and track on the status of the client. After the client contacts the server, the server adds the name of the client and starts sending data for testing.

Meanwhile, client machines send a signal or heartbeat that it is connected with the server.

If the server does not receive any signal from the client machine, it needs to be investigated further and debugged.

Application Stress Testing

During Application Stress Testing we concentrate on finding defects related to data locking and blocking, network issues and performance bottlenecks in an application.

Transactional Stress Testing

Transactional Stress Testing is focused on stress testing on one or more transactions between two or more applications. It is used for fine-tuning & optimizing the system.

Systemic Stress Testing

Systemic Stress Testing is deployed for integrated stress testing which can be tested across multiple systems running on the same server. It is used to find defects where one application data blocks another application.

Exploratory Stress Testing

Exploratory Stress Testing is a scenario used to test the system with unusual parameters or conditions that are unlikely to occur in a real scenario. Exploratory Stress Testing is used to find defects in unexpected scenarios such as:

– A large number of users logged at the same time

– If a virus scanner started in all machines simultaneously

– If Database has gone offline when it is accessed from a website

– When a large volume of data is inserted to the database simultaneously

Load Testing Networks

Where a system can support testing to actual volumes we have a performance testing service to meet your requirements.

This service also offers a comprehensive security validation by testing your system while it is experiencing peak load and while some of that load is attacking traffic.

Our Stress Testing Methodology

Our Stress Testing process follows a 6-step plan:

Planning the Stress Test – In this step we gather system data, analyse the system and define the stress test goals

Create Automation Scripts – In this step we create the Stress Test automation scripts and generate the test data for the stress scenarios.

Script Execution – In this step we run the Stress Test automation scripts and store the stress results.

Results Analysis – In this step we analyse the Stress Test results and identify bottlenecks.

Tweaking and Optimization – In this step we fine-tune the system, change configurations and optimize code with the goal of meeting desired benchmarks.

Rerun the entire cycle – In this step we run the entire cycle to determine that changes made have produced desired results. It is not unusual to have to 3 to 4 cycles of the Stress Test process to achieve the performance goals

Tools we use for Stress Testing

LoadRunner

LoadRunner from HP is a widely-used Load Testing tool. Load Test Results shaped by LoadRunner are considered as a benchmark.

Jmeter

Jmeter is an Open-Source testing tool. Jmeter is a pure Java application for stress and Performance Testing. Jmeter is intended to cover types of tests like load, functional, stress, etc. It needs JDK 5 or higher to function.

Stress Tester

Stress Tester provides extensive analysis of web application performance.

Neo load

Neo load is a popular tool available in the market to test the web and Mobile applications. Neo load can simulate thousands of users in order to evaluate the application performance under load and analyse response times. Neo load also supports Cloud-integrated-performance, load and stress testing.

Metrics for Stress Testing

Metrics help in evaluate a system’s performance and are generally studied at the end of Stress Test.

Metrics commonly deployed by XCELIT for Stress Testing are:

Measuring Scalability & Performance

Pages per Second – Measures how many pages have been requested per second. –

Throughput – Basic Metric – Response data size per second.

Rounds – Number of times test scenarios have been planned versus the number of times a client has executed

Application Response

Hit time – Average time to retrieve an image or a page.

Time to the first byte – Time is taken to return the first byte of data or information.

Page Time – Time is taken to retrieve all the information in a page.

Failures

Failed Connections – Number of failed connections refused by the client (weak signal).

Failed Rounds – Number of rounds it that failed. (Rounds – Number of times test scenarios have been planned versus the number of times a client has executed).

Failed Hits – Number of failed attempts by the system (broken links or unseen images).

Summary of our Stress Testing Service

Our Stress Testing service provides a comprehensive concurrent user simulation of user and system traffic. Stress Testing can be conducted while concurrently generating threats and attacking traffic at high loads. We can scale user behaviour to enormous maximum volumes based on your requirements.  This service allows us to measure the transaction response time and service availability of your end users during periods of the highest levels of traffic.

Load testing under real world loads allows us to isolate and resolve problems before your customer encounters them. Our load testing service includes all the hardware and software to generate unlimited user loads in a realistic controlled load test.

Network Resiliency Audit

A Network Resiliency Audit focuses on the current network diagram of the organization’s data center, data recovery sites, and offices. The Network Resiliency Audit is designed to help organizations better organize their network equipment and will provide advice  regarding best practices.

A Network Resiliency Audit will help strengthen your network in terms of security, and maximize the use of network components, network equipment, firewalls and more.

Key Steps in a Network Resiliency Audit

1. Planning

2. Identify Entry Points

3. Identify Perimeter Devices on the network

4. Identify Weak Links in the Design & Architecture

5. Perform a detailed checking

6. Delivery of report/recommendations

Social Engineering & Phishing

What is Social Engineering? Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

Social Engineering techniques are: Phishing, Vishing, Impersonation, Pretexting, Spear Phishing.

Unlike automated platforms, our Social Engineering & Phishing completed by our Penetration Testing team is undertaken by certified experts.

We Track and Report Social Engineering & Phishing Results