Whether it’s a new website, an updated website, or an annual process required by PCI. Let us hack you before the bad guys do.

Vulnerabilities in web applications are responsible for some of the most high profile data breaches today. Not only that, a compromised web application can host stored cross site scripting (XSS) which can be used to target the browser of every single visitor to your site. These types of vulnerabilities can cause severe damage to your brand and reputation if not dealt with.

Core Sentinel’s web application penetration testing service will enable your business to identify and close off any vulnerabilities discovered in your web application, thus considerably reducing risk and providing assurance to your brand, reputation, and your customers.

Web Application Testing Methodology

Core Sentinel has developed a world class, comprehensive web application penetration testing methodology which is based upon the Open Web Application Security Project (OWASP), CWE/SANS Top 25 Most Dangerous Software Errors, The Open Source Security Testing Methodology Manual (OSSTMM), National Institute of Standards and Technology Special Publication 800-115 (NIST 800-115), and our own independent research.

This means, at minimum we will perform rigorous testing covering all of the the OWASP top ten vulnerabilities which address what is considered by industry consensus to be the most critical and prevalent web application security flaws:

OWASP A1: Injection (including SQL, LDAP, XPath, OS commands, program arguments, etc.)

OWASP A2: Broken authentication and session management (including logout, password management,timeouts, remember me, secret question, account update, etc.)

OWASP A3: Cross-site scripting (XSS) (stored and reflected, both on the server and client.)

OWASP A4: Insecure direct object references (is the user authorized for the target object?)

OWASP A5: Security misconfiguration (within the platform, web server, application server, database,framework, and custom code.)

OWASP A6: Sensitive data exposure (weak crypto, hashing, passwords protecting sensitive data.)

OWASP A7: Missing function level access control (could changing a parameter in the URL grant access to a privileged function by an anonymous user?)

OWASP A8: Cross-site request forgery (Does the application use an unpredictable token to protect against a forged HTTP request?)

OWASP A9: Using components with known vulnerabilities (Can an attacker find the version of a web component which has a known published vulnerability?)

OWASP A10: Unvalidated redirects and forwards (Can an attacker manipulate an unvalidated parameter to choose the destination page of a redirect?)

What You Get

• 1. Expert security consulting throughout the engagement from end-to-end.
• 2. A comprehensive report with an executive summary, and a prioritised list of risk ranked vulnerabilities in order of remediation priority, detailing exactly why they are a risk and how to fix them.
• 3. A manual re-test of vulnerabilities after remediation work is complete to verify they are closed off.

The following flow chart illustrates our quality controlled penetration testing process from the start until the end of the engagement: