Application Testing

Application security issues are the most common issues for business today because of their complexity. Application security is related with the combination of; security of supporting infrastructure, hardening of supporting servers (such as application, database server) and the secure source code.

The Web Application Testing Methodology is divided into three distinct phases; Profiling, Assessment and Exploitation.

Additionally, testing will be performed for the Application's Network Infrastructure for hosts and systems within the scope.

Profiling Phase

Information Gathering (Reconnaissance) Techniques will be performed to gather as much information as possible about the Application's Site Structure and Network Infrastructure.

Specifically, the following techniques will be used to find and assess any security-related information:-

Information Gathering / Reconnaissance

Crawling the Application: Using Crawling techniques to identify all visible directories and scripts.

Analyzing Traffic: Using HTTP Proxying techniques to analyze traffic (HTTP Requests/Responses) between client's browser and the server, focusing on HTTP Headers, Cookies, Forms (GET, POST), URL Parameters, Source Code and Comments.


Knowing the Application: Using the Application normally from both unauthorized/authorized user perspectives -all different privileged levels provided- to fully understand Application's functions and mechanisms.

Architecture / Technologies: Identifying Web/Proxy/Application/Database Servers, Load-Balanced/Firewall(IDS/IPS/WAFs) Architectures, Frameworks (PHP,.NET, JAVA), Web Services (SOA/WOA/SaaS) and Structures (XML, JSON, RSS).

Assessment Phase

Both automated and manual vulnerability assessment will be performed - based on the information found from the Profiling Phase - against the Application's Structure to ensure that all known and unknown vulnerabilities will be identified.

Specifically, the following vulnerability assessment techniques will be used:-

Vulnerability Assessment


Site Structure


       Sitemaps (robots.txt, sitemap.xml, etc.)

       Hidden Structure (Brute-forcing for Files/Directories, Old/Backup Files, etc.)

       Directory Listing / Indexing

       Error Handling

       Information Leakages (Error Messages, Comments, etc.)

       Client-Side Input Validation and Sanitization

       Lack of Patching


Input Validation /



       Buffer Overflows Attacks

       Format String Attacks

       Injection Attacks (OS/SQL/LDAP/XML/SSI/SMTP/Code)

       File Inclusion Attacks (Local/Remote)

       Cross-Site Scripting (XSS): Reflected/Persistent/DOM-based

       XML eXternal Entity Attacks (XXE)

       URL Redirection to Untrusted Site (Open Redirect)

       Path Traversal




       Authentication Functions Review (Log-In, Log-Out, Remember Me, Password Change/Reset, Register)

       Username / Password / Lock-Out Policy Review

       Account Enumeration Possibilities

       Replay Attacks

       Credentials over unencrypted channel


Session Manipulation


       Cookies Attributes (httponly, secure, path, domain)

       Concurrent Sessions

       Session Riding / Cross-Site Request Forgery (XSRF)

       Session Prediction

       Session Fixation

       Session Hijacking

       Session Expiration

       Tokens over unencrypted channel


Application Logic / Misconfigurations


       General Application Logic security flaws and Misconfigurations that could allow a user to do something that isn't normally allowed by the Application (e.g. Removing money from a user's bank account by sending her a negative amount of money)

Exploitation Phase

At the exploitation stage we will try to exploit and validate the existence of the identified vulnerabilities. Both online and offline password cracking techniques (e.g. Guessing, Dictionary, Hybrid, Brute-force) will be performed against password hashes (e.g. MD5) and/or authentication points found from previous steps of testing. In case of successful exploitation we will try to escalate privileges within applications, hosts and networks.