Web Application Penetration Testing
Uncover application security vulnerabilities missed during development
Let’s work together to uncover hidden security risks
OWASP Top 10
The OWASP Top Ten is a widely recognized standard for current critical security risks to web applications. Your development team likely uses the list to inform their security decisions, and the controls are embedded in our web application penetration test processes as well. From broken access controls to insecure design and injection vulnerabilities, you can rest assured that our engineers are versed in them all.
Fast and accurate results
A small web application can be properly penetration tested in about 3 days, whereas most average web applications will need about 5 days to complete. Larger web applications with multiple user roles, input fields, and lots of functionality will need 10 days or more to complete.
Validate controls
Your dev team has the responsibility for the entire app – from user experience to security. Your application must validate that all users have authenticated correctly and are authorized to use the proper areas of the application. But security doesn’t end there. The application code must follow proper security procedures to keep data safe. Your developers deal with a lot of moving pieces.
A different perspective
Instead of looking at your application as a credible user would, they take a hacker’s point of view, attempting to exploit business logic vulnerabilities as well as code and configuration issues. Raxis gives your development team useful, actionable feedback to give them to tools they need to secure your application.
How Raxis conducts web application penetration tests
Application testing accounts for half of the assessments Raxis performs each year. Our engineers test the business logic of the application with an attempt to escalate privilege, force data leaks, expose sensitive information, and in extreme cases make the leap from the application into other environments.
Unauthenticated User
We hunt for flaws in the login process as well as authentication bypass techniques such as SQL injection, cross-site scripting, and session fixation. Anything from user enumeration and brute-force attacks to direct object references are considered in-scope.
Administrative User
Once logged in, Raxis maps out the application, looking for technical vulnerabilities as well as business logic gaps and flaws. Configuration issues, client-side processing, and session issues are just a few of the areas your engineer will test from within your application.
Cross-Customer Users
Software as a Service (SaaS) customers often require testing to validate that the customers who use the web application are not able to access other customers’ data. Raxis pentesters look for vulnerabilities that could allow these flaws and work to exploit them.
Low-Privilege User
Raxis performs comprehensive application testing on forms, fields, and services throughout the application using all user roles. Testing as a user with limited permissions makes it possible for our engineers to attempt operations that should only be accessible to higher level users.
Should web app testing be a part of our Software Development Lifecycle (SDLC)?
External Penetration Testing is performed over the internet, aimed solely at the exposed systems that you host online. This is the first line of defense from the bad actors who are scanning for targets each day.
Static testing for new applications
Raxis can test your application in a QA environment before you go live so that you — and your customers — can rest assured that security features have been thoroughly tested and protections are in place to stop malicious actors from gaining access to your site and systems or even disrupting the environment.
Ongoing testing for continuous development
When your application changes rapidly with agile teams pushing updates to production often, Raxis recommends PTaaS for web applications. This service includes on-demand testing, allowing your security to keep up with your constantly changing application.
Cross-site scripting explained
Cross-site scripting, or XSS, is a common vulnerability found on web application penetration tests and is often misunderstood.