Netcraft’s Web Application Testing service is an internet security audit, performed by experienced security professionals. A key feature of the service, and one which cannot be covered by relying solely on automated testing, is application testing.
The service is designed to rigorously push the defences of internet networks and applications. It is suitable for commissioning, third party assurance, post-attack analysis, audit and regulatory purposes where independence and quality of service are important requirements.
A final written report provides an analysis of any security or service problems discovered and their impact, together with proposed solutions and recommendations for improving the security of the service under test. Every report is thoroughly reviewed by at least two experienced members of the application testing team.
The Web Application Testing service can be used to ensure compliance with the Payment Card Industry (PCI) DSS requirement 11.3, (penetration testing) as it includes both network and application layer testing. Netcraft is a PCI Approved Scanning Vendor (PCI ASV).
Areas covered by web application testing
- Configuration errors
- Application loopholes in server code or scripts
- Advice on data that could have been exposed due to past errors
- Testing for known vulnerabilities
- Reducing the risk and enticement to attack
- Advice on fixes and future security plans
Typical issues discovered in a Netcraft web application test
- Cross-site scripting
- SQL injection
- Exposure of sensitive data
- XML External Entity (XXE) attacks
- Broken access controls and weak passwords
- Server misconfigurations
- Deserialization attacks
- Using components with known vulnerabilities
- Remote code execution
- Local file inclusion
- Form/hidden field manipulation
- Weak session management
- Cross-site request forgery
- Insecure use of cryptography
- Back doors and debug options
- Insufficient logging and monitoring
Cost and duration
The duration of a test depends on the size and complexity of a site, but can start from six days (approx four days testing, two writing up and review).