Application penetration testing

Targets

Application penetration testing has a strictly predefined scope that covers every endpoint and component of the application environment reachable by an attacker. This ensures vulnerabilities that arise from the interaction between different parts of the application — such as mobile and web APIs — are captured within the scope.

Penetration testing models

Penetration testing activities may be performed with different levels of environment information and access available to the tester. Testing methods and techniques differ based on that level, and it is sometimes recommended to conduct testing in several stages to have a better understanding of the application and potential security risks.

Blackbox testing

No prior knowledge of the application, its components, architecture, or functionality — and no test accounts beyond initial access. It emulates an outside threat well, but is best combined with other methods for fuller coverage.

Greybox testing

Builds on Blackbox by providing client accounts, API documentation and schematics, and a list of application components. The most common approach, balancing effectiveness with a realistic simulation of a persistent outside threat.

WhiteBox testing

Full administrative access to every host and component, including source code. The most thorough method — though it makes it harder to gauge exploitability the way a real outside attacker would experience it.

Methodology

In order to conduct application penetration tests, we rely on industry-wide accepted best practices and methodologies, mainly:

OSSTMM (Open Source Security Testing Methodology Manual)
OWASP (Open Web Application Security Project) manuals and guidelines
NIST and ISACA penetration testing and auditing standards and guidelines

Relying on industry standards helps us not only to maintain a consistent testing process but to provide our customers with thorough and standard-compliant penetration tests.