Web Application Penetration Testing Training 10

1
SECURIUM FOX offers cyber security consultancy
services with its expert and experienced team. We
are providing consulting services to prevent
cyber attacks, data leak and to ensure that our
customers are ready and safe against cyber
attacks, with more than 15 years of
experience.In addition to pentests and
consulting services, SECURIUM FOX prepares its
customers and field enthusiasts for real life
scenarios by providing trainings in the lab
environment which was prepared by themselves,
with its young, dynamic and constantly following
team.Everytime that hackers are in our lives,
there are always risks that we can face with a
cyber attack. Over the years cyber security has
become a critical precaution for all
organizations and companies after the effects and
number of attacks. SECURIUM FOX tests the weak
points of customers for possible attacks and
provides consulting services to eliminate these
weak points.SECURIUM FOX team also offers
support for the development of our country in
this field by supporting free events being
organized as a volunteer by the Octosec team.
ABOUT US
2

• WEB APPLICATION SECURITY AND PENETRATION TESTING
  TRAINING

3
Penetration Testing

• Penetration testing examines the security of an
  environment from the perspective of a malicious
  source and is an invaluable component of an
  organization's information security program. Its
  also required for PCI compliance in Requirement
  11.3 and recommended in other numerous regulatory
  compliance frameworks.
• Typically, an application or environment is
  tested for potential vulnerabilities that may be
  the result of incorrect configuration, hardware
  or software vulnerabilities, or operational
  weaknesses in process or technical
  countermeasures.
• AppliedTrust conducts penetration testing in the
  following areas

4

• Web application
• Application programming interface (API)
• Mobile application
• Infrastructure
• Internet of Things (IoT)

5

• There are many types of penetration testing. One
  common type is black-box testing, in which the
  testing team is given no information about the
  environment architecture or composition prior to
  conducting the test. This approach is much like
  assessing a barn for cracks by walking around the
  outside the large cracks or missing boards are
  most easily visible.
• On the other end of the spectrum is white-box
  testing, in which the details of the application
  code, network device configurations, network and
  system diagrams, and/or account information are
  shared with the evaluation team before the test.
  This method is akin to assessing a barn for
  cracks by walking inside on a sunny day the sun
  streaming inside the barn makes even the smallest
  hole easily visible.

6

• Gray-box testing is somewhere in between with
  this method, depending on the environment, the
  testers receive some internal detail as input to
  the test. The goal is to leverage existing
  information about the environment, such as
  API/application documentation and network
  diagrams, as well as work with developers and
  system administrators as necessary, to provide a
  much deeper analysis of the system. Often, a
  penetration tester will identify unusual behavior
  that a developer or system administrator can
  provide insight into immediately, allowing the
  tester to focus attention on other areas. This
  approach also provides more exact information
  regarding the location and/or cause of a
  vulnerability.

7

• AppliedTrust's certified security experts perform
  penetration testing across the spectrum of
  black-box and white-box testing. We customize
  each test based on the functionality/purpose of
  the application or environment and conduct them
  in an open, ethical way so the results can be
  trusted and your organization's production
  environment isn't unexpectedly impacted.
  Regardless of the type of testing, each
  engagement combines the use of automated tools
  with hands-on analysis by qualified engineers to
  produce a detailed, risk-based report with
  actionable recommendations for mitigation.

8

• Web Application Penetration Testing
• Many penetration tests either focus exclusively
  on a web application, or web applications are
  identified during the discovery phase of a
  network. Regardless of the scope, if a web
  application is identified during penetration
  testing, web application-specific attack vectors
  will be investigated. AppliedTrust leverages the
  OWASP Testing Guide and WASC Threat
  Classification as starting points for web
  application penetration testing. Once more
  information about the environment is identified
  during the discovery phase, architecture/language-
  specific testing vectors will be assessed as
  well.
• API Penetration Testing
• An application programming interface (API) is a
  set of clearly defined methods of communication
  between various software components. API
  penetration testing is typically included with
  mobile application testing and involves testing
  both the API server infr

9

• Mobile Application Penetration Testing
• Penetration testing can be done on any iOS or
  Android mobile application. In addition to
  assessing and attempting to exploit
  technology-specific vulnerabilities, AppliedTrust
  also tests for the OWASP Mobile Top 10 list of
  common vulnerabilities affecting mobile
  applications, which include improper platform
  usage, insecure data storage, insecure
  communication, insecure authentication, insecure
  authorization, and extraneous functionality.
• Infrastructure Penetration Testing
• Infrastructure penetration testing focuses on
  finding vulnerabilities and exploits at all
  levels of an environment. Testing can include
  exploitation at the network, system, service, or
  application level to identify areas of weakness.
  Once the testing scope is set, vulnerabilities
  are identified and exploited to open up potential
  pivots to other devices that may have been
  considered secure. As with other forms of
  penetration testing, AppliedTrust leverages
  opensource testing methodologies such as the
  OWASP Testing Guide and the Open Source Security
  Testing Methodology Manual (OSSTMM), along with
  experience gained over time from previous tests,
  to complete a thorough review of any environment.

10

• Internet of Things" (IoT) Penetration Testing
• IoT penetration testing is inherently more
  complicated because there are more hardware,
  software, and communication protocols involved,
  leading to a larger attack surface and a wider
  range of attack vectors. IoT penetration testing
  engagements combine elements of web application,
  mobile application, API, and infrastructure
  penetration testing. Additionally, AppliedTrust
  utilizes the framework from the OWASP IoT Testing
  Guidance and IoT Top 10 list of common
  vulnerabilities affecting IoT devices, which
  address attack vectors such as weaknesses in data
  communication protocols (Ethernet, 802.11,
  Bluetooth, NFC), weaknesses in physical
  interfaces including USB ports or other entry
  points, and testing of embedded devices network
  interface, among others.

11

• You can always contact with SECURIUM FOX. You can
  contact us through our email addresses or by
  using the contact form on the side.

• INFO
• 3rd Floor,Lohia Towers,
• Nirmala Convent Rd,
• Gurunanak Nagar,Patamata,Vijyawada,
• Andhra Pradesh -520010
• 9652038194
• 08666678997
• info_at_securiumfoxtechnologies.com

12
info_at_securiumfoxtechnologies.com Andhra Pradesh
Office 91 8666678997,91 91652038194 3rd
Floor,Lohia Towers, Nirmala Convent Rd,Gurunanak
Nagar,Patamata,Vijayawada, info_at_securiumfoxtechnol
ogies.com UK Office 44 2030263164 Velevate,
Kemp House, 152 - 160,City Road,EC1V
2NX London info_at_securiumfoxtechnologies.com Tamil
Nadu Office 91 9566884661 Kailash Nagar, Nagar,
Tiruchirappalli, Tamil Nadu 620019 info_at_securiumfo
xtechnologies.com
Noida Office 91 (120) 4291672, 91
9319918771 A-25, Block A, Second Floor,Sector -
3, Noida, India info_at_securiumfoxtechnologies.com
USA Office 1 [phone] 33 West,17th
Street, New York, NY-10011, USA info_at_securiumfoxte
chnologies.com Dubai Office 971 545391952 Al
Ansari Exchange, Ansar Gallery - Karama Branch,
Hamsah-A Building - 3 A St - Dubai - United Arab
Emirates