PENETRATION TESTING

Security Penetration Testing Overview

Want to find out what a hacker could do to you? Penetration testing is a very effective means of identifying and validating holes in a web application. MUSINGWAY goes far beyond vulnerability scanning and system testing, exercising your application's ability to handle unexpected situations and typically discovers serious flaws. By carefully planning the effort, we focus on the areas of your application that are most likely to yield a serious compromise. Our tools allow us to probe deep into web applications to find flaws

Details

MUSINGWAY follows a well-defined penetration testing methodology to attempt to penetrate web applications.

First, we browse the website in order to familiarize ourselves with the business model and the general operation of the site. We save off the html source code for all the areas of the site that we encounter. During this process we begin to track all the different pieces of the site and formulate possible areas of weakness. During this stage we do not attempt penetrations, although we keep a careful list of possible targets.

After completion of a full walkthrough of the web application to understand its intended operation, we analyze the saved html and our other findings. We prepare a possible penetration list of areas most likely to result in a successful penetration and prioritize this list based on the likelihood of a successful compromise and the magnitude of the expected consequence. During penetration attempts we focus on finding the highest risk items first, to perform the most efficient penetration. As we proceed through the list, we generate a detailed report of findings. If we uncover another likely penetration candidate during the exploitation process, we add it to the list and reprioritize.

As we proceed through the list, we keep careful notes on everything we try. We use our best judgment about where we are most likely to uncover serious vulnerabilities. For details on the specific vulnerabilities we typically look for in web applications, please check our vulnerabilities page.

Getting Started

We use a short questionnaire to help us understand the scope of the effort and your rules of engagement. Considerations include the complexity of the site, number of independent security mechanisms, number of pages and forms, and the number of backside systems being used.

Once the project is approved and under an NDA, we will begin the test at a time that is convenient for you. We have strict procedures in place for protecting anything we find out about your site and will never disclose it or use it for anything outside the scope of our review.

We select a penetration team for your application and hold a brief telephone conference to discuss the details of the test. We expect to be in frequent communication with you during the test, and we will contact you if we identify a serious problem in an application, or if we have questions about how something in the application is supposed to work. All of our findings are clearly described with references to specific parts of the application and our recommendations for remediation.

Periodic penetration testing is an important part of any software engineering project. Many cyber-risk insurance policies now require penetration testing before a policy can be granted.