Overview

Web application security testing is a broad process that includes a multitude of processes that enable security testing of a Web application. It is a systematic process that starts from identifying and scoping the entire application, followed by planning multiple tests.

Typically, Web application security testing is performed after the Web application is developed. The Web application undergoes a rigorous testing process that includes a series of fabricated malicious attacks to see how well the Web application performs/responds. The overall security testing process is generally followed by a format report that includes the identified vulnerabilities, possible threats and recommendations for overcoming the security shortfalls.

Some of the processes within the testing process include

• Brute force attack testing
• Password quality rules
• Session cookies
• User authorization processes
• SQL injection

Goals

Your goals are specific places where you want to end up. One of your goals might be to improve the security of your web applications so the business stops getting negative audit and compliance reports, or for some to stop having malicious intrusions and hack attacks.

Objectives

Your objectives are sub-goals that you must meet in order to achieve your longer-term goals. One of your objectives might to be to establish a periodic web application security testing plan for the next year, for example every month or every quarter or any time code changes are made to your business web applications.

Features

• Application and server configuration. Potential defects are related to encryption/cryptographic configurations, Web server configurations, etc.
• Input validation and error handling. SQL injection, cross-site scripting (XSS), and other common injection vulnerabilities are the result of poor input and output handling.
• Authentication and session management. Vulnerabilities potentially resulting in user impersonation. Credential strength and protection should also be considered.
• Authorization. Testing the ability of the application to protect against vertical and horizontal privilege escalations.
• Business logic. These are important to most applications that provide business functionality.
• Client-side logic. With modern, JavaScript-heavy webpages, in addition to webpages using other types of client-side technologies (e.g., Silverlight, Flash, Java applets), this type of feature is becoming more prevalent.