活動

  • Griffith Becker 的簡介照片

    Griffith Becker 發表更新 7 年, 9 月前

    To secure a website or a web application, one has to first understand the target application, how it works and the scope behind it. Ideally, the penetration tester should have some basic knowledge of programming and scripting languages, and also web security.

    A website security audit usually consists of two steps. Most of the time, the first step usually is to launch an automated scan. Afterwards, depending on the results and the website’s complexity, a manual penetration test follows. To properly complete

    Website Security Audit Checklist automated and manual audits, a number of tools are available, to simplify the process and make it efficient from the business point of view. Automated
    Security Audit Of Website Checklist help the user making sure the whole website is properly crawled, and that no input or parameter is left unchecked. Automated web vulnerability scanners also help in finding a high percentage of the technical vulnerabilities, and give you a very good overview of the website’s structure, and security status. Thanks to automated scanners, you can have a better overview and understanding of the target website, which eases the manual penetration process.

    For the manual security audit, one should also have a number of tools to ease the process, such as tools to launch fuzzing tests, tools to edit HTTP requests and review HTTP responses, proxy to analyse the traffic and so on.

    In this white paper we explain in detail how to do a complete website security audit and focus on using the right approach and tools. We describe the whole process of securing a website in an easy to read step by step format; what needs to be done prior to launching an automated website vulnerability scan up till the manual penetration testing phase.

    Manual Assessment of target website or web application

    Securing a website or a web application with an automated web vulnerability scanner can be a straight forward and productive process, if all the necessary pre-scan tasks and procedures are taken care of. Depending on the size and complexity of the web application structure, launching an automated web security scan with typical ‘out of the box’ settings, may lead to a number of false positives, waste of time and frustration.

    Even though in recent year’s web vulnerability scanning technology has improved, a good web vulnerability scanner sometimes needs to be pre-configured. Web vulnerability scanners are designed to scan a wide variety of complex custom made web applications. Therefore most of the times, one would need to fine tune the scanner to his or her needs to achieve the desired correct scan results.

    Before launching any kind of automated security scanning process, a manual assessment of the target website needs to be performed. It is a well known fact that an automated scanner will scan every entry point in your website which most likely you tend to forget, and test it for a wide variety of vulnerabilities.

    During the manual assessment, familiarize yourself with the website topology and architecture. Keep record of the number of pages and files present in the website, and take record of the directory and file structure. If you have access to the website’s root directory and source code, take your time to get to know it. If not, you can manually hover the links throughout the website. This process will help you understand the structure of the URL’s. Also, take a note of all the submission and other type of online forms available on the website.

    During the pre-automated scan manual assessment, apart from getting used to directory structures and number of files, get to know what web technology is used to develop the target website, e.g. .NET or PHP. There are a number of vulnerabilities which are specific for different types of technologies. Other details you should lookout for when manually assessing a website are;

    Does the website require client certificates to be accessed?

    Is
    Website Security Audit using a backend database? If yes, what type of database is it?

    Is the database server running on the same server as the website?

    Are all the sensitive records being encrypted?

    Are there any URL parameters or URL rewrite rules being used for site navigation?

    When a non existing URL is requested, does the web server return a HTTP Status Code 404, or does it return a custom error page and responds with a HTTP Status Code 200?

    Are there any particular input forms or one time entry forms (such as CAPTCHA and Single Sign on forms) that need user input during an automated scan?

    Are there any password protected sections in the website?

    Once the manual assessment process is ready, you should know enough about the target website to help you determine if the website was properly crawled from the automated black box scanner before a scan is launched. If
    How To Security Audit A Website is not crawled properly, i.e. the scanner is unable to crawl some parts or parameters from the website; the whole “securing the website” point is invalidated. The manual assessment will help you go a long way towards heading off invalid scans and false positives. It will also help you get more familiar with the website itself, and that’s the best way to help you configure the automated scanner to cover and check the entire website.

No Responses to “活動”

Trackbacks & Pings

  • expert-ocenka.com.ua :

    expert-ocenka.com.ua

    “月”求中秋能`”逢圓”， 我求 親情 ，友情 ， 天天似中秋情更圓。 祝大家中秋節快樂喔! – lucky小如的部落格

    6 年 ago
Translate »
跳至工具列