Application Penetration Testing
- Home
- /
- Application Penetration Testing
Our testing methodology goes beyond automated scans and
uses highly curated approach to mimic the modern attacks and manipulation of
your application.
Doing a penetration testing before go live of any
application must be an integral part of any organization IT governance and
policies. Taking a short cut by running a code scanner or crawling on app
source code leaves holes in the application for cyber attackers as most code
scanning tools just find the low hanging vulnerabilities to fix.
We put ourself in attackers’ shoes and use an ala-carte
combination of commercial industry benchmark automated scanners, manual
processes, commercial and in-house developed scripts and tools to test the
resiliency of application.
How Our Application Penetration Testing Works
Step 1: Kick off and Scope Agreement
Once we receive the query from your side on Application Pen Test, we organize a virtual meet or in-person meet at your office to discuss about the goals and deliverables you want. In this meeting the scope will be discussed and finalized. The target completion date(generally 2-3 weeks) will be fixed along with exclusions from testing.
Step 2: Execution
Our Pentesters will start with extensive recon and will pursue all possible ways to break into your application as identified in scope of work. We will the present the loopholes in your application in our comprehensive penetration test report. We will categorize the risks into 5 main buckets as explained in below chart
The Severity of Vulnerabilities
Critical
Attacked could potentially abuse this vulnerability to exploit and gain access to highly sensitive asset or root-level compromise. can be severe threat to business of company. Compromise of high value asset and information within the organization. Exploitation is usually straightforward, in the sense that the attacked does not need any special authentication credentials or knowledge about individual victims.
High
This vulnerability can allow malicious attackers to access application resource and data. This can allow an attacker to steal session information or sensitive data from the application or server.
Medium
By exploiting these security issues, malicious attackers can access sensitive information on the application or server. The issues marked as Medium Severity usually arise because of errors and deficiencies in the application configuration.
Low
Highly unlikely to be exploited. Generally, they are used in conjugation with Critical, High and Medium vulnerabilities.
Informational
This finding does not indicate vulnerability, but states a comment that notifies about design flaws and improper implementation that might cause a problem in the long run.
