Web App Penetration Testing

Application Security Assessment

Web App Penetration Testing

Torrid has an extensive history of performing application security assessment. Torrid's application security services are designed to be most efficient and wholesome so as to suit the customized needs of your organization. Our world-class team of security researchers developed highly effective methodology and tools that enable us to quickly assess and identify security problems and issues in web applications. Our team strictly follows industry standard and guidelines (Microsoft Security Development Lifecycle, OWASP, OSSTMM et al.) to bring the maximum value for clients.

Application-level testing uncovers design and logic flaws that could result in the compromise or unauthorized access of your networks, systems, applications or information. The Torrid Information Security Center of Excellence (ISCoE) uses Application Testing to identify and investigate the extent and criticality of vulnerabilities found in thin client (web browser) and thick client applications, including front-end and backend systems. Activities range from injections and cross-site scripting to decompiling code and HTML proxy manipulation.

Torrid’s Penetration Testing Approach

At TORRID, our penetration testing services provide a more complete view of the IT infrastructure security. Testing will typically be performed from a number of network access points, representing each logical and physical segment.

Web Application Penetration Testing could be done at various levels:

Black-box Testing: Testing the application without the knowledge on the application. This testing process involves simulating the attack as a normal user without having access to the source code.
Grey-Box Testing: Testing the application with limited knowledge on the application. This testing process involves simulating the attack with the use of user credentials or limited access to the application.

Testing is conducted with the help of automated scanners, custom scripts followed by in-depth manual security testing against the application. The Torrid approach towards penetration testing is as follows:

Information Gathering
Application Fingerprinting
Identifying vulnerabilities in the application
Vulnerability validation and building test cases
Exploiting the vulnerabilities
Recommendations and Reporting

Benefits

Identify design flaws and improve the security of your application at the development level.
Determine if client software may be manipulated to provide unauthorized access.
Identifies specific risks to the organization and provides detailed recommendations to mitigate them.
Supports user confidence in application security.
Helps prevent application downtime and improve productivity.
Protect your organization’s information assets and reputation.

Deliverables

1. Management Report:

A high-level executive summary report highlighting the key risk areas and the impact from successful exploitation of vulnerabilities.

2. Technical Vulnerability Report:

A detailed report about security issues discovered, CVE, Bugtraq and vendor references for these, recommendations to address the issues.

3. Best Practices Document

Guidelines based on industry standards and regulations for compliance with IT standards and best practices.