TASK REPORT 2

TASK REPORT 2
# Testing methodology on Web application
1. Footprint Web Infrastructure

2. Analyze web application
3. Bypass client-side controls
4. Attack authentication mechanism
5. Attack Authorization Schemes
6. Attack access controls
7. Attack Session Management Mechanism
8. Perform Injection Attacks
9. Attack Application Logic Flaws
10. Attack shared environments
11. Attack database connectivity
12. Attack web app client
13. Attack web services
# What is DevSecOps
DevSecOps, which stands for development, security, and operations, is a framework that
integrates security into all phases of the software development lifecycle. Organizations adopt
this approach to reduce the risk of releasing code with security vulnerabilities
# Various SAST & DAST Tools and differences
SAST (Static Application Security Testing):

 How it works: SAST tools analyze the source code, bytecode, or binary code of an
application without running it. It scans the codebase to identify security vulnerabilities
early in the development process.
 When it’s used: During development, before the application is deployed.
 Focus: Finds issues like coding errors, insecure APIs, or unhandled exceptions that could
lead to vulnerabilities.
Popular SAST Tools:

1. SonarQube: Analyzes code quality and security vulnerabilities across different languages.
2. Checkmarx: Focuses on detecting security vulnerabilities in the source code.
3. Fortify Static Code Analyzer (SCA): Detects vulnerabilities in code and provides detailed
reports.
4. Veracode Static Analysis: Scans code for vulnerabilities across a wide range of
languages.
5. Brakeman: A SAST tool specifically for Ruby on Rails applications.
DAST (Dynamic Application Security Testing):

 How it works: DAST tools test the application while it’s running (usually in a staging or
live environment). It simulates attacks to find security vulnerabilities in the app’s
functionality, APIs, and user interface.
 When it’s used: After the application is built and deployed, during testing or in
production.
 Focus: Finds vulnerabilities like SQL injection, cross-site scripting (XSS), or other runtime
issues.
Popular DAST Tools:

1. OWASP ZAP: An open-source tool that identifies security vulnerabilities in web
applications.
2. Burp Suite: A powerful tool for testing web app security through active and passive
scans.
3. Netsparker: Identifies a wide range of security issues in web apps and APIs.
4. Acunetix: Automates security testing for websites and APIs with a focus on detecting
common vulnerabilities like SQL injection and XSS.
5. AppSpider: Scans web and mobile applications to detect security weaknesses.
# How to secure Web applications efficiently
 Web application firewall

A critical component of web application security, a firewall protects against attacks like SQL
injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
 Encryption
Encrypt data in transit and at rest. Use HTTPS and keep SSL up to date.
 Authentication and authorization
An effective authentication and authorization mechanism prevents unauthorized access and
protects user data. Strong authentication protocols, like MFA with biometric authentication, can
reduce the risk of unauthorized access.
 Secure coding practices
Developers can prevent potential vulnerabilities and cyberattacks by following secure coding
best practices.
 Validate inputs
Verify all data submitted to your application for type, length, format, and range. This prevents
attackers from injecting malicious code into your system.
 Dynamic application security testing
This is a good way to ensure that you are delivering secure applications. There are many free
and open source tools to support your testing.
# Here are the screenshots for the tryhackme room labs which I have
completed
(1) https://portswigger.net/web-security/os-command-injection/lab-
simple
(2)https://portswigger.net/web-security/websockets/lab-
manipulating-messages-to-exploit-vulnerabilities
 SUBMITTED BY = ANURAG SONI (anuraggx)

TASK REPORT 2

Uploaded by

Copyright:

Available Formats

TASK REPORT 2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

TASK REPORT 2

Uploaded by

Copyright:

Available Formats

TASK REPORT 2

# Testing methodology on Web application

1. Footprint Web Infrastructure

SAST (Static Application Security Testing):

Popular SAST Tools:

DAST (Dynamic Application Security Testing):

Popular DAST Tools:

# How to secure Web applications efficiently

 Web application firewall

 SUBMITTED BY = ANURAG SONI (anuraggx)

You might also like