Security Testing for Web Applications - Secure Java: For Web Application Development - page 236

11.1.1.1 Black-Box Testing
Black-box techniques are those that consider the Web application to be a black-box; in other
words, these testing techniques do not delve into the code of the application but test the security of
the application using certain external techniques that are used to exploit vulnerabilities present in
Web applications. Black-box testing simulates a real-world scenario, where an attacker would iden-
tify and exploit certain Web application vulnerabilities using form ields of the Web application,
URLs, tampering of parameters, and so on. he two practices commonly employed to perform
black-box security testing for Web applications are vulnerability assessments and penetration tests .
11.1.1.1.1 Vulnerability Assessment
Vulnerability assessment (VA) can be deined as the methodical evaluation of an organization's IT
weaknesses of infrastructure components and assets and how those weaknesses can be mitigated
through proper security controls and recommendations to remediate exposure to risks, threats,
and vulnerabilities. VA is a process where an individual or a group of individuals run a number of
tests to assess the number and type of vulnerabilities that exist in the Web application. VA is an
important exercise that, when performed efectively, provides critical information about the type
of vulnerability, the severity of the vulnerability, and the possible remedy for the vulnerability. VAs
can be performed with a combination of manual and automated tools. here are several applica-
tions available in the marketplace that perform VAs for Web applications and provide detailed
information about the vulnerabilities found, the severity of the vulnerability, the nature of the vul-
nerability, and the possible recommendation(s) for ixing the said vulnerability. Most automated
VA tools also provide scores, which are calculated based on industry-standard scoring systems for
vulnerabilities, and arrive at the severity of the vulnerability based on these scoring metrics.
Manual techniques are also important while carrying out a comprehensive VA. Although auto-
mated VA tools perform vulnerability assessments up to a certain level, they are not able to capture
all the vulnerabilities that might exist in a Web application. Manual VA techniques are used to
explore the identiied vulnerabilities with greater depth and also assess certain vulnerabilities like
lawed authorization controls and laws in business logic of Web application with rigor. We will
explore some of the automated and manual VA techniques in detail in Chapter 12.
11.1.1.1.2 Penetration Testing
A penetration test can be deined as the process of using approved, qualiied personnel to conduct real-
world attacks against a system so as to identify and correct security weaknesses before they are discovered
and exploited by others. Penetration testing (PT) is a process that goes a step further than a vulner-
ability assessment. hese tests aims at exploiting identiied vulnerabilities in a way that an attacker
would maliciously exploit Web application vulnerabilities. In a penetration test, the tester would
gather information, enumerate the vulnerabilities, and lastly would exploit the given vulnerabili-
ties and gain access to the system. he rationale for a penetration test is to simulate a real-world
attack on a Web application and showcase a proof-of-concept of an attack that is perpetrated by a
determined attacker against the Web application. PT can also be performed with automated tools,
but it is equally efective, if not more when performed manually, as penetration testing involves
several processes involving elevation of privileges or gaining access to the system, which may not
be adequately simulated by an automated tool. We will cover PT techniques in Chapter 12.