Assessment

Strengthen Your Cyber Security with Our Web Application Penetration Testing

Making sure that almost all aspect of your web application is being checked and verified.

Almost all organisations have their own websites. It can either be their corporate website, customer portal, webmail, etc. Most of the applications are built with workability, business flow, and customer experience in mind. However, due to a lack of awareness of secure coding practices, this often results in the application being a risk to the organization.

FIRMUS’ approach to web application testing would be in two areas: authenticated and non-authenticated testing. This is to ensure we cover all the pages that are available on the website from a user and non-user perspective. Vulnerabilities such as SQL Injection, Cross Site Scripting, Directory Traversal and many more can be find by performing this web application penetration testing. By using a popular methodology for Web Application Penetration Testing called OWASP, FIRMUS makes sure that almost all aspects of the web application are being checked and verified. Handholding the customer during the period of remediation is one of our policies after we have submitted our findings to ensure all vulnerabilities that were found are closed and verified.

Scope of Work

STAGE 1 - PLANNING

Assessment Preparation

Information Gathering

STAGE 2 - DISCOVERY

Session Management Testing

  • User Enumeration
  • Multiple Factors Authentication
  • Cookies Attributes

Authorization Testing

  • Authentication Bypass
  • Directory Traversal
  • Logout & Browser Cache

Session Management Testing

  • Session Token
  • Cross Site Request Forgery
  • HTTP Exploiting

Data Validation Testing

  • Cross Site Scripting
  • Script Injection Input Validation

Web Service Testing

  • XML Structural Testing
  • XML Large Payload
  • HTTP Methods

Information Leakage

  • Application Banners
  • Application Help Message
  • Debug / Error Message

Configuration Management

  • Infra & App Configuration Testing
  • File Extension Handling
  • HTTP Methods and XST

STAGE 3 - FINDING VERIFICATIONS

Verification on Finding Results

STAGE 4 - REPORTING

Findings Discussion

Report & Presentation

Post Corrective Action Review

Explore Our Assessment Services

Let us help you make informed decisions and set your business up for success through our range of assessment services.

Network Penetration Testing

Web Application Penetration Testing

Incident Response (IR)

Source Code Review

Mobile Application Penetration Testing

Security Configuration Review

Social Engineering

Wireless Penetration Testing

Breach and Attack Simulation (BAS)

Compromise Assessment

Intelligence Led Penetration Testing

Network Resiliency Assessment

Red Teaming

Talk To Us

Penetration testing, cyber security strategy, proof-of-value, or just some information? Our domain experts provide bespoke cyber security offerings to solve your digital transformation challenges.