Web Penetration Testing

Penetration testing is a common technique used to test network security. However, web penetration testing areana is more akin to pure research. Some automated penetration testing tools have been developed, but considering the bespoke nature of web applications, their effectiveness alone is usually poor.

Nowadays, companies sell web application penetration testing as a service to consumers. Web application penetration testing becomes the primary security testing technique. Whilst it certainly has its place in a testing program, I generally do not believe it should be considered as the primary security testing technique. Gary McGraw wrote in Software Penetration Testing, “In practice, a penetration test can only identify a small representative sample of all possible security risks in a system”. However, focused penetration testing (i.e., testing that attempts to exploit known vulnerabilities detected in previous reviews, can be useful in detecting if some specific vulnerabilities are actually fixed in the source code deployed on the website.)

Pros

1. Can be fast (and therefore cheap)
2. Requires a relatively lower skill-set than source code review
3. Tests the code that is actually being exposed

Cons

1. Too late in the SDLC
2. Front-impact testing only