Web application pentest is an attempt to hack application systems (for example, APIs or internal servers) to identify vulnerabilities, and in particular, unprotected input data that are susceptible to code injection attacks.

What is penetration testing (pentest)

Penetration testing is a simulated cyberattack on a computer system to check it for vulnerabilities. In the context of web application security, a pentest is usually used to strengthen the firewall of web applications (Web Application Firewall, WAF).

The information obtained as a result of the penetration test can be used to fine-tune WAF security policies and fix detected vulnerabilities.

Stages of penetration testing

The testing process can be divided into five stages.

1. Planning and exploration

Determination of the scope, goals and methods of testing.

Collecting information (network and domain names, mail server) to better understand how the target works and its potential vulnerabilities.

2. Scanning

At this stage, we determine how the target application will respond to various intrusion attempts. This is usually done using:

Static Analysis (SAST) — checking the application code to evaluate its behavior during operation. These tools can scan the entire code in one pass.

Dynamic Analysis ( DAST) — checking the code in working order. This is a more practical way of scanning, because it allows you to monitor the performance of the application in real time.

3. Getting access

At this stage, web application attacks are used to identify vulnerabilities – cross–site scripting (XSS), SQL injection and backdoors. Then the pentester tries to exploit the vulnerabilities found, usually by privilege escalation, data theft, traffic interception, etc., in order to understand what damage it can cause to the target.

4. Saving access

The purpose of this stage is to find out whether the vulnerability can be used to ensure a permanent presence in the exploited system — long enough for an attacker to gain full access. The idea is to simulate APT threats, which often remain in the system for several months in order to steal the most sensitive data of the organization.

5. Analysis

The results of the penetration test are then combined into a report that describes in detail:

Vulnerabilities that have been exploited;

Confidential data that has been accessed;

The time during which the pentester could remain in the system unnoticed.

This information is analyzed by security personnel to help configure enterprise WAF settings and other application security solutions to fix vulnerabilities and protect against future attacks.