Web applications have become common targets for attackers. Attackers can leverage relatively simple vulnerabilities to gain access to confidential information most likely containing personally identifiable information.
While traditional firewalls and other network security controls are an important layer of any Information Security Program, they can’t defend or alert against many of the attack vectors specific to web applications. It is critical for an organisation to ensure that its web applications are not susceptible to common types of attack.
Best Practice suggests that an organisation should perform a web application test in addition to regular security assessments in order to ensure the security of its web applications.
Xhackster Web Application Testing methodology is based on the Open Web Application Security Project (OWASP) methodology which includes:
- Software Infrastructure/Design Weaknesses
- Input Validation Attacks
- Cross Site Scripting Attacks
- Script Injection Attacks (SQL Injection)
- CGI Vulnerabilities
- Password Cracking
- Cookie Theft
- User Privilege Elevation
- Web/Application Server Insecurity
- Security of Plug-In Code
- 3rd Party Software Vulnerabilities
- Database Vulnerabilities
- Privacy Exposures
Xhackster' Web Application Penetration Tests are performed by experienced security engineers who have a vast level of knowledge and many years of experience testing online applications. Xhackster Web application testing metholdology is performed using the best of manual techniques and then using automated tools to ensure total application coverage. The methodology allows Xhackster' consultants be consistent in finding vulnerabilities beyond what may be found with just automated scanning tools.
What is Code Review?
Code Review is a systematic examination, which can find and remove the vulnerabilities in the code such as memory leaks and buffer overflows.
- Technical reviews are well documented and use a well-defined defect detection process that includes peers and technical experts.
- It is ideally led by a trained moderator, who is NOT the author.
- This kind of review is usually performed as a peer review without management participation.
- Reviewers prepare for the review meeting and prepare a review report with a list of findings.
- Technical reviews may be quite informal or very formal and can have a number of purposes but not limited to discussion, decision making, evaluation of alternatives, finding defects and solving technical problems.