Pen Testing Methods, Prep and Reporting Cheat Sheet
by binca via [Link]/44948/cs/13446/
Black Box Automated Testing
Little or no information provided to tester other than the name of the Automated tools are used to scan a target for vulnerabilities.
target, an IP range or applicable URLs. Many automated scanners are available including HP WebInspect,
The target is a "black box". Trustwave App Scanner, IBM AppScan, ZAP, Burp Suite.
This type of testing requires close coordination between testers and Rapidly scans site but can still take a long time.
target system personnel to ensure that the testing stays within scope. Tester has less control and it is more prone to false positives.
This type of testing is not typically done in web application testing. Lacks the ability to provide business implications to discovered flaws.
White Box Penetration Testing Hybrid Web App Penetration Testing
Testers are provided with information in advance including target Combines manual and automated techniques.
URLs, application functionality summary, application map and test
Scanner provide a starting point with manual verification and exploi‐
accounts.
tation as follow-up.
Target system personnel are available to answer questions.
As new components of an application are discovered the process
This type of testing is an integral part of the development process returns to automated scanning, repeating the cycle.
and as a result it is often performed by an internal team.
Scripting is done as needed.
This is the most frequently used technique for testing.
Grey Box Testing
Testers are provided with some information at the beginning of
Preparation
testing including URLs and user accounts.
It is the first step, and is continuous.
Information gathering is a critical part of this type of testing.
Practicing and developing skills is paramount.
Communication between the tester and target system personnel is
critical.
Managing a Web App Pen Test
This is the most common type of testing performed today.
Begins BEFORE the hands-on testing, involves the testing team and
the target system personnel.
Manual Testing
Developers can be brought in to help improve security awareness.
Manual testing using scripts and tools
Any vendors or infrastructure providers should be included.
The tester processes each page of the target application using tools
and script to help manipulate and formulate requests as well as
Establishing the Test Scope
gather and analyze data.
The scope is defined by the purpose of the test. What are the
It is time consuming but allows for the discovery of logic and
concerns associated witht he target application.
business flaws that tools cannot find.
The type of of test should be agreed upon black, crystal or grey box
Thoroughness is dependent on the tester's time, attention and skill
testing.
set.
The scope of the test will define which applications and/or servers
are involved and which should be avoided.
By binca Not published yet. Sponsored by [Link]
[Link]/binca/ Last updated 9th November, 2017. Everyone has a novel in them. Finish
Page 1 of 2. Yours!
[Link]
Pen Testing Methods, Prep and Reporting Cheat Sheet
by binca via [Link]/44948/cs/13446/
Information Required for Testing Introduction
Applications included in the scope Outlines the parts of the test including the scope, objective and the
Multiple user IDs and passwords, each pair having different access. team.
Technology restrictions such as client types, ports and servers to This section should be 1-2 pages in length.
avoid
Methodology
Emergency contact information.
A step-by-step explanation of testing including tools used.
Rules of Engagement It should be clear enough that a competent tester could reproduce
Identifying tester traffic and data and verify the test.
Target system personnel should be know source identifiers such as This section is often 3-10 pages in length.
IP addresses, email addresses, and other identifiers.
Agreeing upon a testing time frame Findings
This includes testing windows and time for analysis, reporting and This is the meat of the report including each finding categorized by
follow-up. The deliverables should be scheduled prior to testing. risk as pertaining to the application.
Establishing communications plans In some cases findings will be divided by application.
There should be various contacts both technical and management,
Recommendations are part of the findings. If there are multiple, each
as well as methods including email, phone, and possibly IM.
should be provided with an explanation of the most beneficial.
Sensitive information regarding vulnerabilities should be discussed
over secured channels with PGP/GnuPG for email or OTR/encrypted
Conclusions
IM.
This is the final part of the report and is similar to the executive
summary.
Reporting
The audience is the technicians, unlike the executive summary which
Probably the most important part of the penetration test, since it is
is geared to higher-level.
the most lasting portion.
Any appendices are added after the conclusion including
Format:
permission memos
1. Executive Summary
lists of users harvested
2. Introduction
records retrieved from the database
3. Methodology
detailed tool output
4. Findings
5. Conclusions
Presentation
All information gathered during testing becomes part of reporting,
An optional part of penetration tests but an excellent way to work
important notes, permissions, memos and other items may be
with developers.
included in the appendices.
Audience should be chosen by target personnel, possibly hold
Executive Summary multiple sessions to focus the presentation on different kinds of staff
such as developers, administrators, management and testing staff.
Contains a high-level overview of our test and findings
The audience is higher-level personnel.
Maximum 1.5 pages, best kept to a single page.
Contains the findings, including the root cause, and recommend‐
ations, which should be reasonable and accomplishable. Including
recommended time frames including short-term versus long-term
changes.
By binca Not published yet. Sponsored by [Link]
[Link]/binca/ Last updated 9th November, 2017. Everyone has a novel in them. Finish
Page 2 of 2. Yours!
[Link]