Complete Guide On Vulnerability Assessment and Penetration Testing – Includes Checklist
Businesses have learned the hard way that vulnerabilities & loopholes can cost them money and more. Stats show that as many as 99.7% of businesses have at least one undiscovered vulnerability. These vulnerabilities are nothing but a ticking bomb waiting to blow off. Ignorance is not bliss when it comes to cybersecurity. You got to identify and patch these vulnerabilities at the earliest to protect your website.
Enters Vulnerability Assessment & Penetration Testing. Commonly called website security audit.
What is Vulnerability Assessment & Penetration Testing?
Vulnerability Assessment identifies and lists all existing vulnerabilities in your website. Penetration Testing, on the other hand, focuses more on how each of these vulnerabilities could be exploited.
Vulnerability Assessment is more of an initial step in the whole process. Whereas, Penetration Testing uses the findings (or list of vulnerabilities) and exploits them to estimate the degree of risk attached to it. Vulnerability Assessment can use both automated & manual ways. In fact, there are tons of vulnerability scanners available on the web which accelerates the process of Vulnerability Assessment. However, Penetration Testing is generally a manual process.
While both Vulnerability Assessment & Penetration Testing concerns the same area, they are not quite the same. And have been wrongly used interchangeably in the past. This confusion has led to web owners asking for Vulnerability Assessment when they really need Penetration Testing and vice versa.
But not to worry. After reading this blog post, you will be able to tell the difference between these terms. This article will also give you a closer look into the complete methodology involved in VAPT (tools + checklist).
Why Do You Need VAPT?
It is crucial to identify your site’s insecurities so that you are never caught off guard. VAPT lets you anticipate possible mishaps that could take place. This invariably contributes to better risk management for your website.
I have seen website owners often ask things like, “Mine is just a small website, do I need a Vulnerability Assessment & Penetration Testing?“.
The answer is yes. Research has it that nearly 60% of cyberattacks target small businesses. So, there’s a good chance of your website being targeted, if left untended to.
In a nutshell, website penetration testing can help you in the following ways:
- It uncovers serious security flaws that could have led to the compromise. Thus pentesting protects you loosing your sensitive web assets.
- It gives the user a holistic view of improvements needed on the website.
- Emulates real-life attack scenarios and helps in mitigating risks thereby ultimately helping to meet compliances like PCI-DSS.
- Uncovers vulnerabilities could have led to data leakage which in turn would have legal consequences.
- Help in preparing the security team to cope up with a real-life cyber attack.
Methodology for Website Penetration Testing and Security Audit
Website penetration testing is done primarily in 3 phases:
- The first phase is information gathering. In information gathering, the pentester tries to find fingerprints in the backend of the website. It usually includes Server OS, CMS version, etc.
- The second step is where automatic tools are deployed to uncover any known flaws or known CVEs in the respective services.
- In the final step of exploitation, the goal is to leverage any vulnerabilities discovered in the second phase. This is often done manually to weed out false positives. The exploitation part is also used to exfiltrate information from the target and to maintain persistence.
1. Information Gathering
The first phase is information gathering in which, the pentester tries to find fingerprint the backend services of the website i.e. Server OS, CMS version, etc.
Network Mapper a.k.a. NMAP
Nmap has been the absolute favorite recon tool of website pentester for a long time and there is a solid reason for that. The abilities of Nmap are:
- It can discover Open ports on the server.
- Fingerprinting the server OS.
- Bypassing the firewall to scan the target stealthily.
- Uncovering services running on those ports.
- It’s NSE scripts can automate tasks including certain vulnerabilities detection.
To see more options, fire your Kali and in the command line terminal and type ‘nmap‘. Also, users can try Zenmap which is the GUI version of Nmap.
While tools like NMAP does a black box information gathering, there are certain tools like The Harvester which collect Open Source Intelligence (OSINT). OSINT is the information present in the public domain regarding your target i.e. Whois registration info, company emails, etc. This info comes in handy while website penetration testing. It is spread out on sites like Google, Whois, etc. So, the harvester compiles it from all sources and gives you a one-stop solution.
The second step is Discovery in which automatic tools are deployed to uncover any known flaws or known CVEs in the respective services.
Nikto is a tool specifically designed to scan vulnerabilities in around 270 types of servers. It can extensively search for 6700 server misconfiguration.
However, the limitation of Nikto is that it is very noisy and can often generate false positives. Moreover, the firewall evasion techniques of Nikto are very poor. However, when combined with another Inundator (to evade IDS) of Kali, it can be effective.
Therefore, before using Nikto for website penetration testing, make sure to turn off your firewall or IDS for better results.
To scan a target using Nikto, simply open the terminal in Kali and type:
nikto -h 'your-target‘
Burp Suite is a website pentesting framework built on java. It has a built-in proxy that intercepts traffic between your browser and the website pentesting target. This proxy can be then used to manipulate requests or for fuzzing to discover vulnerabilities in a website.
While manipulation of requests can help in finding vulnerabilities, fuzzing can uncover error messages and application behavior too. This tool has become almost an industry standard and is a must-have for website penetration testing.
OpenVAS is a vulnerability scanner that can perform a complete vulnerability scan of the network infrastructure. It can be easily scaled as per your needs and can perform a wide variety of tests. This tool is owned by Greenbone and the paid solution is called Greenbone Security feed while the free one is called Greenbone Community feed. The prime difference between both the editions is the NVTs (Network Vulnerability Scanner test).
Metasploit framework is almost an industry standard when it comes to exploitation of the target. Metasploit can also perform recon using Nmap. If you find any vulnerabilities, there are a plethora of exploits to choose from. Finally, pair your exploit with a suitable payload and you are good to go. Metasploit even has a great choice of post-exploitation tools. Metasploit is owned by Rapid 7 and is written in ruby. Almost all proof of concepts of popular zero-day flaws is updated as Metasploit modules.
To launch Metasploit, open the terminal in your Kali Linux and type:
Sqlmap is a one-stop solution to find any SQL injection vulnerabilities on your website and to exploit them. Sqlmap can fuzz the target parameters in the URL and even data fields on the page to find any SQL injection points. Sqlmap can thereafter exploit them to provide you a pseudo SQL shell or cmd shell from the target machine.
To see more options, open the terminal in your Kali and type:
Xsser is a small and lightweight tool to find and exploit XSS bugs during website penetration testing. XSS bugs are fairly common and there is a lot you can uncover with this small tool.
To run the GUI version, open the terminal in Kali and type:
How Website Security Audit Can Get You Certifications?
Often e-commerce sites deal with sensitive user payment info to conduct their daily operations. This sensitive data means, there should be a standard security practice on every website.
This is ensured by the Payment Card Industry which consists of almost all organizations dealing with debit and credit cards. Therefore PCI Data Service Standards (DSS) is a set of 12 security protocols that every business dealing with credit card info has to comply with. These protocols were developed by the PCI security standard council. In case there is a failure to comply with these protocols, PCI may impose a fine or terminate the credit card processing privileges of that particular organization. These 12 requirements to be PCI-DSS compliant are as under:
Network and Systems Security
Requirement #1: Install and maintain a WAF to protect the data of cardholders.Requirement #2: Default and hardcoded passwords provided by the vendor should not be used.
Requirement #3: Protect the data stored of the cardholder from cyber attacks.
Requirement #4: The transmission of cardholder data should be encrypted over open networks.
Regular Vulnerability Management
Requirement #5: Keep the antivirus solution updated and ensure proper mechanism against malware.
Requirement #6: Develop a secure application and maintain secure systems.
Proper Access Control Measures
Requirement #7: Restrict access to cardholder data by implementing role-based access control.Requirement #8: Identify and authenticate access to system components.Requirement #9: Set constraints to physical access to cardholder data.
Network Monitoring and Testing
Requirement #10: Regularly monitor all access to network resources and cardholder data
Requirement #11: Run frequent tests on all the security systems and processes.
Information Security Policy
Requirement #12: Implement a policy that covers all personnel for information security.
Website Penetration Testing and Security Audit: Checklist
- Port Scanning
- Web Server, CMS Version, and OS fingerprinting.
- HTTP Methods
- Cookie Attributes
- Finding alternative content i.e. directory/files brute force.
- Finding default configurations or misconfigurations.
- Login Fuzzing.
- Testing Session Tokens.
- Injections: SQL, XSS, XML, Template, OS Command.
- Open Redirection.
- LFI & RFI attacks.
- Business Logic Flaws.
- Denial of Service.
- Testing REST and SOAP web services.
- HTTPS strip
- Oracle Padding Attack
- Weak Cryptography or Poor implementation
- Browser hijacking using XSS.
- Data Exfiltration using various injections.
- Authentication Bypass.
- Offline password cracking.
- Cross-Site Request Forgery.
The crux of this article is that website penetration testing is important for everyone, be its small blogs or large corporations. Moreover, there are plenty of tools available freely to conduct website penetration testing.
The three steps of website pentesting (Info gathering, discovery & exploitation) will guide and organize the whole process of website penetration testing. So get started today and audit the security of your website!
However, if you feel that you are new to this field or find this task cumbersome, worry not Astra is always there to help you. Our community of experienced security experts will pentest your website and report any vulnerabilities in a detailed and easy to understand manner. They will also provide you with the fixation steps and even promise to help you or your developer in patching it.
If you wish to get help from experts at Astra, get in touch with us using the chat widget at the bottom right corner of your screen or click here.