[REVS] Security Testing Demystified

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Security Testing Demystified
------------------------------------------------------------------------


SUMMARY

The article linked here presents the concepts of application security
testing. The article focus on web applications, but the concepts are valid
to almost all security testing scenarios.

DETAILS

This article has been written in very simple language which can be
understood not only by security testers but also can be read & understood
by non-technical managers as well.

Just to summarize, this article doesn't talk anything specific about a
particular type of attack rather demonstrate a holistic approach for
security testing. At a broader level it covers the following areas:

Anatomy of Security Testing
* Understanding the product and its architecture
* Identifying possible attack vectors
* Preparation of test cases
* Vulnerability Research & Discovery
* Exploitation of vulnerabilities found
* Compilation of final security testing report
* Final discussions of bug findings and fixes

Briefs about various mistakes and assumptions made by programmers
Talks about why HTTP-REFERRER is a bad thing to rely on
* How important it is to validate all client side info sent to the
server?
* How to identify potential attack vectors?
* How wild and evil imaginations are important attributes for a security
tester?
* Anatomy of a Security Testing Report
* Why a final live hack demo is a good thing to do?

The full presentation can be found at:
<http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip>
http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip


ADDITIONAL INFORMATION

The information has been provided by <mailto:mail@xxxxxxxxxxxxxxxxxx>
Debasis Mohanty.
The original article can be found at:
<http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip>
http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • RE: application security testing training
    ... techniques and apply it to their job they need to have an environment they can ask questions and be ... Someone else mentioned specialized training from CORE Security. ... >>I am looking for application security testing training, ... >>leaks, reverse engineering, writing buffer overflow exploits etc.. ...
    (Pen-Test)
  • RE: application security testing training
    ... techniques and apply it to their job they need to have an environment they can ask questions and be ... Someone else mentioned specialized training from CORE Security. ... >>I am looking for application security testing training, ... >>leaks, reverse engineering, writing buffer overflow exploits etc.. ...
    (Pen-Test)
  • RE: Penetration testing scope/outline
    ... The OSSTMM stands for the "Open Source Security TESTING Methodology Manual". ... Internet Security Systems. ...
    (Pen-Test)
  • Security Testing Workshop in Barcelona
    ... Security Testing Workshop in Barcelona ... the Barcelona workshop for the OSSTMM (Open Source Security Testing ... Methodology Manual) has been pushed back a week to Nov. 29th. ...
    (Bugtraq)
  • OSSTMM 2.1 Released
    ... Source Security Testing Methodology Manual (OSSTMM). ... The Open Source Security Testing Methodology Manual is an open ...
    (Bugtraq)