Course: Introduction to Web Application Penetration Testing

Modern web applications are very complex. So even though we at Netsparker have pioneered a number of cutting edge technologies to help you automate most of the vulnerabilities detection process, one still needs to have a solid understanding of the stages that a thorough penetration test consists of, which mainly are:

• Scope of engagement
• Information gathering
• Vulnerability identification
• Exploitation
• Post exploitation
• Reporting

To help you make the best of the Netsparker web application security scanner, we have developed a course which explains all the different stages of a website penetration test and how you can use Netsparker to automate most of the process. The course is made up of a collection of slides and videos which you watch through this blog post. Let’s get started.

Stage 1: Scope of Engagement

In these slides you can find introductory information on web application penetration testing. Mainly, information on why businesses need to secure their web applications, the benefits of using automated web vulnerability scanners, and what type of security issues and coding defects web application security testing can expose. They also explain in detail what is a scope of engagement, what a scope of engagement typically includes and how you can define one.

Stage 2: Information Gathering

Now that you have defined a scope of engagement, it is time for some hands on action. These slides explain what is information gathering, how it can be done, and most importantly of all, what you should be looking for during this stage of the web application security analysis. In the slides you can also find information on how to configure the Netsparker web vulnerability scanner to crawl the website and start the information gathering process. To accompany the slides we also have three videos. The first video highlights what have been described in the slides;

• How to configure Netsparker to start the information gathering process.
• How to analyse the information Netsparker reports and use it to fine tune the scanning policies in order to improve the quality of the web vulnerability scans.

The following two videos also explain how to configure authentication and URL rewrite rules in Netsparker, which are a must do should the target application require them.

Video: Configuring Authentication in Netsparker Web Application Security Scanner

Apart from the above video you can refer to the below documents for more detailed information on configuring authentication and scanning websites with authentication forms:

• How to Scan Websites with Form Authentication, Single Sign-On & CAPTCHA with Netsparker Desktop
• How to Configure & Verify Form Authentication in Netsparker Enterprise

VIDEO: Configuring URL Rewrite Rules in Netsparker Web Application Security Scanner

For more detailed information on URL Rewrite Rules and Netsparker’s heuristic URL Rewrite technology refer to the following documents:

• Whitepaper: Automating the Configuration of URL Rewrite Rules in Netsparker Web Application Security Scanners
• Automatic Configuration of URL Rewrite Rules in Netsparker Web Application Security Scanners
• How to Configure URL Rewrite Rules in Netsparker

Stage 3, 4 and 5: Vulnerability Identification, Exploitation & Post Exploitation

In the first set of slides for these stages of the web application penetration test you will find information on the type of vulnerabilities that the Netsparker black box scanner can identify during a scan. They also highlight the detailed technical information the scanner reports when it identifies the vulnerabilities, and how to utilise such information to better understand the vulnerability and fix it. The second set of slides look into the exploitation and post exploitation stages. They explain how you can use the post-exploitation tools in Netsparker to exploit the identified vulnerabilities and highlight their impact. The slides highlight the importance of the Proof-Based Scanning^TM technology and how it can help you eliminate a lot of work and save time, by not having to manually verify the scanner’s findings.

Video: Identifying & Analysing Web Application Vulnerabilities

Stage 6: Reporting

Even though the last stage is the easiest one, it is the most important one. This is the ultimate deliverable from your security engagement, in which you show your customer, developers or management what they are interested in:

• The status of security of the audited web application,
• The vulnerabilities that you found,
• What to fix and how to prioritize the fixes.

The slides for the reporting stage explain how to achieve all of the above. It also explains how you can generate compliance, managerial and technical reports for developers with Netsparker. Last but not least, it also explains how you can use the Report Policy Editor in Netsparker to tailor the web security scan reports to match your organization’s security policies.

Video: Using the Report Policy Editor & Generating Reports

More Netsparker Documentation

For more technical and user documentation on Netsparker web application security scanner, you can refer to the Netsparker Support page, where you can find a number of product guides and frequently asked questions about both Netsparker Desktop and Netsparker Enterprise, our enterprise level online web application security scanner.