Your SlideShare is downloading. ×
0
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Security testing. VRN. 20.02.2013
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Security testing. VRN. 20.02.2013

164

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
164
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
8
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Penetration TestingRoman Denisenko,20 February 2013
  • 2. Agenda• Theoretical part: – What is Security Testing? Classification. – When? Who? For what purposes? – Workflow of penetration testing of web application. – Common vulnerabilities.• Toolkit of penetration testers: – Review and classification of necessary tools.• Practical part.
  • 3. Security testing(by final goal): • Vulnerability Assessment. • Penetration testing. • Code Review. • Vulnerability Scan. • Security review.
  • 4. Security testing(by impact level): • Application level. • Network level. • Physical level.
  • 5. When should we perform ST?1. Within development cycle.2. As additional service after deployment.
  • 6. Who should perform?1. Ordinary testers.2. Specialist of Security expertise.3. Developers.
  • 7. Algorithm of penetration testing:• Information gathering.• Mapping.• Vulnerability Assessment. • Automation testing. • Manual testing.• Creation of report.
  • 8. Information gathering.www.target.es
  • 9. Mapping.
  • 10. Run automation vulnerability scanners.
  • 11. Manual testing.
  • 12. Creation of report.
  • 13. Common vulnerabilities.
  • 14. SQL injection
  • 15. SQL injection
  • 16. Stored XSS
  • 17. Stored XSS
  • 18. Privilege escalation.
  • 19. Insecure Direct Object References.
  • 20. CSRF.
  • 21. CSRF.
  • 22. Necessary toolkit.• Gathering tools. – nmap. – nikto• Automation vulnerabilities scanners. – Acunetix – Nexuss – WebInspect – w3af• Sniffing tools. – Wireshark – Fiddler.• Manual testing tools. – BurpSuite – Sqlmap
  • 23. Penetration testing of the test site...
  • 24. Contacts:: Roman.Denisenko@dataart.com: roman__denisenko

×