Web Application Penetration Tests - Reporting

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Web Application Pentesting
Reporting

Reporting
In this next section, we will address the following process:
• Scope of Engagement
• Information Gathering
• Vul...

Reporting
The Penetration Report is the ultimate deliverable from your
engagement. By hiring a penetration tester or a pen...

Reporting
Reporting assists the customer in not only understanding the issues
with their environment, but it can also help...

Reporting
Project teams can take reporting and ensure that the same coding
issues are not occurring in similar projects.
D...

Reporting
Knowing that you used a reverse TCP shell once you managed to
exploit an RFI may not be of critical importance t...

Reporting
There is not a prescribed or standard structure to penetration
testing reports. However, there are best practice...

Reporting
The reporting phase begins at the moment you sign the Rules of
Engagement with your client.
This is the right ti...

Reporting
Reporting is often (mistakenly) believed to be the last chronological
step of an engagement. This is both incorr...

Reporting
While you perform your tests you will have to collect and organize
your information methodically.
This informati...

Reporting
Once you understand who will read your report and what kind of
information they are actually interested in, you ...

Reporting
The Executive Summary is where you talk to the corporate types or,
in general, give a brief and concise overview...

Reporting
The Executive level of a company has zero time to invest in your
philosophical approach to security. Nor it is i...

Reporting
The Vulnerability Report is often also called the Technical report and
is where each vulnerability found in the ...

Reporting
You have different options about how you want to arrange the
information within this section.
In web application...

Reporting
In other cases, you will have only one target in scope affected by a
large number of different vulnerabilities. ...

Reporting
If vulnerabilities are heterogeneous, or the number of targets in
scope is little, you can arrange the above inf...

Reporting
The Remediation report is the place to talk to the developers in
charge of fixing the vulnerabilities that you h...

Reporting
In this section you can work on two different time horizons: short
term and long term.
In the short term you wan...

Reporting
You can also suggest long-term actions, like:
• implementation of SSDLC (Secure Software Development Lifecycle)
...

Reporting
Providing suggestions on how to remediate common vulnerabilities
is usually pretty trivial.
If the vulnerability...

Reporting
You usually find all you need within vulnerability databases or in the
official security advisories.
If the appl...

Reporting
How you arrange the information in this section should reflect the
approach you used during the vulnerability re...

Reporting
Report structure and content as we have seen in previous slides is
very important.
If a combined report is requi...

Reporting
Per OWASP, a comprehensive report can contain these elements:
• Executive Summary: the executive summary sums up...

Reporting
As said before, Netsparker offers the ability to
automatically generate reports.
By clicking on the "Reporting" ...

Reporting
This is a sample of the Executive Summary report. This report
contains only high level reference information wit...

Reporting
This is a sample of the detailed scan report. The detailed scan report
lists all vulnerabilities in detail. Link...

Reporting
You can also export the findings in different formats, such as CSV
and XML.
Thanks to formats like these, you wi...

Report Policy
Another very useful feature that Netsparker offers when creating a
report is the Report Policy.
Report polic...

Report Policy
These settings may be very useful to customize the reports,
depending on who will be the target audience.
Mo...

Report Policy
It is important to know that the Report Policy changes only the way
the findings are presented in the report...

Report Policy
Creating a new Report Policy is very simple. We can do it before
actually scanning the application, or after...

Report Policy
A window like the following will appear. Here we can create a new
Report Policy or clone an existing one.
34

Report Policy
In our example we will clone the existing default policy and change
its name to "Only critical findings". Th...

Report Policy
As said before, we can edit the vulnerability template as well as the
information in it. To do so we just ne...

Report Policy
Notice that all the information can be edited. Therefore, we can
modify the security level as well as the cl...

Report Policy
Once you are finished editing a vulnerability template, click on the
Save button to save your changes or Dis...

Report Policy
As you can see, this feature is fundamental to the customization of
your reports. Depending on who is going ...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Web Application Penetration Tests -... by Netsparker 13865 views
Introduction to Web Application Pen... by Netsparker 18523 views
Web Application Penetration Tests -... by Netsparker 16050 views
B wapp – bee bug – installation by Ronan Dunne, CEH,... 29239 views
İleri Seviye Ağ Güvenliği Lab Kitabı by BGA Cyber Security 20124 views

View on Slideshare

1 of 39 Ad

View on Slideshare

1 of 39 Ad