The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Security Testing Demystified
------------------------------------------------------------------------
SUMMARY
The article linked here presents the concepts of application security
testing. The article focus on web applications, but the concepts are valid
to almost all security testing scenarios.
DETAILS
This article has been written in very simple language which can be
understood not only by security testers but also can be read & understood
by non-technical managers as well.
Just to summarize, this article doesn't talk anything specific about a
particular type of attack rather demonstrate a holistic approach for
security testing. At a broader level it covers the following areas:
Anatomy of Security Testing
* Understanding the product and its architecture
* Identifying possible attack vectors
* Preparation of test cases
* Vulnerability Research & Discovery
* Exploitation of vulnerabilities found
* Compilation of final security testing report
* Final discussions of bug findings and fixes
Briefs about various mistakes and assumptions made by programmers
Talks about why HTTP-REFERRER is a bad thing to rely on
* How important it is to validate all client side info sent to the
server?
* How to identify potential attack vectors?
* How wild and evil imaginations are important attributes for a security
tester?
* Anatomy of a Security Testing Report
* Why a final live hack demo is a good thing to do?
The full presentation can be found at:
<http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip>
http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip
ADDITIONAL INFORMATION
The information has been provided by <mailto:mail@hackingspirits.com>
Debasis Mohanty.
The original article can be found at:
<http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip>
http://www.hackingspirits.com/eth-hac/papers/SecTesting.zip
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
