Request Penetration Testing
You can do a manual penetration test to see the application in a runtime environment and simulate real-world attacks. Penetration testing includes allow you to:
- Identify design flaws.
- Exploit vulnerabilities.
- Leverage combinations of lower impact flaws into higher impact vulnerabilities.
- Determine if identified flaws affect the confidentiality, integrity, or availability of the application.
The objectives of a web-focused penetration assessment include testing using proprietary or public tools to:
- Assess how vulnerabilities might be exploited against a target while establishing a running profile of attack methods discovered.
- Execute test cases to confirm the vulnerability and attempt to determine the impact to business.
- Customize and expand attack payloads, accounting for the specifics of the implementation of the target and environment.
- Analyze captured data for vulnerability patterns, interpreting the results, and developing remediation recommendations.
Human testers identify unorthodox ways of attacking applications and infrastructures to understand the design and functionality, complex authorization processes, and business logic requirements that might not be possible for computing systems to replicate today. These insights enable developers to secure their applications and infrastructure against a broader range of attacks.
Veracode recommends that your organization use Veracode Manual Penetration Testing in conjunction with other automated security assessments such as Veracode Static Analysis, Dynamic Analysis, and SCA to ensure maximum coverage from your security program.
Veracode uses industry standards for classifying and reporting manual penetration test vulnerabilities, including:
- Common Vulnerability Scoring System (CVSS) v3
- Common Weakness Enumeration (CWE)
- Common Attack Pattern Enumeration and Classification (CAPEC)
Details of Veracode Manual Penetration Testing are available in the methodology section of the Veracode Detailed PDF Report and Customizable PDF Report.
Veracode performs all Manual Penetration Testing according to industry-standard testing methodologies where applicable. The following table describes testing types, methodologies, and vulnerability types that form the foundation of Veracode manual penetration testing.
| Test Type | Methodology | Vulnerabilities |
|---|---|---|
| Web application/API | PTES (Penetration Testing Execution Standard), OWASP Testing Guide | OWASP Top 10 and CWE Top 25 |
| Mobile application | PTES (Penetration Testing Execution Standard), OWASP Mobile Security Testing Guide | OWASP Mobile Top 10 |
| Desktop or thick-client applications | PTES (Penetration Testing Execution Standard), OWASP recommended testing guidance and best practices | Application Logic Code Injection Local Storage Binary Exploitation and Reverse Engineering Excessive Privileges Unencrypted Storage of Sensitive Information Unencrypted Transmission of Sensitive Information Weak Encryption Implementations Weak Assembly Controls Weak GUI Controls Weak or Default Passwords |
| Internet of things (IoT) and embedded systems | PTES (Penetration Testing Execution Standard), OWASP IoT Testing Guide and other industry best practices | OWASP IoT Top 10 |
| Infrastructure and Operations (DevOps Penetration Testing) | PTES (Penetration Testing Execution Standard), NIST SP 800-115, PCI DSS 11.3 (for PCI engagements) | Can vary depending on scope and rules of engagement |