Skip to main content

Request Penetration Testing

You can do a manual penetration test to see the application in a runtime environment and simulate real-world attacks. Penetration testing includes allow you to:

  • Identify design flaws.
  • Exploit vulnerabilities.
  • Leverage combinations of lower impact flaws into higher impact vulnerabilities.
  • Determine if identified flaws affect the confidentiality, integrity, or availability of the application.

The objectives of a web-focused penetration assessment include testing using proprietary or public tools to:

  • Assess how vulnerabilities might be exploited against a target while establishing a running profile of attack methods discovered.
  • Execute test cases to confirm the vulnerability and attempt to determine the impact to business.
  • Customize and expand attack payloads, accounting for the specifics of the implementation of the target and environment.
  • Analyze captured data for vulnerability patterns, interpreting the results, and developing remediation recommendations.

Human testers identify unorthodox ways of attacking applications and infrastructures to understand the design and functionality, complex authorization processes, and business logic requirements that might not be possible for computing systems to replicate today. These insights enable developers to secure their applications and infrastructure against a broader range of attacks.

Veracode recommends that your organization use Veracode Manual Penetration Testing in conjunction with other automated security assessments such as Veracode Static Analysis, Dynamic Analysis, and SCA to ensure maximum coverage from your security program.

Veracode uses industry standards for classifying and reporting manual penetration test vulnerabilities, including:

Details of Veracode Manual Penetration Testing are available in the methodology section of the Veracode Detailed PDF Report and Customizable PDF Report.

Veracode performs all Manual Penetration Testing according to industry-standard testing methodologies where applicable. The following table describes testing types, methodologies, and vulnerability types that form the foundation of Veracode manual penetration testing.

Test TypeMethodologyVulnerabilities
Web application/APIPTES (Penetration Testing Execution Standard), OWASP Testing GuideOWASP Top 10 and CWE Top 25
Mobile applicationPTES (Penetration Testing Execution Standard), OWASP Mobile Security Testing GuideOWASP Mobile Top 10
Desktop or thick-client applicationsPTES (Penetration Testing Execution Standard), OWASP recommended testing guidance and best practicesApplication Logic
Code Injection
Local Storage
Binary Exploitation and Reverse Engineering
Excessive Privileges
Unencrypted Storage of Sensitive Information
Unencrypted Transmission of Sensitive Information
Weak Encryption Implementations
Weak Assembly Controls
Weak GUI Controls
Weak or Default Passwords
Internet of things (IoT) and embedded systemsPTES (Penetration Testing Execution Standard), OWASP IoT Testing Guide and other industry best practicesOWASP IoT Top 10
Infrastructure and Operations (DevOps Penetration Testing)PTES (Penetration Testing Execution Standard), NIST SP 800-115, PCI DSS 11.3 (for PCI engagements)Can vary depending on scope and rules of engagement