A common question in web application tests is whether the admin interface needs to be tested. Users with ordinary rights cannot log in to it anyway, so no threat is expected from that direction. But is that really so?

The admin interface is typically well separated from the “normal” interface of the web application. It is usually a web page on a separate domain and, ideally, available only under special conditions. On these pages, our employees manage customer data and troubleshoot any problems that arise.

In a web application assessment, this is often where clients try to save money – on the assumption that restricted access is enough to keep the data safe.

According to an IBM 2016 report, 60% of attacks were carried out by insiders or with their help. And where do employees have access to customer data? In the admin interface.

What kind of tests are worth performing on the admin interface?

As a first step, it is best to extend the web application test with a black box test of the administration site. This ensures that the interface is properly protected from the internet. It can even include password guessing against the login page: we compile a list of possible users from data available on the internet and try to log in with the most common passwords.

Next, we recommend a thorough grey box test covering all user levels. It must be examined whether each user level is properly separated, whether the required permissions are enforced and, in general, whether the principle of least privilege applies.

In addition, every feature must be tested for correct operation and for any way to gain unauthorised access to other users, files or resources. It is important to check whether the file download function really only returns files uploaded by clients. A common mistake is that the application source code can be downloaded with a little parameter manipulation – and with it, usually the configuration files that contain the database credentials.

Unfortunately, our experience shows that the admin interface is often a cupboard full of skeletons. For this reason, our assessment is often followed by further analysis to determine whether malicious staff have already exploited the vulnerabilities found.

Trust us with testing your admin interface! We have nearly 10 years of experience in testing web applications. Don’t hesitate to contact us!