The developers have delivered, and the web application is ready. It works well and the design is great – but who decides whether it is secure enough? Who can give us an independent opinion?
Life has not stopped at development companies, as most development work can be done remotely from home. Web applications are still being developed, so their security assessment must be continuous too.
From a security perspective, protection against injection attacks is paramount in web applications. One of OWASP’s flagship projects, the OWASP Top Ten, also ranks this type of vulnerability as the number one problem. Properly validating and filtering user input can greatly reduce this exposure. However, developers are often unsure what proper validation and filtering actually mean, so this flaw comes up frequently in web application tests.
The ability to inject SQL statements opens the door to data theft, so a mistake by the developers can cause the company serious damage – even years later. Under the GDPR it can even lead to a fine, but the loss of reputation is harder to put a price on: who wants to see their company in a negative headline?
Another common type of injection flaw is when JavaScript code can be injected through data input. Such an attack does not target the data stored in the database directly but is typically aimed at the users of the application. This vulnerability is known as cross-site scripting (XSS). The goal of an XSS attack is usually to take over a user’s session. Most web applications store session IDs in cookies, and a stolen session ID lets attackers log in to the system – and, with a well-targeted attack, even gain administrative privileges. Besides input validation, proper session management is also very important!
Whiteshield has been carrying out web application tests since 2011. Following the OWASP guidelines, our experts aim to uncover vulnerabilities thoroughly through manual testing. Do you need help assessing your application? Get in touch! We are happy to help.