4
votes
3answers
272 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
20
votes
7answers
2k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
6
votes
4answers
1k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
6
votes
2answers
194 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
4
votes
1answer
138 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
526 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
7
votes
1answer
117 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
3
votes
4answers
1k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...