I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between both of them?
For a customer I deal with, the distinction has been:
- "web penetration testing" is testing the security of a web server as configured for production (for example, RHEL 7.4 with SELinux in enforcing mode running Apache HTTPD 2.4 fronting a Tomcat server with two servlets on the same machine where httpd is listening on port 443 for all traffic and Tomcat is listening on port 8443 for traffic only from localhost and iptables is blocking external access to port 8443). This is looking for vulnerabilities in the overall configuration of the server.
- "web application penetration testing" is testing the security of the design and configuration of the web application itself, absent other protections it may rely on. From the example above, this would mean penetration testing the Tomcat server and servlets after deliberately allowing traffic through iptables on port 8443 and disabling SELinux. This is looking for vulnerabilities in the application itself that might be completely, partly, or not mitigated depending on how the server it is running on is configured.