I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between both of them?
What is the difference between "web penetration testing" and "web application penetration testing"?
For a customer I deal with, the distinction has been:
- "web penetration testing" is testing the security of a web server as configured for production (for example, RHEL 7.4 with SELinux in enforcing mode running Apache HTTPD 2.4 fronting a Tomcat server with two servlets on the same machine where httpd is listening on port 443 for all traffic and Tomcat is listening on port 8443 for traffic only from localhost and iptables is blocking external access to port 8443). This is looking for vulnerabilities in the overall configuration of the server.
- "web application penetration testing" is testing the security of the design and configuration of the web application itself, absent other protections it may rely on. From the example above, this would mean penetration testing the Tomcat server and servlets after deliberately allowing traffic through iptables on port 8443 and disabling SELinux. This is looking for vulnerabilities in the application itself that might be completely, partly, or not mitigated depending on how the server it is running on is configured.
1+1 In my experience, "web application pen testers" work closely with developers writing the application, while "web pen testers" work closely with ops or devops who are responsible for the infrastructure. Jan 9, 2018 at 15:54
1I have never seen this distinction before, but with devops and shifts in the modern infrastructure, it makes sense.– schroeder ♦Jan 9, 2018 at 16:38