2

I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between both of them?

Improve this question
0

1 Answer 1

Reset to default
6

For a customer I deal with, the distinction has been:

  • "web penetration testing" is testing the security of a web server as configured for production (for example, RHEL 7.4 with SELinux in enforcing mode running Apache HTTPD 2.4 fronting a Tomcat server with two servlets on the same machine where httpd is listening on port 443 for all traffic and Tomcat is listening on port 8443 for traffic only from localhost and iptables is blocking external access to port 8443). This is looking for vulnerabilities in the overall configuration of the server.
  • "web application penetration testing" is testing the security of the design and configuration of the web application itself, absent other protections it may rely on. From the example above, this would mean penetration testing the Tomcat server and servlets after deliberately allowing traffic through iptables on port 8443 and disabling SELinux. This is looking for vulnerabilities in the application itself that might be completely, partly, or not mitigated depending on how the server it is running on is configured.
Improve this answer
2
  • 1
    +1 In my experience, "web application pen testers" work closely with developers writing the application, while "web pen testers" work closely with ops or devops who are responsible for the infrastructure.
    – Mike Ounsworth
    Jan 9, 2018 at 15:54
  • 1
    I have never seen this distinction before, but with devops and shifts in the modern infrastructure, it makes sense.
    – schroeder ♦
    Jan 9, 2018 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .