0

I am trying to clear up a doubt on security testing.

If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web services should be tested.

The vendor team, however, insists otherwise, and just want web app to be tested, and leave the web services out.

Can someone pls confirm if I am correct & both web app & web services must be reviewed? Thnx.

Update: Adding more info on this.

The vendor is a third-party, who has written this app for one of our teams. The team has asked me directions and next steps for ensuring security in this app. I am recommending that we get a pentest done against this app (both web app & web services), identify the security issues, and tell the vendor to fix stuff, instead of I just signing off on a poorly written app.

Vendor insists we stick to web app pentest and not web services security, as testing both is not necessary.

|improve this question
  • What is your desired outcome? What is your context in this? What angle are you looking at the issue from? – Ian Nov 13 '18 at 12:42
  • @Ian I / my team has to ensure any third-party apps go through VAPT first, get the vendor to fix any issues, re-test & then sign off. – Sunshine Nov 13 '18 at 15:00
  • 1
    I wondered whether this would be the case. Testing both components increases their workload and lowers their margin. A follow up question (although I suspect that I know the answer): Who provides the Web Services component? If it is the supplier, you are within your rights to insist that they are tested too at some point. Whether that is done before you receive the app is up to you, but I'd advise to do so: after all, they may utilise these services for other customers. There may even be evidence of a previous test (the resuls of which you should ask for if so). – Ian Nov 13 '18 at 15:21
  • Yes, it is the vendor team who supplies both the components (web app & web services). Because this app is going to be used for a significant business offering, I am leaning towards getting the vapt done in entirety right now, than later. The vendor doesn't have any previous va / pt reports, & this looks like a red flag. – Sunshine Nov 14 '18 at 4:38
  • 1
    The argument of your vendor that only a pentest for the frontend is necessary (what is the background for this argument? "this automatically implies a pentest for the backend"?! Thats absolutely false!) indicates a major lack of awareness for security in your vendors thinking. When someone thinks like that, he develops like that and includes major security flaws in the backend. You will do yourself a big favor consulting a professional security specialist, especially when the software is a big thing. – Alex Nov 14 '18 at 8:03
2

In terms of a penetration-test / security review you want to review both components, because both components can have different vulnerabilities. The web service should be secure against things like SQL-injection, path traversal, broken authentication and so on whereas the web app should be secure against cross-site-scripting.

You should check the OWASP Top 10 and dertimine which attack vector can / should be prevented in the backend and which in the frontend.

All in all I would say, a secure backend is way more important than a secure frontend because the frontend can easily be bypassed with tools like burp suite oder ZAP, so focus on the backend. But keep in mind that there are vectors which only apply to the frontend.

|improve this answer
1

In almost any situation I can think of, both the Web App and the Web Services would need security testing at some point, but that doesn't necessarily mean both need to (or, even should be) tested as one task.

The Web App is likely to use only some of the services that the Web Service provides (or, at least, use those services in particular ways). Therefore, testing the Web Service will require exercising it in ways that the Web App never would. That is a strong argument for making testing of the Web Service an exercise in itself, distinct from how (one specific) Web App makes use of those services.

Similarly, testing the Web App may involve testing things that are not directly related to the services provided by the Web Service. Again, an argument for looking at security of the Web App in (moderate) isolation to the Web Service.

So: yes it sounds reasonable to be asked to look at the security of the Web App, more-or-less leaving the Web Service out of the picture, provided that someone else, or at some other time, the security of the Web Service does get looked at.

|improve this answer
  • Thnx @TripeHound. Very helpful reply. Yeah, it is we who have to get both the parts (web app & web service) tested, before signing off that the app is 'secure'. – Sunshine Nov 13 '18 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.