0

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit.

For instance, OWASP Testing Guide could be used for both of those cases.

Let's say the pentester and the auditor are working inside the enterprise: they therefore have access to the same resources ie architectures, documentation, etc.

I understand that for a pentester, exploiting a vulnerability is the ultimate goal. But, it looks like the process of discovering the vulnerability for both the pentester and the auditor is the same.

Consequently, the auditor job may look like a vulnerability assessment.

  • 1
    There is a fundamental difference between an "audit" and a "test". – schroeder Jun 2 at 16:08
1

I was debating whether to answer since it may be a matter of opinion to an extent...

Some clients like some names other clients like others. The purpose can be the same and the result as well. So... it varies.

I've done penetration tests against web applications and black/grey box style audits (with and without access to the developer team for questions, etc) and the methodology and the output are the same.

In either case you test the application following a certain methodology to determine whether it is vulnerable to attack, which attacks, to what consequence and how to mitigate these issues. The result is usually a report with a technical risk assessment of a list of vulnerabilities detected including recommendations for mitigation, together with a discussion of the results of some sort.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.