Web Security testing Methodology
The WST methodology
foot printing - passively gaining information. It is one of the most important step. The more information you get, the better and the more preciesely you can attack your target. A good preparation is always important. See Footprinting tools for more information.
scanning - mapping the network. See Scanning networks
enumeration - finding vulnerabilities. Goes hand in hand scan to get info about services, server, version, os, ip adresses, ports. Tools are: armitage, creates a map of scanned machines, further enums possible. More Enumeration
gaining access - use of a penetrating tool: searchsploit, msf, armitage check exploits
maintain access - setting up backdoors is difficult, schedule a service which will open a backdoor or set up a listener or design a script. For example netcat session start up then cover tracks.
covering tracks - altering logs and hiding activity, delete files, scheduled services, user accounts, logs
writing a report. See also Vulnerability assessment
Last updated