How is a web security test carried out?

One of the most effective practices for controlling the resources allocated to cybersecurity is to perform a web security test

In 2023, the most relevant security breaches detected globally had an average cost for the companies that suffered them of 4.45 million dollars. However, despite the scale of the losses, half of those companies that had been victims of security breaches acknowledged after the fact that they did not plan to increase their investment in cybersecurity.

The finding is reflected in the latest Cost of a Security Breach report published by IBM last year. The study provides even more revealing data, such as that many attacks will go without an adequate response because companies need more resources.

A robust cybersecurity policy is one of the fundamental pillars of a business’s correct and efficient operation. Being protected against cyber-attacks is a guarantee that should be non-negotiable, so it is essential to know the state of health of business security on the network at all times. A central objective for any organization can be achieved by using tools such as a web security test.

What is a web security test?

A web security test or web security audit is a comprehensive exercise that identifies vulnerabilities affecting a web application’s security. Its objective is to detect and propose solutions to weaknesses that may pose a risk to the confidentiality, integrity and availability of the information managed by the application. Thus, these weaknesses can be corrected before attackers can exploit them.

Web security testing is vital to any organization. Web applications are among the most exposed assets of the technological infrastructure: they define the corporate image and are a common target for potential attackers. Usually, they try to compromise sensitive information or use web applications as an entry point to escalate privileges later or perform lateral movements that can affect the security of other assets.

What data or elements of an application can be subjected to a web security test?

All of them. Attackers can potentially target any element of a web application’s infrastructure and functionality to compromise its security. Therefore, it is critical to perform web security tests to prevent any eventuality.

Even when the web is static and has no dynamic functionalities or sensitive information, it can be targeted by attackers who identify vulnerabilities. Their intentions may be to alter its content with fake forms to steal information from users, to carry out defacement attacks that affect the corporate image, or to use the website as a starting point to compromise other assets.

What vulnerabilities can a web security test identify?

A web security test can identify many types of vulnerabilities, from those that can be exploited through the user’s web browser to others that can lead to a takeover of the server hosting the application.

Some significant examples are:

• Code injection: command injection, SQL injection, XML injection, Cross-site scripting…
• Authentication and session management vulnerabilities
• Authorization control and access control vulnerabilities
• Infrastructure configuration vulnerabilities
• Sensitive data exposure
• Vulnerabilities in communications encryption
• Vulnerabilities in error handling
• Vulnerabilities in APIs
• Vulnerabilities related to the use of vulnerable third-party software
• Vulnerabilities related to incorrect data validation

Available methods and tools to perform a web security test

Today, there are numerous methods for performing a web security test. Each has a raison d’être that makes it very effective in relation to specific vulnerabilities and the perspectives from which it operates.

The idea is to combine several tools under the umbrella of an effective and responsible cybersecurity policy. Not all methods have the exact Cost and are not equally accessible, so it is necessary to analyze them beforehand and see which are the most suitable for the web according to the available resources.

Open methodologies such as OWASP (Open Web Application Security Project) provide a basis for covering a large part of the controls needed to verify the security of web applications. However, new exploitation techniques are constantly emerging in the world of cybersecurity. It is a daily occurrence.

Therefore, it is vital that the consultant performing the exercise has sufficient skills and knowledge to apply both the tests associated with these methodologies and those related to new discoveries and trends in the community.

One thing to consider when choosing which tools or methods to use is the nature of the analysis. There are two types of web security tests: automatic and manual.

• Automatic scanning tools detect vulnerabilities that are usually the most exposed and publicly reported weaknesses in third-party software. They are critical in the early stages of analysis, as they allow an enumeration of exposed resources and potential information entry points.
• Manual tests are essential to carry out a comprehensive web security test. They are the only way to detect certain types of business logic vulnerabilities or advanced vulnerabilities requiring multiple techniques. One of the main tools for this type of manual testing is proxy tools. With these tools, the consultant performing the web security test can view, intercept, manipulate and forward HTTP requests traveling from the client side to the web server and introduce various attack vectors adapted to each context.

The keys to performing a web security test step by step

Before starting to perform a web security test, three essential factors must be taken into account:

• The scope of the test. It is necessary to define and specify which assets and functionalities are the target of the analysis and which are outside it.
• The test modality is black box, white box or gray box. A black box exercise means performing the web security test without prior information. If the mode is a gray box, the information available is partial, whereas if it is a white box, the exercise uses the most detailed information.
• Adaptation of the techniques used. This is important so as not to cause a possible negative impact on the availability of the service or the integrity of its data when testing in productive environments.

Once these three elements have been defined, it is time to work. Here are the steps to follow to perform a practical web security test. We will follow a two-phase model: an execution phase and a final documentation phase.

Execution phase

The execution phase, as its name suggests, is the technical phase in which the actual tests take place, which will test the web application’s security. It has the following steps:

• Information gathering. This first step has three fundamental milestones:
  • Identification of technologies and frameworks used by the web application
  • Enumeration of exposed resources
  • Identification of information entry points
• Identification of vulnerabilities
• Exploitation of vulnerabilities
• Gathering of evidence on the detected findings

Documentation phase

The documentation phase is critical, as it is the final product. A well-executed analysis in the technical phase that needs better documentation will not correctly convey the findings and will not meet the work’s objectives.

To be a complete and valuable report, it must detail all of the above points along with additional ones:

• The objectives of the analysis are scope and modality
• Possible limitations or problems detected during execution. Any item that could not be analyzed for any reason should be reflected in the documentation
• High-level executive summary
• Detail of vulnerabilities:
  • Severity metrics (CVSS standard)
  • Description of the impact
  • Steps to reproduce the vulnerability
  • Recommendations to fix the identified weaknesses

How often should a web security test be performed?

There are several variables to take into account to determine the frequency with which a web security test should be performed:

• Size and complexity of the application
• Sensitivity of the information managed
• Number of modifications or changes that the application undergoes

The larger these variables are, the more frequently web security tests should be performed.

It is interesting to remember that even if the application does not undergo modifications, new techniques and vulnerabilities are discovered in the security community that can affect it. Regardless of the above variables, performing at least one web security test per year would be advisable.

Logically, performing a web security test after suffering a security incident or having implemented significant changes to the application would also be necessary.

In short, web security tests are essential as a prevention tool. Their variety and versatility allow many combinations that can be adapted to every type of business and situation, effectively solving today’s and tomorrow’s problems.