Umfangreiche Testmethoden

Orientierend aktuellen WASC und OWASP Standards, haben wir Ihnen nachstehend eine kurze Zusammenfassung der wichtigsten Testmethoden zusammengestellt, die von unseren Web Scan Service unterstützt werden.

Sie sehen die Hauptthemen bzw. Oberbegriffe, welche insgesamt ~2000 Signaturen beinhalten .

Durch die Vielfalt der in Web Scan Service enthaltenen Testmethoden, können Sie Ihre Webseite auf alle aktuellen Sicherheitslücken testen, die derzeit in den verschiedensten webbasierenden Systemen vorhanden sind.

 

Aktuelle Testmethoden im Überblick (Kurzfassung)

√  Web Engine
WebScanService 4.0
√  Custom Design Errors
Cross-site Script Injection
Database Tampering - SQL Injection beinhaltet:
- Direct mode
- Blind mode
Buffer & Integer Overflow attack
Format String attack
File & Directories Tampering beinhaltet:
- Backup Files Discovery
- Configuration Files Discovery
- Password Files Discovery
- Information Leakage Discovery
Parameter Tampering beinhaltet:
- Special Parameter Addition attacks
- Boolean Parameter Tampering attacks
- Hidden Parameter Discovery
- Parameter Deletion attacks
- Remote Execution attacks
- File & Directory traversal attacks
- Header Splitting & CRLF Injection attacks
- Remote File Include PHP-based attacks
Check for Suspicious Values in Web Form Hidden Fields
Custom Signature Check (via Signature Editor)
√  Web Server Exposure
Web Server Infrastructure Analysis beinhaltet:
- Web Server & Platform version vulnerabilities
- SSL encryption and x.509 certificate vulnerabilities
- HTTP Method Discovery
- HTTP Fingerprint beinhaltet:
- Web Server Fingerprint
- Web Server technology Discovery
- Directory Brute-Force
- HTTP Protocol vulnerabilities
√  Web Signature Attacks
Web Attack Signatures beinhaltet:
- IIS CGI Decode Test
- IIS Extended Unicode Test
- IIS File Parsing Test
- FrontPage Security Test
- Lotus Domino Security Test
- General CGI Security Test
- HTTP Devices Security Test (routers, switches)
- Windows-based CGI Security Test
- PHP Web Application Security Test
- ASP Web Application Security Test
- J2EE Web Application Security Test
- Coldfusion Web Application Security Test
Attack templates such as:
- Complete, SANS/FBI Top10, Top20
√  Confidentiality Exposure Checks
Look for Web forms vulnerabilities beinhaltet:
- Password cache feature
- Insecure method for sending data
- Lack of Encryption for sensitive data
- Insecure location to send data (leakage)
Information Leakage beinhaltet:
- Find directory listing
- Find available objects to download
- Find meta-tag leakage
- Find sensitive keywords in comments and scripts
Compliance analysis beinhaltet:
- Find Copyright statements
- Find content rating statements
- Find custom content on web pages and forms
√  Cookie Exposure Checks
Cookie Security Analysis beinhaltet:
- Find weakness in cookie information
- Find cookies sent without encryption
- Find information leakage in cookie information
- Find cookies vulnerable to malicious client-side script
√  File & Directory Exposure Checks
Search for backup files
Search for information leakage files
Search for configuration files
Search for password files