Why Web Application Penetration Testing?
Nowadays 80% of all technical attacks are aimed at the Web Application layer. Symantec reports in 2021 that most applications have exploitable flaws. Additionally business logic vulnerabilities are rising exponentially. These flaws are impossible to detect with automated tooling.
Compliance regulations may require regular pen testing
Customers and partners may require proof of regular pen testing
Proactive security investment instead of reactive repair costs
Avoid legal action and reputational damage following a breach
Automated scanners are unable to find a lot of the modern application flaws such as IDORs (Insecure Direct Object Reference) and business logic flaws. Only skilled testers performing manual tests can encounter these critical flaws and help clients in fixing them.
Service description
This service examines websites and web applications, portals, APIs and backend database storage from a coding and implementation flaw perspective, and also looks at technical issues such as described in the OWASP Top 10 framework. It involves attempts to actively exploit vulnerabilities in order to demonstrate data leakage and gaining access to the web application, underlying database services, APIs (Application Programming Interfaces) and the hosting environment itself.
In a Web Application Vulnerability Assessment, which is a cost effective alternative to a Web Application Penetration Test, we only report on the flaws without actively exploiting them.
Tests performed
Our testing methodologies are aligned with the following frameworks: NIST, OWASP Top 10 (Web and API) as well as SANS Top 25. This includes testing for OS Command Injections, XXE, Oauth, SSO, SQLi, XSS, CSRF, SSRF, credential brute forcing, IDOR, Business logic, Click Jacking, DOM based flaws, CORS, HTTP Request Smuggling, Server-Side Template injection, Directory Traversal, Access Control, Authentication, Web Sockets, Web Cache Poisoning, Insecure Deserialization, Information Disclosure and HTTP Host Headers.
Deliverables
Full report (Executive summary and in-depth technical report)
Mitigation Advice on encountered vulnerabilities
Instant notification of critical vulnerabilities found during testing phase
Secure report delivery by encrypted email
Flexible options
Vulnerability Assessment (Identification without exploitation)
Black-box (from an attacker’s perspective without credentials)
Grey-box (from a malicious user’s perspective with user credentials)
White-box (with full admin credentials and access to source code)
External testing (Internet facing) or internal testing via VPN
Packages for recurring and continuous automated testing available
Impact minimization by protection from malicious exploits or DDoS tests
Fine grained scoping and testing only during agreed schedule
Why Bongo Security?
Consultants with 10+ years of ethical hacking experience
Consultants certified to highest levels such as OSCP, OSCE, OSWE, GIAC
Experience across all industry and government sectors
We are an independent third party concerned with finding & fixing flaws
No conflict of interest. We are not embedded with HW/SW vendors
Dedicated Red Team approach with specialists in all technologies
Leveraging Bug Bounty Expertise
Many of our consultants are actively engaged in public and private bug bounty programs for brands like Amazon, Twitter, Facebook, Google, Uber, LinkedIn, the U.S. Department of Defense and others. These are often seasoned and extremely hardened systems and applications, yet our consultants discover and report high impact flaws in these companies on a regular basis. We are leveraging our bug bounty expertise on hardened systems and applications in our Penetration Testing methodology.
As of August 2024, one of our founders who goes by the nickname of “bongo” managed to achieve 1st. rank amongst hundreds of security researches on Bug Bounty Hunter. Bug Bounty Hunter is a sophisticated modern web application with all kinds of vulnerabilities which have been found in real-world application bug hunting.
https://www.bugbountyhunter.com/hunter/bongo
Download Flyer and Sample Reports
1. BONGO-SECURITY-FLYER
2. BONGO-SECURITY-PENETRATION-TESTING-SAMPLE-REPORT
References and Certifications
If you would like to speak to one of our existing customers, we are happy to arrange that. Please note that a lot of customers wish to remain anonymous and not to serve as a reference due to the sensitivity of the work we perform. Naturally we always comply with our customers. We do however have some clients who are happy to serve as references. Should you require validation of our consultant’s certifications, we can arrange that as well.