Articles

Test de pénétration d'application Web : qu'est-ce que c'est ?

Test de pénétration d’application Web : qu’est-ce que c’est ?

,

Le test de pénétration d’application Web est une méthode pour vérifier la sécurité des applications Web. Découvrez comment cela fonctionne !

C’est également connu sous le nom de test de pénétration d’application web ou de test de sécurité, qui est une évaluation organisée de la sécurité d’une application web pour identifier l’exposition et la faiblesse qui pourraient être exploitées par des acteurs malveillants.

1. Identifying the target application and its environment. 

2. Gathering information about the target application. 

3. Identifying potential vulnerabilities. 

4. Exploiting the identified vulnerabilities. 

5. Documenting the results and providing recommendations. 

Le test d’intrusion des applications web, également connu sous le nom de test de sécurité ou de test d’intrusion, est une évaluation organisée de la sécurité d’une application web afin d’identifier les expositions et les faiblesses qui pourraient être exploitées par des acteurs malveillants. L’objectif principal du test d’intrusion est d’évaluer de manière proactive la posture de sécurité d’une application web et d’identifier les vulnérabilités potentielles avant que des attaquants ne puissent les exploiter.

Pendant un test d’intrusion d’application web, des professionnels de la sécurité qualifiés, connus sous le nom de testeurs d’intrusion ou de hackers éthiques, simulent divers scénarios d’attaque pour découvrir les failles de sécurité qui pourraient entraîner un accès non autorisé, des violations de données ou d’autres activités malveillantes. Le processus implique les points suivants :

1. Identification de l’application cible et de son environnement.

2. Recueil d’informations sur l’application cible.

3. Identification des vulnérabilités potentielles.

4. Exploitation des vulnérabilités identifiées.

5. Documentation des résultats et fourniture de recommandations.

Le test d’intrusion des applications web est un processus essentiel pour assurer la sécurité des logiciels et des systèmes informatiques. Les tests d’intrusion peuvent être effectués manuellement ou automatiquement à l’aide de logiciels spécialisés. Ces outils peuvent être utilisés pour rechercher des vulnérabilités connues et des failles de sécurité dans les applications web et les systèmes informatiques. Les tests d’intrusion peuvent également être effectués pour vérifier si les applications web respectent les normes et les réglementations en matière de sécurité.

Les tests d

Source de l’article sur DZONE

/par

Security Bugs Are Fundamentally Different Than Quality Bugs

,

This topic has come up a few times this year in question period: arguments that quality bugs and security bugs « have equal value, » that security testing and QA are « the same thing, » that security testing should « just be performed by QA » and that « there’s no specific skillset » required to do security testing versus QA. This article will explain why I fundamentally disagree with all of those statements.

First, some definitions.

Source de l’article sur DZONE

/par

What Is the Difference Between SAST, DAST, and IAST?

,

What benefits does SAST have? What’s the difference between SAST and DAST? What’s IAST? What do all these words mean?! Let’s talk about this and more in the overview of the main types of Application Security Testing (AST).

Informational Security

Before we start deciphering these terms, let’s figure out why we need security testing at all. In modern world, software integrates into automation processes almost everywhere, the number of code lines in applications is increasing. As a result, the number of possible vulnerabilities and errors is increasing as well. This creates the need for effective checking and testing of the source code.

Source de l’article sur DZONE

/par

SAST in Secure SDLC: 3 Reasons to Integrate It in a DevSecOps Pipeline

,

Vulnerabilities produce enormous reputational and financial risks. As a result, many companies are fascinated by security and desire to build a secure development life cycle (SSDLC). So, today we’re going to discuss SAST — one of the SSDLC components.

SAST (static application security testing) searches for security defects in application source code. SAST examines the code for potential vulnerabilities — possible SQL injections, XSS, SSRF, data encryption issues, etc. These vulnerabilities are included in OWASP Top 10, CWE Top 25, and other lists.

Source de l’article sur DZONE

/par

Top 3 Chatbot Security Vulnerabilities in 2022

,

Article Image

Chatbots Are Here To Stay

Chatbots have been around for a long time and based on the global chatbot market size (and the expected growth), they will stick around for a long time and gain importance. In the past, they’ve rarely met customer expectations or provided much positive experience. However, over the last few years, advances in conversational AI have transformed how they can be used. Since chatbots offer a wide range of applications, in certain cases, they become responsible for collecting and protecting personal information as well. 
Consequently, they are a great attraction for hackers and malicious attacks too. The responsibility of ensuring chatbot security has become more evident after the introduction of GDPR in Europe. As statistics show that this technology will be a determining factor in our lives, security testing must also become part of our daily tasks, so that these chatbots can be used with confidence.

Security Risks, Threats, and Vulnerabilities                 

The words risk, threat, and vulnerability are often confused or used interchangeably when reading about computer security, so let’s first clarify the terminology:

  • Vulnerability refers to a weakness in your software (or hardware, or in your processes, or anything related). In other words, it’s a way hackers could find their way into and exploit your systems.
  • A threat exploits a vulnerability and can cause loss, damage, or destruction of an asset – threats exploit vulnerabilities.                
  • Risk refers to the potential for lost, damaged, or destroyed assets – threats + vulnerability = risk! 
The well-known OWASP Top 10 is a list of top security risks for a web application. Most chatbots out there are available over a public web frontend, and as such, all the OWASP security risks apply to those chatbots as well. Out of these risks, there are two especially important to defend against, as in contrast to the other risks, those two are nearly always a serious threat — XSS (Cross-Site Scripting) and SQL Injection.
In addition, for artificial intelligence-enabled chatbots, there is an increased risk for Denial of Service attacks, due to the higher amount of computing resources involved.

Vulnerability 1: XSS – Cross-Site Scripting

A typical implementation of a chatbot user interface:           

           

  • There is a chat window with an input box.
  • Everything the user enters in the input box is mirrored in the chat window.
  • Chatbot response is shown in the chat window.

The XSS vulnerability is in the second step — when entering text including malicious Javascript code, the XSS attack is fulfilled when the web browser is running the injected code:

 <script>alert(document.cookie)</script>              

Possible Attack Vector

For exploiting an XSS vulnerability the attacker has to trick the victim to send malicious input text. It can be done through one of the following ways:

/par

Automated Pen Testing With Zed Attack Proxy

,

In this post, you will learn how to execute penetration tests with OWASP Zed Attack Proxy (ZAP). ZAP is a free web app scanner which can be used for security testing purposes.

1. Introduction

When you are developing an application, security must be addressed. It cannot be ignored anymore nowadays. Security must be taken into account starting from initial development and not thinking about it when you want to deploy to production for the first time. Often you will notice that adding security to your application at a later stage in development, will take a lot of time. It is better to take security into account from the beginning, this will save you from some painful headaches. You probably have some security experts inside of your company, so let them participate from the start when a new application needs to be developed. Nevertheless, you will also need to verify whether your developed application is secure. Penetration tests can help you with that. OWASP Zed Attack Proxy (ZAP) is a tool which can help you execute penetration tests for your application. In this post, you will learn how to setup ZAP and execute tests with the desktop client of ZAP. You will also need a preferably vulnerable application. For this purposes, Webgoat of OWASP will be used. In case you do not know what Webgoat is, you can read a previous post first. It might be a little bit outdated because Webgoat has been improved since then, but it will give you a good impression of what Webgoat is. It is advised to disconnect from the internet when using Webgoat because it may expose your machine to attacks.

Source de l’article sur DZONE

/par

My Picks for Shifting Left: ‘21

,

Here at ShiftLeft, we are gearing up for Shifting Left: ’21, a one-day application security conference for developers and security practitioners on Jan 28, 2021. I’ve been a huge fan of security conferences ever since I attended my first security conference, NorthSec in Montreal. This time, I am excited to be on the organizer’s side and present this conference to you.

Shifting Left: ‘21 is entirely online and free to register here. Now let’s get into it! Here are the sessions that I am most excited about and that you should attend if you like machine learning, developing secure applications, or hacking into applications.

Source de l’article sur DZONE

/par