渗透测试 CheckLists
Most of the web applications are public-facing websites of businesses, and they are a lucrative target for attackers. Hence, it becomes imperative for companies to ensure that their web applications are adequately protected and are not prone to cyber-attacks. Our penetration testing experts have compiled a checklist to be utilized while performing a penetration test for web applications. We will look at this checklist’s items one by one. 大多数Web应用程序都是面向公众的企业网站，它们是攻击者有利可图的目标。因此，公司必须确保其Web应用程序得到充分保护并且不易受到网络攻击。我们的渗透测试专家编制了一份清单，以便在对 Web 应用程序执行渗透测试时使用。我们将一一查看此清单的项目。
Contact form 联系表格
Contact forms available on a web application act as entry points for spammers. If adequate security mechanisms are not implemented, there are chances that the associated email account is flooded with spamming emails. Hence, the contact form should be able to identify and prevent such attacks. CAPTCHA is one such way to prevent spamming. Web 应用程序上可用的联系表单充当垃圾邮件发送者的入口点。如果未实施足够的安全机制，则关联的电子邮件帐户可能会充斥着垃圾邮件。因此，联系表格应该能够识别和防止此类攻击。验证码是防止垃圾邮件的一种方式。
Proxy server 代理服务器
Proxy servers play a significant role in directing traffic to your web application and filtering out malicious activities. The penetration testers must check whether the proxy servers within an organization’s network are functioning as desired. Tools like OWASP ZAP and Burp can help the penetration testing team. 代理服务器在将流量定向到 Web 应用程序和过滤掉恶意活动方面发挥着重要作用。渗透测试人员必须检查组织网络中的代理服务器是否按预期运行。OWASP ZAP和Burp等工具可以帮助渗透测试团队。
Spam Email Filter 垃圾邮件过滤器
Spam filters must be enabled to ensure that email policies are being enforced as expected. The penetration testers verify whether the spam filter. 必须启用垃圾邮件筛选器，以确保按预期强制实施电子邮件策略。渗透测试人员验证垃圾邮件是否过滤器。
Network Firewall 网络防火墙
Just like proxy servers, network firewalls prevent undesirable traffic from entering your web application. The penetration testers not only check the efficiency of a network firewall but also explore the possibilities of bypassing the firewalls. 就像代理服务器一样，网络防火墙可防止不需要的流量进入您的 Web 应用程序。渗透测试人员不仅检查网络防火墙的效率，还探索绕过防火墙的可能性。
Security Vulnerabilities 安全漏洞
The penetration testers here simulate various modus operandi used by the attackers to simulate a real-life attack. Vulnerabilities can exist in network devices, servers, databases, web applications, etc. 这里的渗透测试人员模拟攻击者用来模拟现实生活中的攻击的各种作案手法。漏洞可能存在于网络设备、服务器、数据库、Web 应用程序等中。
Credential Encryption 凭据加密
The penetration testers look out for the possibilities of conducting a man-in-the-middle attack. An organization must encrypt login credentials, and they should be only transferred over a secure HTTPS connection. When a web application is to be secured, encryption plays a vital role. 渗透测试人员会寻找进行中间人攻击的可能性。组织必须加密登录凭据，并且只能通过安全的 HTTPS 连接传输这些凭据。当要保护 Web 应用程序时，加密起着至关重要的作用。
Cookies 饼干
Cookies store data related to a user’s session on your web application. This is a sensitive piece of information, and with increasing privacy and protection laws across the globe, it is not a favorable position for a business to allow this confidential information to get exposed to attackers. Cookie 在您的网络应用程序上存储与用户会话相关的数据。这是一个敏感信息，随着全球隐私和保护法律的增加，企业允许这些机密信息暴露给攻击者并不是一个有利的位置。
Login Page 登录页面
The penetration testers test a web application’s login page from multiple angles. One such angle is to ensure that only a limited number of login attempts are made for a corresponding user. This ensures that dictionary attacks are prevented. 渗透测试人员从多个角度测试 Web 应用程序的登录页面。其中一个角度是确保只对相应的用户进行有限次数的登录尝试。这可确保防止字典攻击。
Error Message 错误信息
Error messages on your web application should not reveal more than required information about the problem. The error messages shown must be generic in nature. A detailed error message is similar to inviting the attackers to attack your web application. Web 应用程序上的错误消息显示的信息不应超过有关该问题的所需信息。显示的错误消息必须是通用的。详细的错误消息类似于邀请攻击者攻击您的 Web 应用程序。
Usernames & Passwords 用户名和密码
The penetration testers test all the usernames and passwords which are used on your web application. A password must be fairly complex, and the username must not be easily guessable. 渗透测试人员测试您的 Web 应用程序上使用的所有用户名和密码。密码必须相当复杂，并且用户名不能容易猜到。
File Scanning 文件扫描
Before files are uploaded either to your web application or server, they must be scanned to ensure that they do not contain harmful content. 在将文件上载到 Web 应用程序或服务器之前，必须对其进行扫描以确保它们不包含有害内容。
SQL Injection SQL 注入
This is one of the most common methods used by attackers while exploiting web applications. The penetration testers perform SQL injection attacks on all the components of your web application. 这是攻击者在利用 Web 应用程序时使用的最常见方法之一。渗透测试人员对 Web 应用程序的所有组件执行 SQL 注入攻击。
XSS XSS
Just like SQL injection, cross-site scripting, or XSS, is another common method employed by attackers to launch attacks on an organization’s web application. The penetration testers check whether security mechanisms implemented to prevent an XSS attack are working correctly or not. 就像SQL注入一样，跨站点脚本或XSS是攻击者用来对组织的Web应用程序发起攻击的另一种常用方法。渗透测试人员检查为防止XSS攻击而实施的安全机制是否正常工作。
Session Hijacking 会话劫持
Once a user logs out of your web application, his user session must be terminated. Moreover, a user must be allocated the minimum user access privilege possible – nothing less, nothing more. Valid sessions may be hijacked by the attackers, which allows them to view all the information that a user is allowed to. 用户注销 Web 应用程序后，必须终止其用户会话。此外，必须为用户分配尽可能低的用户访问权限 - 仅此而已。有效会话可能会被攻击者劫持，从而允许他们查看允许用户查看的所有信息。
Brute Force 蛮 力
The penetration testers analyze whether your web application is safe against brute force attacks or not. A brute force attack is a trial and error method that is used by the attackers to break through your encryption method or find the correct credentials to your web application. 渗透测试人员分析您的 Web 应用程序是否安全免受暴力攻击。暴力攻击是一种反复试验的方法，攻击者使用它来突破您的加密方法或找到 Web 应用程序的正确凭据。
DoS Attack 拒绝服务攻击
By launching DoS attacks on your web application, the attackers send a large number of requests to your web application. A DoS attack not only prevents genuine users from accessing your web application but also leads to downtime. However, using appropriate mitigation tools can significantly minimize the threat. 通过对 Web 应用程序发起 DoS 攻击，攻击者会向您的 Web 应用程序发送大量请求。DoS 攻击不仅会阻止真正的用户访问您的 Web 应用程序，还会导致停机。但是，使用适当的缓解工具可以显著减少威胁。
Directory Traversal 目录遍历
An organization must disable directory traversal on the server where a web application is hosted. If directory traversal is not prevented, the attackers get easy access to your organization’s confidential information. 组织必须在托管 Web 应用程序的服务器上禁用目录遍历。如果不阻止目录遍历，攻击者可以轻松访问组织的机密信息。
Open Ports 开放端口
Unnecessarily open ports on your web application act as an invite for the attackers to exploit your web application. Only posts which are required for your web application to perform must be kept open. Web 应用程序上不必要的开放端口会邀请攻击者利用您的 Web 应用程序。只有您的 Web 应用程序执行所需的帖子必须保持打开状态。
HTTP Method HTTP方法
The penetration testers review the HTTP methods used by your web application. As a mandatory step, PUT and DELETE methods shall not be enabled. 渗透测试人员会审查 Web 应用程序使用的 HTTP 方法。作为强制性步骤，不应启用 PUT 和 DELETE 方法。
Access Permissions 访问权限
An audit of access permissions given to various users for your web application must be conducted. As stated, a user should only be given the minimum access level privilege possible. 必须对授予 Web 应用程序的不同用户的访问权限进行审核。如前所述，应仅向用户授予可能的最低访问级别权限。
Information Gathering 信息收集
There’s an old saying that holds value in this scenario regarding Web Application Penetration Testing – “Begin with the End in Mind.” One of the biggest components of ensuring that your organization gets the most value out of a Web Application Penetration Test is proper planning, which cannot be overlooked. Once you can articulate what exactly it is that you are looking to gain from a Web Application Penetration Test, it is easier to develop an action plan that caters to your organization’s objectives. Businesses often call this approach an ‘Outcome-Based Approach.’ 关于Web应用程序渗透测试，有一句老话在这种场景中具有价值 - “从最终开始”。确保您的组织从 Web 应用程序渗透测试中获得最大价值的最大组成部分之一是适当的规划，这是不容忽视的。一旦您可以阐明您希望从 Web 应用程序渗透测试中获得的确切收益，就更容易制定满足组织目标的行动计划。企业通常将这种方法称为“基于结果的方法”。
Whatever your organization’s reason is for planning a Web Application Penetration Testing, following this checklist of questions that need to be answered before you start can help relieve some of the intricacies involved in the process. 无论您的组织计划进行 Web 应用程序渗透测试的原因是什么，遵循此在开始之前需要回答的问题清单都有助于缓解该过程中涉及的一些复杂性。
What is your organization’s objective of getting a PenTest done? 您的组织完成渗透测试的目标是什么？
a. Gain customer’s trust by demonstrating proactiveness in security measures with an assessment of the current security posture 一个。通过评估当前的安全状况来展示安全措施的主动性，从而获得客户的信任 b. Regulatory or industry-level compliance/standards b.法规或行业级合规性/标准 c. Security Posture Assessment/Management c. 安全状况评估/管理 d. Attack Surface Management d. 攻击面管理 e. DevSecOps 和。DevSecOps
What Is the Scope? 范围是什么？
a. What environment should you be conducting the PenTest in, staging or production? 一个。您应该在什么环境中进行渗透测试，暂存或生产？ b. Do you need BlackBox or GreyBox or Whitebox testing? b.您需要黑盒、灰盒或白盒测试吗？
What is the best tool or vendor for the job? 最适合这项工作的工具或供应商是什么？
a. Traditional consultant-based approach 一个。传统的基于顾问的方法 b. Automated Testing approach b. 自动化测试方法 c. Modern Penetration Testing approach that uses A.I. and Human PenTesters both c. 现代渗透测试方法，同时使用人工智能和人类渗透测试仪
What is the best time to schedule your Penetration Test? 安排渗透测试的最佳时间是什么时候？
a. How often should I be conducting Penetration Testing? 一个。我应该多久进行一次渗透测试？ b. What are the triggers for a PenTesting activity? b.渗透测试活动的触发器是什么？
What is your plan for remediation? 您的补救计划是什么？
a. What is the guideline around the time you will take to fix a High, Medium or a Low vulnerability? 一个。修复高、中或低漏洞的准则是什么？ b. What is the process to deploy and test your patch for each vulnerability? b.针对每个漏洞部署和测试补丁的过程是什么？
What is your organization’s reason for getting a Web Application PenTest? 您的组织获得 Web 应用程序渗透测试的原因是什么？
There are cases in which businesses are simply considering Web Application Penetration Testing as a proactive security posture procedure and there are cases when it’s required for compliances, vendor assessments, and client requests. Some of these compliances include: 在某些情况下，企业只是将 Web 应用程序渗透测试视为主动安全态势过程，在某些情况下，合规性、供应商评估和客户端请求需要它。其中一些合规性包括：
- PCI DSS PCI DSS
- HIPAA HIPAA
- SOC2 SOC2
- NYDFS 500 NYDFS 500
- ISO 27001 ISO 27001 认证
- CCPA 中国通用技术咨询
- GDPR 通用数据保护条例
Having an in-depth understanding of what is required by a vendor or client out of a PenTest will set you on the right path to move deeper into the planning phase. 深入了解供应商或客户对渗透测试的要求将使您走上更深入规划阶段的正确道路。
What is the scope of the Web Application PenTest? Web 应用程序渗透测试的范围是什么？
When planning to begin a PenTest on your organization’s Web Application, providing your selected vendor with the scope of what needs to be tested is especially important. The Rules of Engagement should also be agreed upon at the beginning. Businesses often struggle with identifying the scope of PenTests, as there are multiple variables involved. However, the scope of the engagement should be derived from the objective of the PenTest, reaffirming the idea of the ‘Outcome-Based Approach.’ For example, for PCI DSS compliance testing, all the applications and systems coming in the Card DataHolder Environment (CDE) should be included and it should also include a plan to test the isolation of CDE to non-CDE environment. 在计划的组织的 Web 应用程序上开始渗透测试时，为所选供应商提供需要测试的范围尤为重要。《接战规则》也应在一开始就达成一致。企业经常难以确定渗透测试的范围，因为涉及多个变量。但是，参与的范围应来自渗透测试的目标，重申“基于结果的方法”的理念。例如，对于 PCI DSS 合规性测试，应包括卡 DataHolder 环境 （CDE） 中的所有应用程序和系统，并且还应包括测试 CDE 与非 CDE 环境的隔离的计划。
Another example: if you have made significant changes to an application, it’s best that the organization test the recent changes/additions to see if the changes made caused any vulnerabilities to arise. 另一个示例：如果您对应用程序进行了重大更改，则组织最好测试最近的更改/添加，以查看所做的更改是否导致出现任何漏洞。
There is also the decision between a White Box, Grey Box, or Black Box Penetration Test to consider. It is extremely important that your vendor has the correct information to ensure that the results of the PenTest live up to its requirements and objective. For example, if an organization requesting a blackbox test for a web application that only has a Form-Login page, and the entire application and interfaces are behind the login, the BlackBox PenTest results will not be helpful.
还需要考虑白盒、灰盒或黑盒渗透测试之间的决定。您的供应商拥有正确的信息以确保渗透测试的结果符合其要求和目标，这一点非常重要。例如，如果一个组织请求对只有一个表单登录页面的 Web 应用程序进行黑盒测试，并且整个应用程序和界面都在登录后面，那么 BlackBox 渗透测试结果将没有帮助。
It is equally important to understand the environment in which you want the Web Application to be tested. Most organizations, due to fear of a disruption in business, get the staging environment of the application PenTested. 了解要在其中测试 Web 应用程序的环境同样重要。由于担心业务中断，大多数组织都会获得应用程序PenTested的暂存环境。
What is the best tool or vendor for the job? 最适合这项工作的工具或供应商是什么？
The key to finding the right tool or vendor should also stem from the objective of testing. Organizations often use a traditional Penetration Testing approach for compliance-based testing and rely on consultant-based model entirely. The traditional model has proven to be effective in the past, but it is not scalable in the current digital era. 找到合适的工具或供应商的关键也应该源于测试的目标。组织通常使用传统的渗透测试方法进行基于合规性的测试，并完全依赖基于顾问的模型。传统模式在过去已被证明是有效的，但在当前的数字时代是不可扩展的。
Similarly, organizations looking at assessing the current security posture take a tool-based approach which gives them scalability and comprehensiveness, but it often misses the business context and testing of business controls. 同样，希望评估当前安全状况的组织采用基于工具的方法，该方法为他们提供可扩展性和全面性，但它经常错过业务上下文和业务控制的测试。
Additionally, credibility of the vendor is an especially important factor that determines the admissibility of the reports by auditors. 此外，供应商的信誉是决定审计员接受报告的一个特别重要的因素。
For example, organizations in Financial Services and Healthcare Technology require their PenTesting vendors to be ISO 27001 certified due to the rigorous nature of the certification process. 例如，金融服务和医疗保健技术领域的组织要求其渗透测试供应商获得ISO 27001认证，因为认证过程的严格性。
ISO 27001 requires vendors to go through a meticulous 6–12-month process to earn their certifications. An ISO 27001 Global Report done by IT Governance found from a survey of vendors in over 53 countries that 71% of them reported receiving requests from clients for proof of ISO 27001 certification, proving that ISO 27001 is a widely recognized industry standard across the globe. Additionally, industry recognitions, certifications, and compliances such as CREST and SOC II are equally important.
ISO 27001要求供应商通过6-12个月的细致流程才能获得认证。IT 治理部门发布的 ISO 27001 全球报告对超过 53 个国家的供应商进行的调查发现，其中 71% 的供应商报告收到了客户要求提供 ISO 27001 认证证明的请求，证明 ISO 27001 是全球广泛认可的行业标准。此外，行业认可、认证和合规性（如 CREST 和 SOC II）同样重要。
Some other considerations to make when choosing the right Penetration Testing vendor are whether or not they employ in-house or outsource/crowdsource their Penetration Testers, what kind of tools they use internally, and whether or not they use third-party services to share details about PenTest results. Having a third party in the mix for reporting purposes can pose an entirely new set of privacy risks, especially before remediation efforts have been completed. Any of these concerns can easily be put to rest by doing your due diligence to source the best partner for the job. 选择合适的渗透测试供应商时要考虑的其他一些因素是，他们是否使用内部或外包/众包渗透测试人员，他们在内部使用哪种工具，以及他们是否使用第三方服务来共享有关渗透测试结果的详细信息。出于报告目的而使用第三方可能会带来一系列全新的隐私风险，尤其是在补救工作完成之前。通过尽职调查为工作寻找最佳合作伙伴，可以轻松消除这些问题中的任何一个。
When is the best time to schedule a PenTest for your Web Application? 为 Web 应用程序安排渗透测试的最佳时间是什么时候？
In any organization, there are always going to be peak business hours that drive traffic on its Web Application. It goes without saying that those peak business hours are not an ideal time of the day to plan a PenTest. The best way to work around this is to monitor trends in traffic over time to ensure that you can work with your Penetration Testing vendor to schedule the PenTest at the least disruptive time in case its activities had any temporary adverse effects on the performance of the application. When working with a skilled Penetration Tester, it’s unlikely that any issues would arise, but it is best to er on the side of caution. 在任何组织中，总会有高峰营业时间来增加其 Web 应用程序的流量。不用说，这些高峰营业时间并不是一天中计划PenTest的理想时间。解决此问题的最佳方法是监视一段时间内的流量趋势，以确保您可以与渗透测试供应商合作，将渗透测试安排在中断最少的时间，以防其活动对应用程序的性能产生任何暂时的不利影响。与熟练的渗透测试人员合作时，不太可能出现任何问题，但最好谨慎行事。
Another thing to keep in mind when planning to schedule your PenTest is any major updates to your WebApp or any industry-wide announcements of a new vulnerability. Any changes to the code or structure of a Web Application could be a place for a new vulnerability to make way. 在计划安排渗透测试时要记住的另一件事是对 WebApp 的任何重大更新或任何行业范围内新漏洞的公告。对 Web 应用程序代码或结构的任何更改都可能成为新漏洞让路的地方。
In order to receive the maximum value out of PenTest engagement and investment, organizations should take a periodic assessment approach with on-demand testing on an ad hoc basis. For example, the compliance may suggest getting a PenTest every quarter, but the organization should be cognizant of requesting an ad hoc PenTest if there are significant changes made to the system/application or if the threat landscape has changed significantly. 为了从渗透测试参与和投资中获得最大价值，组织应采取定期评估方法，在临时基础上进行按需测试。例如，合规性可能建议每季度获取一次渗透测试，但如果对系统/应用程序进行了重大更改或威胁形势发生了重大变化，组织应认识到请求临时渗透测试。
What is your plan for remediation? 您的补救计划是什么？
Directly after receiving Web Application Penetration Test results, you’re going to want to get right to work with understanding the vulnerabilities detected, especially any critical, high, and medium ones. More often than not, vendors don’t offer a channel to speak with the PenTesters to get context and clarity on reported findings. However, it is a crucial step towards an effective remediation via prioritization. 在收到 Web 应用程序渗透测试结果后，您将希望立即了解检测到的漏洞，尤其是任何关键、高和中等漏洞。通常情况下，供应商不会提供与PenTesters交谈的渠道，以获取报告结果的背景和清晰度。但是，这是通过优先级确定进行有效补救的关键一步。
It’d serve your organization well to have a solid plan for remediation efforts as far as delegating remediation efforts to your developer team and having a timeline goes to prepare for a retest. Traditional models also don’t offer workflow integration to assign the findings to the concerned team and because of manual management of spreadsheets and word documents, quite a lot of valuable information falls between the cracks. Rest assured – there are vendors out there who are receptive to this pain-point in the Penetration Testing process and have implemented innovative ways around it. 制定可靠的修正工作计划将修正工作委派给开发人员团队，并制定时间表为重新测试做准备，这将对你的组织大有裨益。传统模型也不提供工作流集成来将结果分配给相关团队，并且由于手动管理电子表格和 Word 文档，相当多的有价值的信息都落在了裂缝之间。请放心 - 有些供应商愿意接受渗透测试过程中的这个痛点，并围绕它实施了创新的方法。
Depending on the goal of the PenTest, it may be best to focus on specific types of vulnerabilities that are most closely related to specific functions or bits of information stored in the Web Application. Having the appropriate business context before remediation efforts begin can make a positive difference in your team’s ability to prioritize remediation efforts on exploitable vulnerabilities that have the greatest effect on your business. Schedule a call to learn more about breachlock penetration testing as a service. 根据渗透测试的目标，最好关注与 Web 应用程序中存储的特定功能或信息位最密切相关的特定类型的漏洞。在修正工作开始之前拥有适当的业务环境可以对您的团队确定对业务影响最大的可利用漏洞的修正工作的优先级的能力产生积极影响。安排通话以了解有关漏洞锁渗透测试即服务的更多信息。
- 信息收集和侦察：
- 开放式情报收集（OSINT）
- 域名枚举和子域名收集
- 主机发现和端口扫描
- 操作系统和服务识别
- 漏洞情报收集和分析
- 网络扫描和漏洞评估：
- 漏洞扫描和评估
- Web应用程序扫描和安全评估
- 操作系统和服务配置审计
- 社交工程安全测试
- 身份验证和访问控制测试：
- 密码策略和凭证安全性评估
- 身份验证机制测试（如弱密码、凭证重用等）
- 会话管理和权限验证测试
- 特权提升和越权访问测试
- Web应用程序安全测试：
- 输入验证和安全配置测试
- 跨站脚本攻击（XSS）和跨站请求伪造（CSRF）测试
- SQL注入和命令注入测试
- 文件上传和文件包含测试
- 安全标头和加密测试
- 网络安全测试：
- 网络架构和拓扑评估
- 网络设备和防火墙安全测试
- 无线网络安全测试
- 拒绝服务（DoS）和DDoS测试
- 本地网络安全测试（如ARP欺骗）
- 漏洞利用和后渗透测试：
- 操作系统和应用程序漏洞利用
- 特权提升和权限维持
- 数据泄露和隐私问题测试
- 后渗透测试和内部网络探测
- 物理安全和社会工程测试：
- 物理安全评估（如设备访问控制和机房安全）
- 社会工程测试（如钓鱼、网络钓鱼等）
- 媒体设备和信息安全测试
- 移动应用程序和无线安全测试：
- 移动应用程序安全测试
- 移动设备管理（MDM）和策略评估
- 无线网络安全测试和蓝牙安全测试
- 安全配置和安全加固：
- 操作系统和应用程序的安全配置评估
- 加固建议和安全增强措施
- 安全补丁管理和漏洞修复建议
- 报告和总结：
- 渗透测试结果的整理和总结
- 缺陷报告和风险评估
- 修复建议和安全建议