Due to the ease of access, cost effectiveness and provision of service, the Web Application has emerged as a driving force of Implementation. Web Application has evolved to be more advanced, quicker in response times than that of desktop applications. Today Web Applications are more functional and flexible, which increases their value to business operations. It is this wide acceptability and adaptability of web applications that make them an enticing target for malicious users. The increasing complexity and use of new technologies has opened doors to greater and more devastating security risks.

Intending to commit corporate espionage, identity theft, fraud, and other illegal activities, hackers enter websites resulting in costly and embarrassing service disruptions, down-time, lost productivity, stolen data, regulatory fines, angry users and irate customers. To address these security threats and to prevent the associated negative consequences, companies need frequent and thorough web application penetration testing. Axxera consultants have a proven track record of success and an intimate understanding of the latest security vulnerabilities, and with customized analysis tools our security consultants are able to identify malicious activities and security vulnerabilities that are often overlooked.

Web Application Penetration Testing (WAPT) is a legally authorized, non-functional assessment of a given web application, carried out to identify loopholes. These vulnerabilities, exploited by a malicious user (attacker/hacker), may affect the confidentiality, integrity, availability of the web application and/or information distributed by it. Examples of these vulnerabilities include SQL Injection (Structured Query Language Injection), XSS(Cross Site Scripting), CSRF(Cross Site Request Forgery), Remote File Include, etc. Apart from these, vulnerabilities may exist in the underlying infrastructure like Operation System, Web Server, Application Server, and Database Server. WAPT aims at identifying and reporting the presence of these vulnerabilities.

Axxera’s Security Professional Services group operates on the premise that information security solutions must be based on the client’s fundamental business models and processes. Working closely with the client staff, members of our professional services team identify both high-level strategic threats and specific technical vulnerabilities and suggest solutions to mitigate risk.

Each relationship begins with a careful assessment of the client’s unique business practices and through mapping of the organizations information technology infrastructure. After identifying the client’s core business needs, Axxera develops a customized information security solution that combines expert consulting with product and service recommendations.

This is the most critical phase in the methodology as all further phases depend on this. As a part of this phase, information about the target web application should be collected: type of web application (e-commerce, social networking, e-retailing, etc), technology used (J2EE, .NET, PHP, PERL, etc), WHOIS, and trace route.

All the data gathered in the above phase, is converted into usable information, in the form of a customized test plan. An important step in this phase is to prepare a checklist of tasks or areas (URLs) or applicable vulnerabilities to cover.

This phase can also be dubbed as active information gathering phase. Various automated scans are run against the target application and its underlying infrastructure (server(s) and network); a web application is only as strong as the infrastructure it is hosted on. Vulnerability in any of the underlying infrastructure components could compromise the security of the web application. Axxera uses perimeter, internal, and external scanning methodologies to detect flaws that may be exploited for attack, identifies and prioritizes the most serious vulnerabilities, and recommends appropriate follow-up measures.