1. Vulnerability Analysis Dr. X

2. Computer system Design Implementation Maintenance Operation

3. What is a vulnerability?

4. Pen testing Red/tiger team attack Authorized attempt to violate specific contrants Tests Security Controls: procedural, operational, technical

5. Layers External, no access External, with access Internal, with access

6. Flaw hypothesis methodology Information gathering Flaw hypothesis Flaw testing Flaw generalization Flaw elimination

7. Vulnerability classification Intentional Time of flaw Location

8. Intentional

9. Time

10. Location

11. Pen test Port scan Vulnerability scan Why? Prevent data breach Test your security controls Ensure system security Get a baseline Compliance

12. Steps of pen test Establish goal Information gathering Reconnaissance Discovery Port scanning Vulnerability scanning Vulnerability analysis Taking control Exploitation Brute forcing Social engineering Pivoting Reporting Evidence collection Risk analysis Remediation

13. Steps 12 subcategories of the Web Application Penetration Testing Methodology: based on OWASP methodology 1.Introduction and Objectives 2.Information Gathering 3.Configuration and Deploy Management Testing 4.Identity Management Testing 5.Authentication Testing 6.Authorization Testing 7.Session Management Testing 8.Data Validation Testing 9.Error Handling 10.Cryptography 11.Business Logic Testing 12.Client Side Testing

14. Steps Step 1: Introduction and Objectives Step 2:Information gathering Step 3:Vulnerability analysis Step 4:Simulation (Penetrate the system to provide the proof) Step 5:Risk assessment Step 6:Recommendations for reduction or recovery and providing the report