1. End-to-End Methodology

2. Testing Phases  Reconnaissance  Mapping  Discovery  Exploitation  Repeat…  Report

3. Reconnaissance  Whois records  Architecture diagrams  IPs and Hostnames  DNS information  Google Searches  Social Networks  Blogs and Other Web Sites

4. Whois [laa@lobo ~]$ whois generalstatics.com [Querying whois.verisign-grs.com] domain: generalstatics.com owner: Neale Pickett organization: WoozleWorks email: hostmaster@woozle.org address: 2175 35th St city: Los Alamos state: NM postal-code: 87544 country: US phone: +1.5055004666 admin-c: CCOM-411473 hostmaster@woozle.org tech-c: CCOM-411473 hostmaster@woozle.org billing-c: CCOM-411473 hostmaster@woozle.org nserver: ns1.afraid.org contact-hdl: CCOM-411473 person: Neale Pickett organization: WoozleWorks email: hostmaster@woozle.org address: 2175 35th St city: Los Alamos state: NM postal-code: 87544 country: US phone: +1.5055004666 source: joker.com live whois service

5. Architecture Diagram

6. Mapping  Port scans  Version Checking  OS Fingerprinting  Spidering  Pieces/flow of the application User/admin/public areas Login screens Configuration and Management Session identifiers  Learning the various components that make up a web application

7. Network Scan

8. Discovery  Focus is on finding issues  User interfaces  Information leakage  Authentication systems  Error messages  Some exploitation will happen as part of this step Directory browsing

9. Directory Browsing

10. Exploitation  Attacking the flaws in an application Injection XSS Authentication/Authorization bypass  Determine implications of an attack What can happen as a result…  What other parts of the application infrastructure are exposed through the attack?

11. Repeat…  Some knowledge of the application may be gained that wasn’t found in the Recon, Mapping, or Discovery phases  Jump back into the workflow, utilizing the newly discovered information

12. Reporting  Documentation for Reporting is collected during all phases  Executive Summary Appears first, but written last Audience is management  Introduction Scope, objectives, personnel  Methodology Step-by-step, including tools used Sufficient detail to allow verification and repeat of test

13. Reporting (2)  Findings Categorized according to risk Include recommendations  Conclusions Short summary Like Executive Summary, but audience is technical  Appendix Permission memo, data discovered, tools outputs