Practical Web Penetration Testing

Assets

Assets are the different parts of the application that a hacker would be interested in getting (also known as Threat target). Most of the time, the attacker is interested in the data, but here are more examples that you can use while developing this section:

• Read user data (for example, passwords, credit cards, personal information)
• Execute unauthorized functionalities (for example, add a new user and delete an account)
• Access to unauthorized systems (for example, access to the database, access to the web server file system through a terminal window)
• Different systems availability (for example, DOS against a web server)