Security Testing Handbook for Banking Applications

CHAPTER 2: BASIC TESTS AND TECHNIQUES

Let’s quickly summarise the steps involved in conducting a penetration test:

• Understand the application.

• Prepare the threat profile.

• Prepare the test plan.

• Execute the test cases.

• Prepare the report.

In the previous chapter, we discussed the first three steps. We saw how a systematic approach is followed to arrive at an exhaustive threat profile. We also discussed how a test plan is built – for each threat all possible attacks are listed. During the discussion, we came across a number of attack techniques like SQL injection, cross-site scripting, cross-site request forgery and variable manipulation. It’s time to take a closer look at some of the popular attacks and common vulnerabilities ...