Penetration Test Report (UnderDefense): Anonymised Web and Infrastructure Penetration Testing Report 2019

Web and Infrastructure
Penetration Testing Report
for
[CLIENT]
Executive summary
This report presents the results of the “Grey Box” penetration testing for [CLIENT] Infrastructure
and Web Application. The recommendations provided in this report structured to facilitate
remediation of the identified security risks. This document serves as a formal letter of
attestation for the recent [CLIENT] Infrastructure and Web Application Penetration Testing.
Evaluation ratings compare information gathered during the course of the engagement to “best
in class” criteria for security standards. We believe that the statements made in this document
provide an accurate assessment of [CLIENT] current security as it relates to infrastructure and
network perimeter..
We highly recommend to review section of Summary of business risks and High-Level
Recommendations for better understanding of risks and discovered security issues.
Scope Security Grade
level
Web application and infrastructure perimeter D Poor
UnderDefense Grading Criteria:
Grade Security Criteria Description
A Excellent The security exceeds “Industry Best Practice” standards. The overall
posture was found to be excellent with only a few low-risk findings
identified.
B Good The security meets with accepted standards for “Industry Best
Practice.” The overall posture was found to be strong with only a
handful of medium- and low- risk shortcomings identified.
C Fair Current solutions protect some areas of the enterprise from security
issues. Moderate changes are required to elevate the discussed areas
to “Industry Best Practice” standards
D Poor Significant security deficiencies exist. Immediate attention should be
given to the discussed issues to address exposures identified. Major
changes are required to elevate to “Industry Best Practice” standards.
Confidential 1
Grey Box Web and Infrastructure Penetration Testing Report for [CLIENT] Revised 11.03.2019
F Inadequate Serious security deficiencies exist. Shortcomings were identified
throughout most or even all of the security controls examined.
Improving security will require a major allocation of resources.
Assumptions & Constraints
As the environment changes, and new vulnerabilities and risks are discovered and made
public, an organization’s overall security posture will change. Such changes may affect the
validity of this letter. Therefore, the conclusion reached from our analysis only represents a
“snapshot” in time.
Objectives & Scope
Organization
[CLIENT ORGANISATION]
Audit type Grey Box Infrastructure and Web Application Penetration Testing
Asset URL APPENDIX A - Scope
Audit period Feb. 19 - Mar. 11
Consultants performed discovery process to gather information about the target and searched
for information disclosure vulnerabilities. With this data in hand, we conducted the bulk of the
testing manually, which consisted of input validation tests, impersonation (authentication and
authorization) tests, and session state management tests. The purpose of this penetration
testing is to illuminate security risks by leveraging weaknesses within the environment that lead
to the obtainment of unauthorized access and/or the retrieval of sensitive information. The
shortcomings identified during the assessment were used to formulate recommendations and
mitigation strategies for improving the overall security posture.
Results Overview
The test uncovered several vulnerabilities that may cause users credentials stealing, session
hijacking, sensitive data leakage, broken confidentiality, integrity and availability of the
resource. Security testing activities showed that there are a lot of misconfigurations on cloud
infrastructure.
Identified vulnerabilities are easily exploitable and the risk posed by these vulnerabilities can
cause significant damage to the company.
Confidential 2
Grey Box Web and Infrastructure Penetration Testing Report for [CLIENT] Revised 11.03.2019
Security experts performed manual security testing, which demonstrate the following results.
Severity Critical High Medium Low Informational
​
# of issues 0 1 2 13 1
Severity scoring:
● Critical - Immediate threat to key business processes.
​ ​
● High – Direct threat to key business processes.
​
● Medium – Indirect threat to key business processes or partial threat to business
processes.
● Low – No direct threat exists. Vulnerability may be exploited using other vulnerabilities.
​
● Informational – This finding does not indicate vulnerability, but states a comment that
notifies about design flaws and improper implementation that might cause a problem in
the long run.
Confidential 3
Grey Box Web and Infrastructure Penetration Testing Report for [CLIENT] Revised 11.03.2019
Summary of business risks
High severity issues make direct threat to the business as they can be used to:
● Using XSS attack it is possible to steal user session or credentials and get full access to
users account. It will lead to client data leakage as this vulnerability is present on
application which is used by company clients. Successful exploitation of this
vulnerability will cause big reputational and financial damage for the company.
Medium and low severity issues can lead to:
● Attacks on communication channels and as a result on sensitive data leakage and
possible modification, in other words it affects the integrity and confidentiality of data
transferred.
● Information leakage about system components which may be used by attackers for
further malicious actions.
● Attacks on old and not patched system components with bunch of publicly known
vulnerabilities.
● Enumerating existing users emails/usernames and brute forcing their passwords. Easy
access to their session after exploitation of high level risks, as session token is not
invalidated after logout.
● Combination of few issues can be used for successful realisation of attacks.
Informational severity issues do not carry direct threat but they can be used to gather useful
information for an attacker.
High-Level Recommendations
Taking into consideration all issues that have been discovered, we highly recommend to:
● Conduct current vs. future IT/Security program review;
● Establish Secure SDLC best practices, assign Security Engineer to a project to monthly
review code, conduct SAST & DAST security testing;
● Review Architecture of application;
● Deploy Web Application Firewall solution to detect any malicious manipulations;
● Continuously monitor logs for anomalies to detect abnormal behaviour and fraud
transactions. Dedicate security operations engineer to this task;
● Implement Patch Management procedures for whole IT infrastructure and endpoints of
employees and developers;
● Continuously Patch production and development environments and systems on regular
bases with latest releases and security updates;
● Conduct annual Penetration test and quarterly Vulnerability Scanning against internal
and external environment;
● Conduct security coding training for Developers;
● Develop and Conduct Security Awareness training for employees and developers;
● Develop Incident Response Plan in case of Data breach or security incidents;
● Analyse risks for key assets and resources;
Confidential 4
Grey Box Web and Infrastructure Penetration Testing Report for [CLIENT] Revised 11.03.2019
● Update codebase to conduct verification and sanitization of user input
on both client and server side;
● Use only encrypted channels for communications;
● Improve server and application configuration to meet security best practises;
● Also we recommend to conduct remediation testing of both infrastructure and web
applications.
Performed tests
● All set of applicable OWASP Top 10 Security Threats
● All set of applicable SANS 25 Security Threats
Criteria Label Status
Meets criteria
A1:2017-Injection
Fails criteria
A2:2017-Broken Authentication
Meets criteria
A3:2017-Sensitive Data Exposure
Meets criteria
A4:2017-XML External Entities (XXE)
Meets criteria
A5:2017-Broken Access Control
Fails criteria
A6:201