The leading software brand seeks 2-3 Pentest contractors. Candidates will come in and find security vulnerabilities in SQL 2016 server.
An Application Security Component Pentest will consist of vulnerability discovery at the application layer, will focus on identifying flaws documented in both the 2013 OWASP Top 10 and the CWE Top 25 most dangerous software errors. There is some overlap between the two, but both serve well as references for test case creation during the assignment. The OWASP Top 10 applies mostly to Web-applications and is listed here as:
2013 OWASP Top 10:
A1 Injection
A2 Broken Authentication and Session Management (XSS)
A3 Cross Site Scripting (XSS)
A4 Insecure Direct Object References
A5 Security Misconfiguration
A6 Sensitive Data Exposure
A7 Missing Function Level Access Control
A8 Cross Site Request Forgery (CSRF)
A9 Using Components with Known Vulnerabilities
A10 Unvalidated Redirects and Forwards
The CWE Top 25 applies to traditional client / server software as well as webapplications:
CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-120 Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)
CWE-306 Missing Authentication for Critical Function
CWE-285 Improper Access Control (Authorization)
CWE-798 Use of Hard-Coded Credentials
CWE-311 Missing Encryption of Sensitive Data
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-250 Execution with Unnecessary Privileges
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
CWE-798 Use of Hard-Coded Credentials
CWE-805 Buffer Access with Incorrect Length Value
CWE-98 Improper Control of Filename for Include / Require Statement in PHP Program (PHP File Inclusion)
CWE-494 Download of Code Without Integrity Check
CWE-863 Incorrect Authorization
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-676 Use of Potentially Dangerous Functions
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-131 Incorrect Calculation of Buffer Size
CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-601 URL Redirection to Untrusted Site (Open Redirect)
CWE-134 Uncontrolled Format String
CWE-190 Integer Overflow or Wraparound
CWE-759 Use of a One-Way hash without a Salt
First priority for evaluation will be on Telemetry, and JSON data. Further scenarios and data services to be defined by the group
