Remember this is not functional testing. In Pentest, your goal is to find security holes in the system.
Given below are some generic test cases and are not necessarily applicable to all applications.
- Check if the web application is able to identify spam attacks on contact forms used on the website.
- Proxy server – Check if network traffic is monitored by proxy appliances. The proxy server makes it difficult for hackers to get internal details of the network, thereby protecting the system from external attacks.
- Spam email filters – Verify if incoming and outgoing email traffic is filtered and unsolicited emails are blocked. Many email clients come with inbuilt spam filters that need to be configured as per your needs. These configuration rules can be applied to email headers, subject or body. Firewall – Make sure that the entire network or computer is protected by firewalls. A Firewall can be software or hardware that blocks unauthorized access to a system. Firewalls can prevent sending data outside the network without your permission.
- Try to exploit all servers, desktop systems, printers, and network devices.
- Verify that all usernames and passwords are encrypted and transferred over secure connections like https.
- Verify information stored in website cookies. It should not be in a readable format.
- Verify previously found vulnerabilities to see if the fix is working.
- Verify if there is no open port on the network.
- Verify all telephone devices.
- Verify WiFi network security.
- Verify all HTTP methods. PUT and Delete methods should not be enabled on a web server.
- Verify if the password meets the required standards. The password should be at least 8 characters long containing at least one number and one special character.
- Username should not be “admin” or “administrator”.
- The application login page should be locked upon a few unsuccessful login attempts.
- Error messages should be generic and should not mention specific error details like “Invalid username” or “Invalid password”.
- Verify if special characters, HTML tags, and scripts are handled properly as an input value.
- Internal system details should not be revealed in any of the error or alert messages.
- Custom error messages should be displayed to end-users in case of a web page crash.
- Verify the use of registry entries. Sensitive information should not be kept in the registry.
- All files must be scanned before uploading them to the server.
- Sensitive data should not be passed on to URLs while communicating with different internal modules of the web application.
- There should not be any hardcoded username or password in the system.
- Verify all input fields with long input strings with and without spaces.
- Verify if the reset password functionality is secure.
- Verify application for SQL Injection.
- Verify the application for Cross-Site Scripting.
- Important input validation should be done on the server-side instead of JavaScript checks on the client-side.
- Critical resources in the system should be available to authorized persons and services only.
- All access logs should be maintained with proper access permissions.
- Verify user session ends upon log off.
- Verify that directory browsing is disabled on the server.
- Verify that all applications and database versions are up to date.
- Verify URL manipulation to check if a web application is not showing any unwanted information.
- Verify memory leak and buffer overflow.
- Verify if incoming network traffic is scanned to find Trojan attacks.
- Verify if the system is safe from Brute Force Attacks – a trial and error method to find sensitive information like passwords.
- Verify if the system or network is secured from DoS (denial-of-service) attacks. Hackers can target a network or a single computer with continuous requests due to which resources on the target system get overloaded resulting in the denial of service for legit requests.
- Verify the application for HTML script injection attacks.
- Verify against COM & ActiveX attacks.
- Verify against spoofing attacks. Spoofing can be of multiple types – IP address spoofing, Email ID spoofing, ARP spoofing, Referrer spoofing, Caller ID spoofing, Poisoning of file-sharing networks, GPS spoofing.
- Check for an uncontrolled format string attack – a security attack that can cause the application to crash or execute the harmful script on it.
- Verify the XML injection attack – used to alter the intended logic of the application.
- Verify against canonicalization attacks.
- Verify if the error page is displaying any information that can be helpful for a hacker to enter into the system.
- Verify if any critical data like the password is stored in secret files on the system.
- Verify if the application is returning more data than is required.
- These are just the basic test scenarios to get started with Pentest. There are hundreds of advanced penetration methods which can be done either manually or with the help of automation tools.
MIT License & cc license
This work is licensed under a Creative Commons Attribution 4.0 International License.
To the extent possible under law, Paul Veillard has waived all copyright and related or neighboring rights to this work.