WebApplication Vulnerability Scanning
Website vulnerability scans are crucial for identifying and patching weaknesses, meeting compliance, protecting reputation, and staying ahead of evolving threats, all cost-effectively.
What’s Included
Detection of Misconfigurations
Checks for misconfigurations:
- Default files or users
- HTTP Header Deficiencies
- Directory Listing
- HTTP Methods Accepted
Discover Known Vulnerabilities
Discovery of known vulnerabilities in web application frameworks and libraries.
Patching Analysis
Detection of outdated or vulnerable software versions.
Sensitive Data Exposure
Checks for pages and files that are exposed that contain any sensitive information.
Error Message Handling
Identification of potentially sensitive information disclosed through error messages or responses.
Continuous Monitoring
Establish continuous scanning processes to regularly assess your businesses exposure to cybersecurity exploits and data breaches.
Session Management Reviews
Checking for Session Issues:
-
Session fixation: The scan would test for vulnerabilities related to session fixation, ensuring that session identifiers are securely generated and invalidated upon login or logout to prevent attackers from fixing a session ID and hijacking an authenticated session.
-
Session timeout: The scan would check if there’s a proper session timeout mechanism in place to automatically log users out after a period of inactivity. This prevents unauthorized access to sensitive data in case a user forgets to log out or leaves their session unattended.
Authentication Mechanism
- Password Policies
- Multi-Factor Authentication (MFA)
- Account Lockout Mechanisms
- Username Enumeration
- Authentication Bypass Vulnerabilities
Encryption and Cryptography
- TLS/SSL – Checking for supported protocols and cipher suites
- Cryptographic Algorithms
- Certificate Validity
Injection Vulnerabilities
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Command Injection
- And More
Detailed Report
We provide a report which details all the findings from Nessus, as well as our in-house tools.
Detailed remediation recommendations with findings prioritised into the order of what should be addressed first.
Steps To Success
1. Choose Your Plan
If you want to test just your External Attack Surface (Network hosts or Websites) – Choose Basic!
Need internal scanning too? – Choose our Advanced or Enterprise Options
2. Sign The ROE
After a successful payment, you will be asked to complete a Rules of Engagment (ROE) form. Dont worry, there aren’t that many questions to answer. This form allows you to tell us what we are allowed to target.
3. We Start Scanning
Any external scanning options will begin as soon as we confirm receipt of the signed ROE.
OSINT is also performed at this stage. You’re close to the results already!
4. Results
As soon as the scans have finished, we will be working on the reports and aiming to have them with you as soon as possible.
Here, you’ll get a full Nessus Vulnerability Scan report, as well as a detailed report which removes all of the fluff and shows you which issues should be remediated as a priority.
5. Fix The Issues
With our detailed reports, you should have no troubles fixing any identified issues. Whilst you take care of improving your security posture, we will already be configuring your next scan, and tweaking it should it be necessary.
6. Repeat
Unless your external targets have changed, we will repeat the vulnerability scanning process again. You’re now much further ahead than most!
Got a clean report? Time to check out our other service offerings, but remember to keep having your external targets scanned as new vulnerabilities come into existence each day!