Mapping the Attack Surface

Sızma testi için haritasını çıkardığınız web uygulamasının hangi bölümünde hangi konuyu irdelemelisinizi şöyle bir tablo ile ifade edebiliriz:

Mapping the Attack Surface
SUBJECT	POSSIBLE FLAW
Client-side validation	Checks may not be replicated on the server.
Database interaction	SQL Injection
File uploading and downloading	Path traversal vulnerabilities.
Display of user-supplied data	Cross-site scripting.
Dynamic redirects	Redirection and header injection attacks.
Login	Username enumeration, weak passwords, ability to use brute force.
Multistage login	Logic flaws.
Session state	Predictable tokens, insecure handling of tokens.
Access controls	Horizontal and vertical privilege escalation.
User impersonation functions	Privilege escalation.
Use of cleartext communications	Session hijacking, capture of credentials and other sensitive data.
Off-site links	Leakage of query string parameters in the “Referer” header.
Interfaces to external systems	Shortcuts in handling of sessions and/or access controls.
Error messages	Information leakage.
Email interaction	Email and/or command injection.
Native code components or interaction	Buffer overflows.
Use of third-party application components	Known vulnerabilities.
Identifiable web server software	Common configuration weaknesses, known software bugs.