Application Security Pre-Engagement

This chapter will introduce you to the application security pre-engagement process. There are a lot of considerations to think about before starting your penetration test activities. Be ready to work closely with a local lawyer to help you achieve this phase successfully and to avoid legal action against you in the future if you're a free lance consultant. If you're an employee and belong to the security team of your company, then you don't need a lawyer, in fact, you just need the approval of your manager.

Yes, this chapter is dedicated to freelance contractors, but that doesn't mean that you don't have to read it if you're an employee. In fact, as an employee, you will always deal with contractors and you must understand the nature of their business.

Here's the plan before you start your penetration testing...

Introduction

People think that web application penetration testing is a simple task, but it's not, it involves a lot of duties before starting the tests. The main activities for web application penetration testing would be:

• Source Code Review or Static Code Analysis: This activity involves the analysis of the source code to identify bad security practices.
• Web Intrusion Test or Dynamic Code Analysis: This activity checks if the client's website is vulnerable to attacks like Cross-Site Scripting, SQL Injection, and so on.
• Infrastructure Test: This will involve the web server and the database server vulnerabilities assessment and exploitation if it's feasible.
• Information Gathering: In this activity, you will collect information about your client using the internet's resources. This test will reveal any data leakage to the public.

This chapter will help you...

The first meeting

Before the first meeting, you will need to prepare yourself to avoid unprofessional consequences. Make sure to respect the following checklist to help you achieve your goals successfully before the meeting:

• Make sure you memorize the full name of the person that you will meet
• Plan your trip in advance to make sure you don't show up late for the meeting, and double check the date and time
• Dress professionally even if you prefer the geek's look
• Prepare your materials (for example, laptop) and any flyer that you're willing to share with the client
• Prepare your speech so you sound professional when you talk about the subject
• Plan the subjects that you want to talk about and write them down with respect to the meeting's time interval
• Visit the customer's website to understand his business and to have an idea about his security awareness
• Use...

Non-Disclosure Agreement

At this stage, you need to consult an attorney in your local area before you proceed further, as the next step is the kick-off meeting, where confidential information will be exchanged between you and your client. To protect your company and your client, you need to sign an NDA contract to protect all the exchanged information that your client will trust giving to you.

To find a sample of an NDA check your country/region laws; for example, here in Canada we have a good site LawDepot.ca that has a large choice of law contract samples depending on your province.

Kick-off meeting

Assuming that you already signed the NDA agreement that I talked about in the previous section, then you can proceed with the kick-off meeting. This event is very important for your penetration testing phase, as it will allow you to understand the complete infrastructure as well as the functionalities that the client's website supports. You should have asked your client, before this meeting, to prepare a demo with the stakeholders. It is a good idea to bring all the penetration testing team to this meeting so they will better understand the client's needs. A good comprehension of the client's architecture is the key to your success. This meeting could be longer depending on your client's infrastructure and the web site's complexity. Here are some important ideas to take into consideration for the success of this meeting:

1. The client should...

Time and cost estimation

Time estimation is crucial; this will prove to your client how efficient and professional you are in the services that you're trying to offer. You don't want to waste the money and time of your client as well. You need to take multiple factors into consideration if you want to estimate your project time efficiently.

• The experience of the consultant is important because a senior consultant could take 5 hours to finish a penetration when a junior consultant could take 10 hours for the same test.
• Always add a 15-20% risk after you estimate a project.
• The kick-off meeting is the most important aspect of your time estimation. This meeting will reveal most of the obstacles that you may encounter during the tests.

Assume that you have finished your kick-off meeting and the client has given you the following architecture diagram:

Also, during the...

Statement of work

This document is a formal agreement for you as a penetration tester to start your work. The purpose of this document is to define:

• The expectations from the client
• The scope of work
• The schedule of the work
• The pricing
• The deliverables at the end of all the penetration tests
• The payment terms
• The legal agreements
• Finally, the signatures

Of course, you can add your custom contents if you feel that this information is not enough. Tweak it to your liking and experience. In the following, you will see a sample of a statement of the work contract.

Statement of work – Web Application Penetration Test:

For [Client Company Name]
[Date]

Contents:

1. Description
2. Expectations
3. Scope
4. Schedule
5. Pricing estimation
6. Deliverables
7. Payment Terms
8. Agreement
9. Signatures

Description:

[Your Company Name] will undertake all the necessary tasks to help the customer meet business requirements...

Penetration Test Agreement

This contract will list all the necessary information to allow you and the consultants that work for you to conduct and execute the penetration testing activities. The following shows a sample contract with these titles:

• The contract brief description
• Your main contacts and the main client contacts
• How confidential information is going to be exchanged
• Different penetration testing activities with details
• Limits of responsibility in case of something bad happening
• Finally, the signature of the contract

Web Application Penetration Test Agreement:

For [Client Company Name]
[Date]

Contents:

1. Description
2. Contacts
3. Exchange of confidential information
4. Web Application Intrusion Test
5. Code review
6. Infrastructure security test
7. Information Gathering
8. Limits of responsibility
9. Signatures

Description:

This document describes the application penetration testing activities...

External factors

There is always a possibility that your client's application will interact with third-party services and a remote infrastructure. As I mentioned previously, you need a lawyer by your side to advise you about your tests. You need to ask your client the following important questions regarding the third parties that he deals with.

Does your client application interact with the third-party web service? If the answer is yes, then you need to ask your client's permission to investigate the third-party activities. If your client agrees, then you need to ask them to organize a meeting with the third-party's representative. During the interview with the third party, ask the following questions:

• Does the third party collect information about your client? If yes, what is that information?
• What is the authentication mode used for the web services? You want...

Summary

I hope that you enjoyed this chapter, I know that it did not contain some exciting hacking commands, but you should know about the Pre-Engagement phase if you're going to be working in this field.

Let's summarize what you have learned in this chapter:

1. About your first meeting with your client
2. What a Non-Disclosure Agreement is
3. How to kick off a meeting
4. How to estimate the time and cost of your project
5. What a statement of work is?
6. What a Penetration Test Agreement looks like
7. External factors of a penetration test project

In the next chapter, you will learn about Application Threat Modeling, which is, for me, one of the pillars of a successful application security mandate.