Re: OWASP Top 10 penetration testing software?
Zaki Akhmad <[email protected]>
| Newsgroups | gmane.comp.security.penetration |
|---|---|
| Message-ID | <CAE7Ck-SZPDmH12xs+pccNOKovO0BEUzGh8c8UKkt8jTpnGGZDw@mail.gmail.com> |
On Wed, Feb 29, 2012 at 3:44 AM, psiinon <[email protected]> wrote: > Hi, > > You should be careful with scanners that claim to test "the OWASP Top Ten". > For example, "Insecure Cryptographic Storage" is one of the OWASP Top > Ten but this is typically only detectable server side, so no web app > scanner will find it :) So Simon, a penetration testing won't cover all? The simplest test case for this insecure cryptographic storage is by requesting a forgot password. If the web application sends your password in clear text, then you found the issue. -- Zaki Akhmad OWASP Indonesia ------------------------------------------------------------------------ This list is sponsored by: Information Assurance Certification Review Board Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. http://www.iacertification.org ------------------------------------------------------------------------