1.1 Purpose

The purpose of this document is to provide a technical proposal with an estimate for the vulnerability assessment and penetration testing of web applications deployed by Moolya.

1.2 Scope

The scope of this document is limited only to the technical proposal of the below cyber security works.

Penetration Testing GREY BOX

The scope of work includes grey box penetration testing of an isolated instance of the specified application or service. Fixed vulnerabilities will be verified if the fix is made available within the warranty period. Warranty period for this testing will be 1 month after releasing the final report. Effort and cost estimation of grey box penetration testing is provided.

1.3 Abbreviations & Definitions

1.HTTP- Hypertext transfer protocol

2.API- Application programming interface

1.4 References

1.5 Overview

This proposal covers different test approaches required for satisfying the entire assessment scope. These approaches are:

1. Security Architecture Study

2. Classify Security Testing

3. Threat modelling

4. Test Planning

5. Test execution

6. Report Generation

7. Retest for the fixed bugs

2.1 Security architecture study

For making an application hack proof, the security requirements need to be addressed at the very first stage of every software design. The architecture should have the capability to prevent external attacks and so architecture should be designed in such a way. In this phase, application will be analyzed for possible threats at the architecture level. The security goals and security compliance objectives will be studied during the phase along with understanding and analyzing the requirement of the application under test. Some of the security perspective checkpoints are listed below

1. Economy of mechanism

2. Fail-safe defaults

3. Complete mediation

4. Open Design

5. Separation of privileges

6. Least privileges

7. Least common privileges

8. Psychological Acceptability

2.2 Classify security testing

All the system setup information used for developing the system/software such as network, operating system, technology, hardware etc. will be collected, studied and analyzed.

2.3 Threat Modelling

After collecting, studying and analyzing the data based on the above steps, a threat profile will be created.

2.4 Test planning

Based on the identified threats, vulnerabilities and security risks, a test plan will be created to address all those issues.

2.5 Test case execution

Performs the vulnerability assessment penetration testing based on the plan and gathered information.

2.6 Reports

A detailed report of the results will be prepared with proper mitigation plans. There will be two types of report

1. Technical Report: It contains all the vulnerabilities identified with how to fix description in it so that a developer can fix the issues using the report.

2. Management Report: It contains bug summary with graphical representations.

2.7 Re-testing

Once the bugs are reported and fixed by developers, then retesting is required to verify whether those bugs still exist. The status will be updated in the reports.

3.1 Project Specification

#Item - Description

1. URL - _______________

2. Tech Stack -Java, ReactJS, JavaScript, Erlang, MySQL

4.1 Effort Web application

Item Effort (Man Hours)

1 Information Gathering 1.1 Determine highly problematic areas of the application

1.2 Construct business logic and data flow

1.2.1 Integrity of the workflow

1.2.2 Users can’t bypass or skip steps

1.2.3 Users can’t perform privileged activities without authorization

2 Checking for Login page 2.1 Session management

2.2 Brute forcing

2.3 Privilege escalation

2.4 Password complexity

3 Perform automated and manual crawling 4 Conduct tests and discover vulnerabilities 4.1 Test for business logic

4.2 Check for version-specific attacks

4.3Form validation Testing

4.4 Security Vulnerability Testing

4.5 HTTP Method(s) Testing

4.6 User Session Testing

4.7 Directory Browsing

4.8 Authentication Testing

4.9 Configuration Management Testing

4.10 Data Validation Testing (All Injections)

4.11 Client-side testing

5 Backend Services Testing 5.1 Broken Object Level Authorization

5.2 Broken User Authentication

5.3 Excessive Data Exposure

5.4 Broken Function Level Authorization

5.5 Injection

6 Report Total (Hours) —

4.2 Effort Mobile application

Item Effort (Man Hours)

1 Information Gathering 1.1 Determine highly problematic areas of the application

1.2 Construct business logic and data flow

1.2.1 Integrity of the workflow

1.2.2 Users can’t bypass or skip steps

2 Assessment/Analysis 2.1 Local File Analysis

2.2 Static Analysis

2.3 Dynamic Analysis

3 Inter-Process Communication 3.1 Endpoint Analysis

3.2 Content Providers Intents

3.3 Broadcast Receivers

3.4 Activities

3.5 Services

4 Exploitation 4.1 Test for business logic

4.2 Check for version-specific attacks

4.3 Security Vulnerability Testing

4.4 User Session Testing

4.5 Authentication Testing

4.6 Configuration Management Testing

5 Backend Services Testing 5.1 Broken Object Level Authorization

5.2 Broken User Authentication

5.3 Excessive Data Exposure

5.4 Broken Function Level Authorization

5.5 Injection

6 Report Total (Hours)

Total (Hours) —-

4.3 Effort Server

Item Effort (Man Hours)

1 Information Gathering

2 Vulnerability Scanning

3 Exploitation

4 Gaining access & privilege evaluation

5 Manual pen-testing

6 Automated tool based pen-testing

7 Privilege Escalations

8 Post exploitation reconnaissance

9 Pivoting threats

10 Compromise Remote users

11 Auditing

12 Report Total (Hours) —