DISC InfoSec blogPenetration Testing Archives

Nov 27 2024

Penetration Testing and ISO 27001 – Securing ISMS

Category: ISO 27k,Pen Test — disc7 @ 9:06 am

The document highlights the integration of penetration testing within ISO 27001’s framework, emphasizing its critical role in identifying system vulnerabilities and maintaining security posture. It links pen testing to the standard’s risk management and continuous improvement principles, focusing on Annex A controls, such as Operations Security and Compliance.

It details the importance of scoping, balancing business needs with potential risks. The guide underscores embedding pen testing into broader risk assessment efforts to enhance resilience.

How does penetration testing fit into my ISO 27001 ISMS project?

There are three stages in your ISMS project when penetration testing can make a
significant contribution:

As part of the risk assessment process, to uncover vulnerabilities in any
Internet-facing IP addresses, web applications or internal devices and
applications, and link them to identifiable threats.
As part of the risk treatment plan, to ensure that security controls work
as designed.
As part of the ongoing performance evaluation and improvement
processes, to ensure that controls continue to work as required and that
new and emerging vulnerabilities are identified and dealt with.

ISO 27001 says that you must identify information security risks within the scope of
the ISMS (Clause 6.1.2.c). This involves identifying all assets and information systems
within scope of the ISMS, and then identifying the risks and vulnerabilities those
assets and systems are subject to.

A penetration test can help identify these risks and vulnerabilities. The results will
highlight detected issues and guide remedial action, and are a key input for your risk
assessment and treatment process. Once you understand the threats you face, you
can make an informed decision when selecting controls.

For further details, access the full document here.

Penetration Testing : Step-By-Step Guide

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO 27k Chat bot

Pragmatic ISO 27001 Risk Assessments

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

How to Address AI Security Risks With ISO 27001

How to Conduct an ISO 27001 Internal Audit

4 Benefits of ISO 27001 Certification

How to Check If a Company Is ISO 27001 Certified

How to Implement ISO 27001: A 9-Step Guide

ISO 27001 Standard, Risk Assessment and Gap Assessment

ISO 27001 standards and training

What is ISO 27002:2022

Previous posts on ISO 27k

Securing Cloud Services: A pragmatic guide

ISO 27001/2 latest titles

Tags: isms, iso 27001, Penetration Testing

Comments (2)

Mar 01 2023

5 open source Burp Suite penetration testing extensions you should check out

Category: Security Tools — DISC @ 11:25 am

5 open source Burp Suite penetration testing extensions you should check out

How does Burp Suite extensions help in Penetration Testing…

Burp Suite is a popular web application security testing tool that can be extended through the use of various plugins and extensions. These extensions provide additional functionality and capabilities that can assist in the penetration testing process. Here are some ways that Burp Suite extensions can help in penetration testing:

Automated vulnerability scanning: Burp Suite extensions can automate the process of scanning for vulnerabilities in web applications. These extensions can identify common vulnerabilities such as SQL injection, cross-site scripting (XSS), and file inclusion vulnerabilities.
Customized payloads: Some Burp Suite extensions allow for the creation of customized payloads that can be used in testing for specific vulnerabilities. These payloads can help identify vulnerabilities that may be missed by standard scanning tools.
Integration with other tools: Burp Suite extensions can integrate with other tools used in the penetration testing process, such as vulnerability scanners and exploit frameworks. This integration can streamline the testing process and make it more efficient.
Brute-force attacks: Burp Suite extensions can automate brute-force attacks against web applications. This can help identify weak passwords or authentication mechanisms that could be exploited by an attacker.
Fuzz testing: Burp Suite extensions can perform fuzz testing to identify vulnerabilities caused by unexpected or invalid input. This can help identify vulnerabilities such as buffer overflows or other memory-related issues.

In summary, Burp Suite extensions can greatly enhance the functionality and capabilities of the tool for penetration testing. These extensions can automate tasks, provide customized payloads, integrate with other tools, and help identify vulnerabilities that may be missed by standard scanning tools.

When it comes to assessing the security of computer systems, penetration testing tools are critical for identifying vulnerabilities that attackers may exploit. Among these tools, Burp Suite stands out as one of the most popular and widely used options among security professionals and enthusiasts alike.

Here’s a collection of Burp Suite extensions to make it even better.

Auth Analyzer

The Auth Analyzer extension helps you find authorization bugs. Navigate through the web application as a privileged user and let the Auth Analyzer repeat your requests for any defined non-privileged user. With the possibility to define parameters, the extension is able to extract and replace parameter values automatically.

Autowasp

Autowasp is a Burp Suite extension that integrates Burp issues logging with the OWASP Web Security Testing Guide (WSTG) to provide a web security testing flow. This tool will guide new penetration testers to understand the best practices of web application security and automate OWASP WSTG checks.

Burp_bug_finder

Burp_bug_finder is a Burp Suite plugin (written in Python) that makes the discovery of web vulnerabilities accessible. This version focuses only on XSS, and error-based SQLi. There’s no need to send XSS payload either for reflected or stored payload manually. You need to browse the pages where you want to check XSS vulnerability or error-based SQL injection.

Nuclei

Nuclei is a simple extension that allows you to run Nuclei scanner directly from Burp Suite and transforms JSON results into the issues.

Pentest Mapper

Pentest Mapper is a Burp Suite extension that integrates the Burp Suite request logging with a custom application testing checklist. The extension provides a straightforward flow for application penetration testing. The extension includes functionalities allowing users to map the application flow for pentesting to analyze the application and its vulnerabilities better. The API calls from each flow can be connected with the function or flow name. The extension allows users to map or connect each flow or API to vulnerability with the custom checklist.

Our Previous posts on Security Tools

Burp Suite Cookbook: Practical recipes to help you master web penetration testing with Burp Suite

We’d love to hear from you! If you have any questions, comments, or feedback, please don’t hesitate to contact us. Our team is here to help and we’re always looking for ways to improve our services. You can reach us by email (info@deurainfosec.com), or through our website’s contact form.

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: burp suite, Penetration Testing

Comments (0)

Jan 09 2023

Top 10 Best Penetration Testing Companies & Services – 2023

Category: Pen Test — DISC @ 12:08 pm

Top 10 Best Penetration Testing Companies & Services – 2023

enetration Testing Companies are pillars when it comes to information security, nothing is more important than ensuring your systems and data are safe from unauthorized access, Many organizations have a flawed security culture, with employees motivated to protect their own information rather than the organization.

This sets up an opportunity for attackers seeking ways into a company to exploit it and get access to critical data and secrets.

In this article, we will see the 10 best penetration testing companies and understand what penetration testing is. We will also discuss its importance, different types of tests, and how they are conducted.

What Is Penetration Testing?

The term “penetration testing” refers to the process of checking an application’s or network’s security by exploiting any known vulnerabilities.

These security flaws might be found in a variety of places, such as system configuration settings, authentication methods, and even end-user risky behaviors.

Apart from assessing security, pentesting is also used to assess the effectiveness of defensive systems and security tactics.

The cyber security condition is shifting at a breakneck speed. New vulnerabilities are discovered and exploited all of the time, some of them are publicly recognized, and others are not.

Being aware is the greatest defence you can have. A penetration test uncovers security flaws in your system that might lead to data theft and denial of service.

Top 10 Best Penetration Testing Companies – 2023

Best Penetration Testing Companies: Key Features and Services

Top Pentesting Companies	Key Features	Services
Astra Security	Automated Vulnerability Scans, Continuous Scanning, CI/CD Integration, Zero false positives, Pentest Report, Customer Support, and Theories on How to Report to Regulators.	Penetration Testing, Vulnerability Assessment, Security Audits, IT Risk Assessments, Security Consulting Website Protection, Compliance Reporting.
Detectify	Simple and intuitive interface, Prioritized remediation advice can your web applications and APIs in the cloud	Penetration Testing, Scanning for Vulnerabilities
Intruder	Provides results from automated analysis and prioritization, Examination of configurations for flaws missing patches application weaknesses	Management of Vulnerabilities, Penetration Testing, Perimeter server scanning, Cloud Security, Network Security
Invicti	Built-in reporting tools automatically find SQL Injection, Scan 1,000 web applications in just 24 hours	Penetration Testing, Website SecurityScanning, Web VulnerabilityScanning
Rapid7	Easy-to-use interface-click phishing campaigns	Penetration Testing, Vulnerability Management
Acunetix	Access Controls/Permissions, Activity Dashboard, Activity Monitoring	Immediate actionable results best web security services seamless integration with customer’s current system
Cobalt	Proof-Based Scanning, Full HTML5 Support, Web Services Scanning, Built-in Tools, SDLC Integration	Integration with JIRA and Github, OWASP Top 10, PCI, HIPAA, and other compliance report templates customer Reports API for building personalized security reports test vulnerabilities functionality
SecureWorks	more than 4,400 customers in 61 countries across the world perform more or less 250 billion cyber events	Pen Testing Services, Application Security Testing, Advance Threat/Malware detection, and preventing Retention and Compliance Reporting
Sciencesoft	Certified ethical hackers on the team33 years of overall experience in ITIBM Business Partner in Security Operations & Response, Recognized with 8 Gold Microsoft Competencies	Vulnerability Assessment, Penetration Testing, Compliance Testing, Security Code Review, Infrastructure Security Audit
Cyberhunter	Best for Penetration Testing, Network Threat Assessments, Security Audits, Cyber Threat Hunting, Network reconnaissance, vulnerability mapping, exploitation attempts, cyber threat analysis	Penetration Testing, Network Threat Assessments, Network Security Audits, Cyber Threat Hunting, Network Log Monitoring