Website Security Checks

Our vulnerability assessments are conducted by looking at the public facing parts of your website, along with your website's code and looking for vulnerabilities based on the technology your website is using, the way your code is written and common exploits for any software you are running.

Performing a web penetration test is a lot more in depth. We will work with you to define the scope (what websites and areas to test), then we will conduct a vulnerability assessment on those areas. From there, we will actively try to exploit any vulnerabilities we find to 'hack into' your site and either access areas or perform actions we shouldn't be able to.

Un-authenticated penetration tests (also known as black box testing) simulates an attack by an individual who has no valid user credentials and demonstrates what damage can be done from your public facing pages. This type of testing is useful to identify any vulnerabilities on pages such as your registration or login page, which is accessible to anyone on the web.

Authenticated penetration tests (also known as white box testing) simulates an attack by an individual who has already breached your external defenses or who has obtained user credentials, either by phishing or brute force 'guessing'. This type of testing is useful to identify what damage can be done from the inside; often more catastrophic as functionality could be less protected if successful authentication is assumed. We also test the possibilities of privilege escalation, where an attacker logs in as a low level user and is able to 'upgrade' their account status to a higher level admin to perform more functions.

All our security tests start with looking for the Open Web Application Security Project (OWASP) Top 10 vulnerabilities.

These are considered best practice and includes vulnerabilities such as broken authentication, security misconfigurations, code injections, cross site scripting (XSS) and cryptographic failures.

Further vulnerabilities and exploits are then discovered by our security developers based on their experience and discovery of the system as they perform the tests.

The Open Web Application Security Project, or OWASP, is an international non-profit organisation dedicated to making web application security better through education and collaboration.

Part of its core values is to be open and global, making all their materials available to everyone so anyone can improve their website's security.

The OWASP Top 10 reports on the 10 most critical security risks. It is a regularly updated report put together by a team of security experts, designed to raise awareness.

It is best practice in the security industry for these risks to be mitigated and protected against as a minimum on your website.

When you are ready to book one of our services, we will book a scoping call with you where we will go through some basic information about your company, your website and what you're looking to achieve.

We need to know things like how big your website is, what functionality it has, whether there's a user or admin area, does it have a database and how much third party software does it use?

Don't worry if you are not sure of anything - often we can find the information out by you showing us round the site on a screen share or letting us have a look at the code.

We have an NDA document available for us both to sign before the scoping call, to make sure your business is protected.