What Is The Testing Methodology For Edgescan?

Edgescan has varying levels of rigour dependent on the type of testing that takes place, all levels align to best practices and industry standards.

Version Number: v1.0.0

Published Date: 26 March 2025

____________________________________________________________________________

Manual Penetration Testing – Methodology & Approach

An Edgescan advanced licence provides for a level of testing that is equivalent to a manual penetration test. This licence includes the same testing that is applied to foundation licences but also the additional expected rigour of a full manual penetration test.

Approach – Application Layer Testing

Edgescan has developed an application testing methodology based on OWASP best practice which has proven effective in identifying areas within web applications that are most vulnerable to attack.

The methodology initiates each assessment from different threat perspectives to determine the extent that sensitive information or unauthorised access can be gained.

Our testing approach combines automated and manual techniques to perform the security testing of both the application and supporting application server (underlying hosting infrastructure). While scanning tools provide a solid foundation for vulnerability detection, they have several weaknesses which we address via manual testing and inspection, which is core to our service. Our testing approach progresses through three distinct phases. Our penetration testing methodology is aligned with CREST (https://www.crest-approved.org/) and we are a CREST accredited penetration testing provider.

Phase 1: Application Recon

The first step in the Edgescan methodology is to ‘spider’ or ‘crawl’ the application to map out the relevant functions.

This step helps identify the applications attack surface.

Phase 2: Fault injection and scanning

Edgescan employs a variety of tools for web application and API scanning, based on leading industry practice. A combination of proprietary, best of breed commercial and open-source tools are employed. Existing and new tools are constantly being tested by our ‘scanner’ security team to ensure that adequate coverage of systems is ensured during testing, in addition to accuracy and identification of vulnerabilities present in target systems.

Phase 3: Manual penetration testing

The results obtained in previous phases, combined with Edgescan’s web and API application security testing experience, are used in the manual assessment of application vulnerabilities. Testing is delivered using a qualified penetration testing consultant and this phase attempts to identify vulnerabilities that could be exploited to:

• bypass authentication or authorization controls
• identify an individual by circumventing privacy controls
• bypass validations or manipulate application business logic
• obtain unauthorised access to the application, the database and the underlying operating system

Testing included, but was not limited to using the following techniques:

• Business Logic weakness manipulation: Attempts to “fool” the application or break workflow logic in order to examine the potential to bypass business or logical controls.
• Authentication: Verifying the robustness of authentication mechanisms using techniques such as ‘brute forcing’ (attacks that involve trying large number of possible values until the correct value is discovered, this is at customer request only. Our default test is to ascertain if there are protective controls in place) and ‘sniffing’ (capturing and analysing network traffic).
• Parameter manipulation: The ability to alter parameters passed to the server in the HTTP POST and GET requests in order to bypass authorisation controls or other validation controls.
• Vertical and horizontal privilege escalation: The ability to hijack the rights of a fellow user, and the ability to escalate these privileges to gain unauthorised access to administrative areas.
• Injection Attacks: The ability to construct and submit payloads that will be run on the backend systems and gain unauthorised access to data or unsanctioned privileges on an underlying database or operating system.
• Directory traversal: The ability to navigate to server directories that the user should not be authorised to access.
• Web server permissions: The ability to make unsanctioned uploads or changes to application content or access the directory structure in an unauthorised manner.
• Cookie Poisoning and Spoofing: Cookies are typically used to pass session variables, including the authentication of a user. By manipulating unencrypted cookies, it may be possible to modify them to gain escalated user privileges.
• Session Management: Analyse session cookies to determine whether they can be predicted and used to gain unauthorised access to applications.
• Cross-site scripting: The ability to inject malicious script characters into the website content that may be used for ‘phishing’ attacks or general defacement.
• Direct Object access Forceful Browsing: Attempting to gain unauthorised access to parts of the online retail application by directly accessing URLs.
• Overflow: An overflow is the process of diverting the function of a particular program by placing a malicious piece of code in memory that is executed on the server. Attempt to identify parameters in the application that cannot handle large input streams that may create an overflow condition.

Approach – Network Layer Testing

Edgescan’s experience and knowledge of the latest exploits, common system weaknesses and hacking techniques are used to attempt to exploit potential exposures and uncover any areas of security weakness in target hosts. The testing is divided into two distinct phases:

Phase 1: IP Scan

Edgescan has developed a sophisticated and effective programme to test the security surrounding Internet-connected systems. This includes controlled penetration tests that are used to attempt to gain access to Internet-connected systems and ultimately pivot to adjacent or internal networks from the Internet, if applicable. The following aspects of the methodology were used:

• Server identification – allowing the identification of platforms, operating systems, and applications.
• Service scan – a method to determine which service ports are present and listening for transactions. Traffic from application programs and operating system instructions are transmitted over these ports
• Information retrieval – attempting to identify active ports and extract information from the target system, including banners or other key information.
• Vulnerability scan – use of commercial and proprietary tools against computer addresses, vulnerabilities, and protocols.

As stated earlier, automated scanning techniques have their limitations - Edgescan carefully evaluated the results of each tool and where possible, manually verified the existence of difficult to detect vulnerabilities to ensure accurate reporting.

Phase 2: Manual Vulnerability Validation

Where applicable, we validate all vulnerabilities in the target hosts. Both proprietary Edgescan and well-known, widely available techniques are used to attempt to circumvent selected systems’ security. Edgescan’s specific approach included the following:

• Configuration/Known weakness attacks – both inherently insecure services as well as necessary but poorly configured services are targeted during testing: attempts are made to exploit vulnerabilities in services such as NetBIOS, ftp, HTTP etc. Attempts to exploit password composition vulnerabilities may also be made through use of intelligent brute force utilities, if applicable.
• Known vulnerabilities – non-destructive validation techniques were employed, should a known vulnerability be detected in any of the underlying system stack, with the goal to escalate privileges within the system.

Testing Taxonomy

Edgescan offers continuous Dynamic Application Security Testing (DAST) integrated with deep-dive, business logic penetration testing through our Edgescan advanced license. This combination of production-safe, automated and manual testing on one platform, allow enterprises to tackle the ever-increasing demand for accurate and useful Application Security Testing (AST) intelligence. The vulnerability and test case taxonomy of our DAST and Penetration Testing services are outlined below.

In addition to the Edgescan Standard (DAST) testing (above), penetration testing attempts to discover issues which scanners generally do not detect. The discovery of such issues is unique to Penetration Testing or using an Edgescan Advanced license, as the issues are contextual and require human intelligence to discover and exploit.

The additional manual testing that is performed during an Edgescan advanced test is outlined below.

*O - OWASP Top 10 2017 or API 2019

*S25 - SANS Top 25 Programming Errors