Real-world tactics, techniques, and procedures for today's application testing

TrustedSec uses the OWASP Testing Guide for its assessment methodology, and has created and developed solid methodologies for testing any type of application. Our web application testing relies on the use of real-world tactics, techniques, and procedures.

Testing ensures complete coverage of the OWASP Top 10 web application risk categories:

• A01:2021-Broken Access Control
• A02:2021-Cryptographic Failures
• A03:2021-Injection
• A04:2021-Insecure Design
• A05:2021-Security Misconfiguration
• A06:2021-Vulnerable and Outdated Components
• A07:2021-Identification and Authentication Failures
• A08:2021-Software and Data Integrity Failures
• A09:2021-Security Logging and Monitoring Failures
• A10:2021-Server-Side Request Forgery

Unauthenticated Testing (Black-Box) - Automated web application scanning produces validated results to reduce false positives.

Authenticated Testing (Grey-Box) - Credentials are manually utilized to gain access to the inner workings of the application.

Source-Assisted Authenticated Testing (Hybrid Grey-Box) - Source Code Review results are fed into a Grey-Box Test to reduce time and provide an actionable, prioritized list of issues.

Source Code Review (White-Box) - Manual and automated source code analysis of application code base determines the source of issues that could result in exploitation.

Web Services & API Testing - Accessing the API services is based on building attack scenarios upon the endpoints provided. This includes both credentialed and uncredentialed testing.

Training - Customizable manager application security awareness/secure software development lifecycle (SDLC) training and developer OWASP Top 10 training are offered.

Mobile Apps - We test iOS and Android and services to which they connect.

Why Organizations Trust Our Mobile Security Assessments

At TrustedSec, we pride ourselves on developing and utilizing our own custom tools and extensions. These will provide us with access and extraction abilities used by advanced attackers. TrustedSec will identify and attempt to bypass controls such as certificate pinning and root/jailbreak detection. Network communication will be monitored and tampered with to attempt to identify potential vulnerabilities with back-end services.