Case Studies

Scope

• Development framework: ASP.NET and Oracle
• Web Server : Microsoft IIS version 10
• Conduct penetration tests and provide suitable countermeasure
• Penetration tests should cover Black Box and White Box testing
• Testing to be carried out in staging environment
• Web Server : Microsoft IIS version 10

Standards

• OWASP and SANS

Vulnerabilities

• Database connection string disclosed
• Brute-force on login field
• Missing X-Frame-Options Header
• Missing Session Management
• Reports folder is accessible through directory traversal

Scope

• Complete security assessment of modules involve
• Black Box and White Box testing
• Web application developed in Django and python,
• Mobile application developed for Android OS
• BT Hardware module custom designed / fabricated chips
• Provide security consulting in terms of encryption services

Standards

• OWASP and SANS
• Electronic Signal encryption etc.
• BT module tested using standards for IoT based devices

Vulnerabilities

Mobile Application Vulnerabilities

• Sensitive data exposure
• Debug enabled
• App Signed by Android Debug Certificate

Bluetooth Hardware module

• Excessive services running

Cloud hosted Web Application

• Sensitive data exposure
• Eicher & Django Dashboard Login
• Session Hijacking

Scope

• Digital forensics of company issued desktop
• Focus on theft of Intellectual property through use of removable media, network copy, printing OR data deletion
• Remote access of company system to unauthorised users
• Any additional evidences to prove data theft

Standards

• Hard disk image acquisition
• Hard disk image analysis
• Preservation of chain-of-custody

Vulnerabilities