Real World Tactics, Techniques, and Procedures for Today's Application Testing

TrustedSec uses the OWASP Testing Guide for its assessment methodology, and has created and developed solid methodologies for testing any type of application. TrustedSec’s web application testing relies on the use of real-world tactics, techniques, and procedures.

Testing ensures complete coverage of the OWASP Top 10 web application risk categories:

• A01:2021-Broken Access Control
• A02:2021-Cryptographic Failures
• A03:2021-Injection
• A04:2021-Insecure Design
• A05:2021-Security Misconfiguration
• A06:2021-Vulnerable and Outdated Components
• A07:2021-Identification and Authentication Failures
• A08:2021-Software and Data Integrity Failures
• A09:2021-Security Logging and Monitoring Failures
• A10:2021-Server-Side Request Forgery

Black-Box Testing

Automated web application scanning produces validated results to reduce false positives.

White-Box Testing

Manual and automated source code analysis of application code base determines the source of issues that could result in exploitation.

Grey-Box Testing

Credentials are manually utilized to gain access to the inner workings of the application.

Hybrid (White/Grey) Testing

White-Box Testing results are fed into a Grey-Box Test to reduce time and provide an actionable, prioritized list of issues.

Web Services & API Testing

Accessing the API services is based on building attack scenarios upon the endpoints provided. This includes both credentialed and uncredentialed testing.

Training

Customizable manager application security awareness/secure software development lifecycle (SDLC) training and developer OWASP Top 10 training are offered.

Mobile Apps

We test iOS and Android and services to which they connect.

Why Organizations Trust Our Mobile Security Assessments

At TrustedSec, we pride ourselves on developing and utilizing our own custom tools and extensions. These will provide us with access and extraction abilities used by advanced attackers. TrustedSec will identify and attempt to bypass controls such as certificate pinning and root/jailbreak detection. Network communication will be monitored and tampered with to attempt to identify potential vulnerabilities with back-end services.