Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Needs to know the kind of Security Pen-test in Prod Environment -Web AppSec

Cybernewbie | Last updated: Jun 13, 2018 06:24PM UTC

Can someone tell me about the various security testing in Web Application involved without creating any junk data in DB or collapsing Duplicating data with original data present and testing will be done in Production Environment ? Please let me know testing involved like HTTP Head injection, Cookie Manipulation & LDAP injection etc...

PortSwigger Agent | Last updated: Jun 14, 2018 07:08AM UTC

Hi Cybernewbie, It's difficult to avoid creating junk while testing. If you can't test a development environment, try creating test users that do not interact with other users. When manually testing you can check if each attack has created junk and manually reverse it. It's not really possible for an automated scanner to do the same. You can find some information on testing for various vulnerabilities here: - https://support.portswigger.net/customer/portal/topics/792273-burp-testing-methodologies/articles

Burp User | Last updated: Jun 19, 2018 12:57PM UTC

Hi paul , My question here how we can test an web application in non-intrusive techniques doing the security testing in Production environment ? What are options to be limited the testing without creating an duplication of data in the application?

PortSwigger Agent | Last updated: Jun 19, 2018 01:58PM UTC

Hi Cybernewbie, Is the app you're testing multi-user or multi-tenant? You may be able to restrict testing to only affect particular users and tenants that are used for test purposes. Otherwise, you can't do meaningful testing in a non-intrusive way. The best you can do is to manually introduce payloads, and manually revert any side-effects caused by those payloads. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.