On Wed, Feb 29, 2012 at 3:44 AM, psiinon <psiinon (at) gmail (dot) com [email concealed]> wrote:

> Hi,
>
> You should be careful with scanners that claim to test "the OWASP Top Ten".
> For example, "Insecure Cryptographic Storage" is one of the OWASP Top
> Ten but this is typically only detectable server side, so no web app
> scanner will find it :)

So Simon, a penetration testing won't cover all?

The simplest test case for this insecure cryptographic storage is by
requesting a forgot password. If the web application sends your
password in clear text, then you found the issue.

--
Zaki Akhmad
OWASP Indonesia

------------------------------------------------------------------------

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[ reply ]