Introducing Katana: Revolutionising Web Application Penetration Testing
Katana is a cutting-edge solution meticulously designed to streamline and enhance web application penetration testing. It marries the efficiency of automation with the precision of manual tasks, reducing the workload for testers. Throughout the penetration testing process, Katana seamlessly integrates various tools, including commercial, open source, and custom-developed applications, to deliver comprehensive reports that consolidate findings effectively.
Target Selection
Katana effortlessly identifies services and functionality on web servers when provided with URLs, whether with or without credentials.
Scanning and Discovery
Leveraging established tools, Katana pinpoints specific software plugins, versions, and features within the web infrastructure.
Vulnerability Scanning
Katana harnesses a wide range of public sources, such as CVE and vendor reports, along with the Vulners Database to compile a repository of software information. It then meticulously scans for potential vulnerabilities in the web server, in addition to assessing against the OWASP Top 10 security concerns.
- A01-2021 – Injection attacks
- A02-2021 – Cryptographic failures
- A03-2021 – Injection
- A04-2021 – Insecure Design
- A05-2021 – Security Misconfiguration
- A06-2021 – Vulnerable and outdated components
- A07-2021 – Identification and Authentication failure
- A08-2021 – Software and Data Integrity failures
- A09-2021 – Security Logging and Monitoring Failures
- A10-2021 – Server-Side Request Forgery
Exploitation
When vulnerabilities are identified, Katana conducts non-destructive Proof-of-Concept tests to demonstrate the potential for exploitation.
Post-Exploitation
Notably, Katana does not assess persistence or lateral movement within the environment, eliminating the need for post-exploitation cleanup.
Reporting and Analysis
Katana’s automated reports provide detailed insights, including descriptions, impact assessments, and remediation activities. Findings are supported by concrete evidence, making them easily comprehensible to technical audiences and stakeholders. The reports offer step-by-step guidance for remediation, facilitating collaboration with development teams.
Validation
Katana is engineered to maximize true positives while minimizing false positives. Vulnerability descriptions are continuously updated to enhance clarity and minimize reliance on technical jargon.
What’s Included
- Authenticated Penetration Test, designed for external scans as well as testing authenticated areas within a site or application.
- Monthly reports
- Term 12 months (Monthly subscription is billed monthly. Discounts apply for Annual payment.)
