Web App Security Standards except OWASP & SANS

[dinesh kumar]

Hi Guys,

I have gone through the constraints of security standards like OWASP and SANS.

My question is apart from these standards, is there any other advance testing terminologies that more specific to the e-commerce applications. Kindly let me know.

Thanks and Regards
Dinesh kumar M

[Naresh Annangar]

For e-commerce applications, especially if you are handling credit cards, you should look at PCI-DSS.

--

n.

--
_______________________________________________________________________________
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
---
You received this message because you are subscribed to the Google Groups "null" group.
To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Akash]

PCI DSS recommends OWASP for application security.

@Dinesh

OWASP and SANS are not testing terminologies. They are organisations.

You might want to reword the question and clarify what is that was missing here.

I am assuming that you referred to OWASP Top 10 and SANS/CWE Top 25.

--
Warm regards,
Akash Mahajan

That Web Application Security Guy | +91 99 805 271 82
akashm.com | @makash on twitter | linkd.in/webappsecguy
OWASP Bangalore Chapter Lead | null Community Manager

[dinesh kumar]

Hi

I'm sorry Akash, I too mean the same, I have used the OWASP Top 10 and SANS/CWE Top 25 methods, but the my question is apart from these any other specific methods as like as OWASP Top 10 or SANS/CWE TOp 25 to the payment gateway integrated web application.

Please help.

Thanks

[c0nsoul]

Hi,

    If you want to Audit payment gateway then you can check this one for reference.

                 https://www.youtube.com/watch?v=gNkrUngGVsU

Regards

[Akash]

This document is what you should read first.

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf

From this you can dervice which framework you would like to use for classifying vulnerabilities found.

In terms of approach you need to figure out what is suitable for your use case.

There are multiple pen testing frameworks you can use.

You can start with https://www.owasp.org/index.php/Web_Application_Penetration_Testing

This link in itself is not complete and only offers a broad over view. Refer to the OWASP Testing Guide version 3 and version 4 for more details.