The protected bank client for secure access to bank accounts. The main feature of the client is the use of security keys for every financial transaction with a client account that provides the highest level of protection against invasion.
The aim of this security testing is verification of high-level protection of software banking system package from comprehensive attack vectors, including both a server and a client part.
Additional challange was client connection testing, the characteristics of the browser behavior in the unusual situations, as well as testing of the add-on plugin Silverlight.
Platforms and Tools
- Software Infrastructure: Acunetix Web Vulnerability Scanner, Arpspoof, Metasploit Framework, Nessus, Outpost Firewall Pro, SSLstrip
Team
1 automated test engineer
Duration
70 man-hours
Benefits
During testing there were found bugs with the possibility of information capturing, as well as incorrect status of login errors that indicates whether the user is in the database.
After fixing all vulnerabilities our specialist performed re-testing of the found bugs, after which it was concluded that the web-application has a high degree of safety.