Pentration testing of our web site #2

We would like an experienced person to perform penetration testing of our web site. this is the scope of work This is very urgent. Scope of Work. The Freelancer will perform an Application Penetration Testing to identify vulnerabilities in applications residing on Customer’s networked systems that offer user or inter-process interfaces, such as web applications and “thick” clients. The Application Penetration Testing will examine Customer’s application’s components and technologies to identify vulnerabilities in systems, server systems, static content, and server-side programs that implement the application logic. The Freelancer will identify common and more unique application flaws. The Freelancer will test for common application flaws, such as stack overflows and format string issues. In addition, The Freelancer will examine the application’s underlying design for unique vulnerabilities that may not be easily recognizable during a more superficial investigation. The Freelancer will perform a variety of checks, based on industry-specific guidance, industry practices and standards. As determined necessary by The Freelancer, application components will be tested for improper configuration, session tracking weaknesses, encryption implementation and strength, input validation, flaws in server-side executables, and sensitive or unnecessary information within HTML content. The Freelancer will perform application security testing of the Customer’s applications through automated web application scanning as well as manual application functionality testing. The Freelancer’s testing techniques will consist of: · Input validation bypass – The Freelancer will remove client side validation routines and bounds-checking restrictions to confirm controls are implemented on application parameters sent to the server. · SQL injection – The Freelancer will submit specially crafted SQL commands in input fields to validate input controls are in place for the protection of database data. · Cross-site scripting – The Freelancer will submit active content to the application in an attempt to cause a user's web browser to execute unauthorized and unfiltered code. This test is meant to validate user input controls. · Parameter tampering - The Freelancer will modify query strings and parameters, and hidden fields in an attempt to gain unauthorized access to user data or application functionality. · Cookie poisoning – The Freelancer will modify data sent in cookies in order to test application response to receiving unexpected cookie values. · User privilege escalation – The Freelancer will attempt to gain unauthorized access to administrator or other users’ privileges. · Credential manipulation – The Freelancer will modify identification and authorization credentials in an attempt to gain unauthorized access to other users’ data and application functionality. · Forceful browsing – The Freelancer will enumerate files located on a web server in an attempt to access files and user data not explicitly shown to the user within the application interface. · Backdoors and debug options –The Freelancer will identify code left by developers for debugging purposes that could potentially allow an intruder to gain additional levels of access. · Configuration subversion –The Freelancer will assess Customer’s web servers and application servers for improper configurations that could create attack vectors. · Test Environments – Some Applications (as defined below) to be tested will be in a Customer test or development environment.