Blog — Security Research and Practical Guidance | NovaPentest

Practical guides to the vulnerability classes NovaPentest checks for. Each guide explains what the weakness is, how attackers exploit it, how to detect it and how to fix it, and it is grounded in how our own scanner actually detects it. Every guide names the module that performs the check, so you can see exactly what is tested and verify it yourself with a scan.

Vulnerability guides

• Subdomain takeover: how it happens, how to detect it, how to fix it — A dangling DNS record pointing to a deprovisioned service lets an attacker claim the resource and serve content from your subdomain.
• JWT vulnerabilities: how they work, how to detect them, how to fix them — Weak JSON Web Token handling - alg:none, no expiry, or a manipulable kid header - lets attackers forge or replay tokens and impersonate users.
• CORS misconfiguration: how it works, how to detect it, how to fix it — Overly permissive CORS - a reflected Origin with credentials, a wildcard, or an allowed null origin - lets malicious sites read authenticated responses.
• Host header injection: how it works, how to detect it, how to fix it — The app trusts a client-supplied Host or X-Forwarded-Host value when building links, enabling reset poisoning and cache attacks.
• Content Security Policy (CSP): how it works, how to test it, how to fix it — A CSP header limits what scripts a page may run. Weak directives such as 'unsafe-inline' or wildcards leave cross-site scripting uncontained.
• Exposed sensitive files (.env, .git, backups): how it works, how to test it, how to fix it — Files like .env, .git/config or backup.sql left in the web root can hand out credentials and source code to anyone who requests the right URL.
• HTTP security headers: what they do, how to check them, how to set them — HSTS, nosniff, Referrer-Policy and CSP: what each header prevents, what the scanner checks, and how to set them correctly.
• Cookie security: the Secure, HttpOnly and SameSite flags explained and configured — Session cookies without Secure, HttpOnly or SameSite can be stolen or misused. How to check each flag and set it correctly.
• TLS certificates and HTTPS redirects: keep certificates valid and users on HTTPS — Expired certificates and missing HTTPS redirects expose users and train them to ignore warnings. How to check and fix both.
• Directory listing: why it exposes your files and how to turn it off — Auto-generated folder listings reveal backups, logs and uploads. How to find them on your site and switch them off.

Comparisons

• NovaPentest vs Intruder — Intruder covers a broad estate: infrastructure, cloud and apps. NovaPentest tests a few web apps and APIs in depth. Pick by the question you need answered.
• NovaPentest vs Detectify — Detectify discovers and monitors a large external surface. NovaPentest attacks a few registered web apps in depth, on a small monthly plan.
• NovaPentest vs a penetration testing consultancy — Human testers win on business logic, chained attacks and formal attestation. NovaPentest covers the weeks between engagements, on every release.