Bishop Fox Application Penetration Testing Methodology

This document is a technical report detailing the methodology for Bishop Fox's application penetration testing services. It outlines the structured approach taken for Baseline, Standard, and Advanced assessment packages, each designed to identify misconfigurations and vulnerabilities within applications. The report explains the pre-assessment requirements, including necessary application information and access, and describes the discovery and vulnerability scanning process, which involves both automated tools and manual testing techniques. It further details the analysis and reporting phase, where findings are documented with replication steps and remediation recommendations. The methodology emphasizes the importance of human-driven assessments to uncover complex vulnerabilities that automated tools may miss. Additionally, it provides insight into the on-demand remediation review process, allowing clients to request retesting of identified vulnerabilities. Overall, the document serves as a comprehensive guide to understanding the application penetration testing process employed by Bishop Fox.