Auditing Web Services

What is auditing?

Auditing a web application is an essential practice that has to be done to identify the improper use of its functions and vulnerabilities and to ensure that data models and the application logic are correct and working as intended.

Web penetration, in a way, is simply auditing web applications, but the scope is generally limited to the security aspect. Nevertheless, both pentesters and auditors (commonly known as software quality assurance engineers) should be able to perform different audit services on web applications based on the specification requirements and both company and legal policies.

The auditing process

Web auditing looks for potential problems or opportunities for improvement and offers suggestions for them. The steps involved in the web auditing process are summarized as follows:

1. Identify the goals and objectives of the audit. This will help determine the focus and scope of the audit, as well as the specific tools and techniques that need to be used.

2. Conduct a thorough website analysis, including its design, content, code, and performance. This may involve using various web auditing tools, such as ...