JCON 2021

"Penetration Test" - an attack simulation. But how is pentesting defined? Are there "paid hackers"? How does efficient application testing works? How do I mitigate risks? The talk spotlights well known methods and "hack" within these methods, to speed up testing and be way more efficient. The following questions will be answered: - Should I test against Dev/Stage/Prod? - What's the best time for testing? - What's an efficient approach for testing roles and rights? - Why is OWASP Top 10 a great document, but not usable for Penetration Testing? - Why are CATCHAs a potential problem for testers? - Should I test with or without the Web Application Firewall? - What do you mean by "horizontal and vertical privilege escalation"? The talk covers test experience of 20 years and hundreds of web applications.