VA and Penetration Test -- 3

Hi, we developed a new web portal and need to test it's security, so we need to: - Perform a VA (Vulnerability Assessment) and generate a report containing the list of vulnerabilities found and the raccomended actions to fix them; - Perform a Penetration Test and generate a report containing the list of issues found and the raccomended actions to fix them. This is the list of common tests that must be executed (at least theese, but you can perform more tests): Fingerprint web server software Analyze HTTP headers for security misconfiguration Check the security of HTTP cookies Check the SSL certificate of the server Check if the server software is affected by known vulnerabilities Analyze [login to view URL] for interesting URLs Check whether a client access file exists, and if it contains a wildcard entry ([login to view URL], [login to view URL]) Discover server configuration problems such as Directory Listing Check if HTTP TRACK/TRACE methods are enabled Crawl website Check for SQL Injection Check for Cross-Site Scripting Check for Local File Inclusion and Remote File Inclusion Check for OS Command Injection Check for ASP Cookieless Cross-Site Scripting Check for Server Side Request Forgery Check for Open Redirect Check for PHP Code Injection Check for JavaScript Code Injection Check for outdated JavaScript libraries Find administrative pages Check for sensitive files (archives, backups, certificates, key stores) based on hostname and some common words Attempt to find interesting files / functionality Check for information disclosure issues Weak Password Submission Method Clear Text Submission of Credentials Verify Domain Sources Check for commented code/debug messages Find Login Interfaces Sensitive Data Crawl Before we assign you the job you should provide us: - the name of the framework you'll use to perform the tests; - an example of the reports you'll generate and give us; - an example of one or more real reports generated for other tests previously performed for other customers. After you completed the job you must: - give us two fully deailed reports, as previously described, containing issues, causes and suggested remediations/fixes and help us fixing all found issues thank you