Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools or classes( preferably) for security testing?

share|improve this question
Welcome to SQA, userjain. You might start by searching this site for other questions about security testing. – user246 Jun 19 '13 at 20:03

I would start here:

Lots of good reading, tools, videos, etc.

share|improve this answer

There are already a bunch of really good SO/SQA related pages; including tools.

share|improve this answer

BurpSuite and Fiddler are two important tools for my security testing tasks. Definitely check them out.

As for the approach I have found it is good to find out if your organization is required to allow 3rd party audits and security scans. Make sure your security tests cover these cases first. Then move to the most sensitive areas. Usually anything to do with authentication, sessions, user authorization levels and money transactions are a good place to start. It may be controversial to say this but as far as security goes I feel that the low hanging fruit / obvious exploits are a good place to start. Most attackers will try those first as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.