Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, except for some light SQL Injection, which is easy to test for either way. The problem I'm having is that they want me to come up with actual cases for XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery). While Google provides some examples for programmers, they do nothing to teach testers on how exactly to test for these vulnerabilities. Is there a place, a tutorial, something that provides actual examples of how people can attempt these types of exploits and how to discover them in your web application?

share|improve this question
add comment

4 Answers

up vote 5 down vote accepted

If you're willing to spend a little bit of cash, I'd recommend both How to Break Web Software and the Web Security Testing Cookbook. I also recommend playing around with things like Damn Vulnerable Web Application and WebGoat. Should give you a decent start.

share|improve this answer
    
Thanks for all those, they're great help! –  Ragnar Jun 1 '11 at 7:37
add comment

Use Ironwasp tool fro CSRF attack if the application have CSRF attack we can easily identify by CSRF POC generator tool

share|improve this answer
add comment

http://www.hackthissite.org/ is a useful resource

share|improve this answer
add comment

Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns.

You can look at those examples then try to relate them to where they would apply to your application.

share|improve this answer
    
Thanks for the site, it's really helpful! –  Ragnar Jun 1 '11 at 7:37
    
beat me to it - love that site. –  DuncN Jun 3 '11 at 10:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.