Security testing is a process to determine that an information system protects data and maintains functionality as intended.
1
vote
0answers
40 views
Attack surface metrics analyzer tool
I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics
I found Microsoft surface ...
2
votes
1answer
78 views
Open source web security testing tools
Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd ...
2
votes
2answers
122 views
Open source security testing tool faster than Zed Attack Proxy?
I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow.
I am looking for an open source tool that will be faster and ...
3
votes
2answers
103 views
How do I test injection attacks similar to SQL injection for non sql solutions, or do I?
My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that ...
1
vote
4answers
96 views
How to convince BA that her software requirement may cause problems?
In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I ...
1
vote
1answer
90 views
Any testing resource for security testing of mobile web applications
i have gone through the following question security sources and found testing resources for testing desktop and web applications, any realtime resource to test an mobile web applications?
3
votes
2answers
96 views
Testing Paradigms for Network Security
In software engineering, I am familiar with some basic, often-overlapping types of testing, for example:
unit testing
functional / use-case testing
alpha / beta testing
branch / boundary testing
...
2
votes
2answers
265 views
What tools do you use to test for XSS injections?
What tools would you recommend to use for testing for XSS injections?
Apparently, what I need is a tool that can find all the places in the HTTP request where inputs are possible (including data ...
3
votes
2answers
237 views
Netsparker community edition: how to start with it?
I like to do SQL injection security testing. So I installed Netsparker (community edition 1.7). If any one have used this application to test SQL injection an web applications, then please tell me the ...
1
vote
2answers
116 views
What methods do you use to analyze / define attack surface for a software?
It is good to define an attack surface before security testing.
Different places to attack:
Open pages & services (like login)
Attack to underlying layers/servers/etc
Attack to other users
...
...
2
votes
2answers
181 views
Ways to test Web Service security by IP filtering?
As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if ...
5
votes
3answers
671 views
Is there a successful approach to automating security testing?
My team uses a security testing tool called Burp Suite. We currently try to manually run it once a release. One of my tasks is to determine if/how we can make that into more of an automated process. ...
8
votes
3answers
410 views
Abuse cases and misuse cases
Are abuse cases and misuse cases for security the same?
From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same.
Please clarify my doubt.
12
votes
4answers
1k views
How do I test an application for SQL injections?
I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on ...
9
votes
4answers
499 views
XSS/CSRF security testing
I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, ...
9
votes
2answers
1k views
What are some tools for fuzz testing?
Fuzz Testing as defined by Wikipedia is:
a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer ...
4
votes
5answers
1k views
How to plan security testing of a web application?
Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security.
So ...
14
votes
9answers
336 views
Security testing resources
Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...
