Security testing is a process to determine that an information system protects data and maintains functionality as intended.

learn more… | top users | synonyms

0
votes
3answers
91 views

Best Opensource Tool available for Security Testing of Web applications

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I want use an open source tool. There are many type of vulnerabilities like Cross Site ...
3
votes
2answers
81 views

What's the name of the technique for getting data from a web application you aren't supposed to get?

This question is about getting the name of a testing concept. For example, say you have a REST route which requires that you be logged in. When you call that route and provide the ID of another user ...
0
votes
0answers
63 views

Fuzzing Python Modules

Is it possible to use a fuzzer, specifically the Peach fuzzing framework to fuzz a module or header file of code. For example, if I wanted to fuzz the os module in python 2.7.6, would I be able to, ...
2
votes
0answers
221 views

How to use soapUI for Boundary Scan security tests?

I've tried to use soapUI to set up a Boundary Scan security test, using the sample wsdl provided in the soapUI tutorial. I changed it so that it has a restriction on the username field for the ...
1
vote
4answers
133 views

Mobile app security testing

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider ...
0
votes
0answers
39 views

xss scripts through console of web-developers-tools

So, well i am learning selenium webdriver, junit4. I need to know, is it a proper way to add "xss scripts" through console of web developers tools ? Can anyone help me with example ?
4
votes
2answers
252 views

Tool to minimize tests number and maximize code coverage

I am currently undergoing black-box testing campaigns for applications that require file input in linux environments. For that I need sets of test files of different formats that can be used to be ...
1
vote
1answer
470 views

Selenium RC: Xpath of the link is changed when i refresh the page

Selenium RC: Xpath of the link is changed when I refresh the page, and when I run the code it shows "Exception in thread "main" com.thoughtworks.selenium.SeleniumException: ERROR: Element ...
1
vote
3answers
186 views

How to add a script tag to the end of a URL which can be covered as a part of XSS Testing

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either ...
2
votes
4answers
137 views

Security testing of web application

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools or classes( preferably) for security testing?
1
vote
0answers
70 views

Attack surface metrics analyzer tool

I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics I found Microsoft surface ...
4
votes
1answer
286 views

Open source web security testing tools

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd ...
2
votes
2answers
396 views

Open source security testing tool faster than Zed Attack Proxy?

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow. I am looking for an open source tool that will be faster and ...
3
votes
2answers
341 views

How do I test injection attacks similar to SQL injection for non sql solutions, or do I?

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that ...
1
vote
4answers
113 views

How to convince BA that her software requirement may cause problems?

In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I ...
1
vote
1answer
116 views

Any testing resource for security testing of mobile web applications

i have gone through the following question security sources and found testing resources for testing desktop and web applications, any realtime resource to test an mobile web applications?
3
votes
2answers
120 views

Testing Paradigms for Network Security

In software engineering, I am familiar with some basic, often-overlapping types of testing, for example: unit testing functional / use-case testing alpha / beta testing branch / boundary testing ...
5
votes
3answers
2k views

What tools do you use to test for XSS injections?

What tools would you recommend to use for testing for XSS injections? Apparently, what I need is a tool that can find all the places in the HTTP request where inputs are possible (including data ...
3
votes
2answers
362 views

Netsparker community edition: how to start with it?

I like to do SQL injection security testing. So I installed Netsparker (community edition 1.7). If any one have used this application to test SQL injection an web applications, then please tell me the ...
1
vote
2answers
142 views

What methods do you use to analyze / define attack surface for a software?

It is good to define an attack surface before security testing. Different places to attack: Open pages & services (like login) Attack to underlying layers/servers/etc Attack to other users ... ...
2
votes
2answers
281 views

Ways to test Web Service security by IP filtering?

As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if ...
5
votes
3answers
1k views

Is there a successful approach to automating security testing?

My team uses a security testing tool called Burp Suite. We currently try to manually run it once a release. One of my tasks is to determine if/how we can make that into more of an automated process. ...
8
votes
3answers
740 views

Abuse cases and misuse cases

Are abuse cases and misuse cases for security the same? From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same. Please clarify my doubt.
13
votes
5answers
3k views

How do I test an application for SQL injections?

I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on ...
10
votes
4answers
681 views

XSS/CSRF security testing

I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, ...
10
votes
3answers
2k views

What are some tools for fuzz testing?

Fuzz Testing as defined by Wikipedia is: a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer ...
4
votes
5answers
2k views

How to plan security testing of a web application?

Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security. So ...
15
votes
8answers
457 views

Security testing resources

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...