Security testing is a process to determine that an information system protects data and maintains functionality as intended.

learn more… | top users | synonyms

3
votes
2answers
78 views

Does adding the port number to a URL redirect pose a Security risk?

I am testing a new version of a web site and when requesting the site URL it redirects to a URL with the port number 80 appended to it, for example requesting www.example.com redirects to ...
0
votes
1answer
59 views

Training for Penetration Testing

I have been looking into expanding my skill set into penetration testing for a bit and with all of the recent security breaches, I figured it would be best to start my training and learning quickly. ...
0
votes
3answers
117 views

Best Opensource Tool available for Security Testing of Web applications

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I want use an open source tool. There are many type of vulnerabilities like Cross Site ...
2
votes
5answers
149 views

How to convince BA that her software requirement may cause problems?

In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I ...
11
votes
3answers
3k views

What are some tools for fuzz testing?

Fuzz Testing as defined by Wikipedia is: a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer ...
3
votes
2answers
82 views

What's the name of the technique for getting data from a web application you aren't supposed to get?

This question is about getting the name of a testing concept. For example, say you have a REST route which requires that you be logged in. When you call that route and provide the ID of another user ...
5
votes
3answers
2k views

What tools do you use to test for XSS injections?

What tools would you recommend to use for testing for XSS injections? Apparently, what I need is a tool that can find all the places in the HTTP request where inputs are possible (including data ...
13
votes
5answers
3k views

How do I test an application for SQL injections?

I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on ...
1
vote
3answers
249 views

How to add a script tag to the end of a URL which can be covered as a part of XSS Testing

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either ...
2
votes
4answers
146 views

Security testing of web application

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools or classes( preferably) for security testing?
15
votes
8answers
467 views

Security testing resources

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...
0
votes
0answers
76 views

Fuzzing Python Modules

Is it possible to use a fuzzer, specifically the Peach fuzzing framework to fuzz a module or header file of code. For example, if I wanted to fuzz the os module in python 2.7.6, would I be able to, ...
2
votes
0answers
299 views

How to use soapUI for Boundary Scan security tests?

I've tried to use soapUI to set up a Boundary Scan security test, using the sample wsdl provided in the soapUI tutorial. I changed it so that it has a restriction on the username field for the ...
4
votes
2answers
284 views

Tool to minimize tests number and maximize code coverage

I am currently undergoing black-box testing campaigns for applications that require file input in linux environments. For that I need sets of test files of different formats that can be used to be ...
1
vote
4answers
142 views

Mobile app security testing

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider ...
0
votes
0answers
43 views

xss scripts through console of web-developers-tools

So, well i am learning selenium webdriver, junit4. I need to know, is it a proper way to add "xss scripts" through console of web developers tools ? Can anyone help me with example ?
1
vote
1answer
563 views

Selenium RC: Xpath of the link is changed when i refresh the page

Selenium RC: Xpath of the link is changed when I refresh the page, and when I run the code it shows "Exception in thread "main" com.thoughtworks.selenium.SeleniumException: ERROR: Element ...
10
votes
4answers
714 views

XSS/CSRF security testing

I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, ...
1
vote
0answers
71 views

Attack surface metrics analyzer tool

I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics I found Microsoft surface ...
4
votes
5answers
2k views

How to plan security testing of a web application?

Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security. So ...
4
votes
1answer
313 views

Open source web security testing tools

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd ...
2
votes
2answers
421 views

Open source security testing tool faster than Zed Attack Proxy?

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow. I am looking for an open source tool that will be faster and ...
3
votes
2answers
413 views

How do I test injection attacks similar to SQL injection for non sql solutions, or do I?

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that ...
3
votes
2answers
374 views

Netsparker community edition: how to start with it?

I like to do SQL injection security testing. So I installed Netsparker (community edition 1.7). If any one have used this application to test SQL injection an web applications, then please tell me the ...
1
vote
1answer
118 views

Any testing resource for security testing of mobile web applications

i have gone through the following question security sources and found testing resources for testing desktop and web applications, any realtime resource to test an mobile web applications?
3
votes
2answers
120 views

Testing Paradigms for Network Security

In software engineering, I am familiar with some basic, often-overlapping types of testing, for example: unit testing functional / use-case testing alpha / beta testing branch / boundary testing ...
1
vote
2answers
146 views

What methods do you use to analyze / define attack surface for a software?

It is good to define an attack surface before security testing. Different places to attack: Open pages & services (like login) Attack to underlying layers/servers/etc Attack to other users ... ...
8
votes
3answers
878 views

Abuse cases and misuse cases

Are abuse cases and misuse cases for security the same? From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same. Please clarify my doubt.
5
votes
3answers
1k views

Is there a successful approach to automating security testing?

My team uses a security testing tool called Burp Suite. We currently try to manually run it once a release. One of my tasks is to determine if/how we can make that into more of an automated process. ...
2
votes
2answers
309 views

Ways to test Web Service security by IP filtering?

As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if ...