Security testing is a process to determine that an information system protects data and maintains functionality as intended.

learn more… | top users | synonyms

18
votes
8answers
539 views

Security testing resources

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...
15
votes
5answers
5k views

How do I test an application for SQL injections?

I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on ...
13
votes
3answers
5k views

What are some tools for fuzz testing?

Fuzz Testing as defined by Wikipedia is: a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer ...
12
votes
4answers
866 views

XSS/CSRF security testing

I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, ...
9
votes
3answers
2k views

Abuse cases and misuse cases

Are abuse cases and misuse cases for security the same? From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same. Please clarify my doubt.
7
votes
3answers
6k views

What tools do you use to test for XSS injections?

What tools would you recommend to use for testing for XSS injections? Apparently, what I need is a tool that can find all the places in the HTTP request where inputs are possible (including data ...
7
votes
3answers
2k views

Is there a successful approach to automating security testing?

My team uses a security testing tool called Burp Suite. We currently try to manually run it once a release. One of my tasks is to determine if/how we can make that into more of an automated process. ...
7
votes
4answers
5k views

Automation and bypassing Google No CAPTCHA reCAPTCHA

My client want to use Google's No CAPTCHA reCAPTCHA (NCRC) to prevent robots completing an application. QA have automated this process, but if the business introduce NCRC into the form, then this ...
6
votes
5answers
3k views

How to plan security testing of a web application?

Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security. So ...
6
votes
1answer
485 views

Open source web security testing tools

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd ...
6
votes
2answers
376 views

Tool to minimize tests number and maximize code coverage

I am currently undergoing black-box testing campaigns for applications that require file input in linux environments. For that I need sets of test files of different formats that can be used to be ...
4
votes
2answers
592 views

Open source security testing tool faster than Zed Attack Proxy?

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow. I am looking for an open source tool that will be faster and ...
4
votes
2answers
133 views

Testing Paradigms for Network Security

In software engineering, I am familiar with some basic, often-overlapping types of testing, for example: unit testing functional / use-case testing alpha / beta testing branch / boundary testing ...
4
votes
2answers
466 views

Netsparker community edition: how to start with it?

I like to do SQL injection security testing. So I installed Netsparker (community edition 1.7). If any one have used this application to test SQL injection an web applications, then please tell me the ...
4
votes
2answers
145 views

Does adding the port number to a URL redirect pose a Security risk?

I am testing a new version of a web site and when requesting the site URL it redirects to a URL with the port number 80 appended to it, for example requesting www.example.com redirects to ...
4
votes
4answers
191 views

Security testing of web application

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools or classes( preferably) for security testing?
4
votes
2answers
86 views

What's the name of the technique for getting data from a web application you aren't supposed to get?

This question is about getting the name of a testing concept. For example, say you have a REST route which requires that you be logged in. When you call that route and provide the ID of another user ...
4
votes
0answers
734 views

How to use soapUI for Boundary Scan security tests?

I've tried to use soapUI to set up a Boundary Scan security test, using the sample wsdl provided in the soapUI tutorial. I changed it so that it has a restriction on the username field for the ...
3
votes
2answers
1k views

How do I test injection attacks similar to SQL injection for non sql solutions, or do I?

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that ...
3
votes
2answers
54 views

Ideas for testing for Man in the middle attack vulnerabilities?

I am currently looking for ideas to test my application for Man in the middle (MITM) vulnerabilities. I was thinking about using Fiddler or Cain to examine the network traffic to see if a MITM attack ...
3
votes
2answers
526 views

Is it possible to automate testing involving Two-factor Authentication?

Are there methods for testing 2FA signup or login? I would assume judicious use of dummy phone numbers and/or emails would be involved.
3
votes
1answer
915 views

Selenium RC: Xpath of the link is changed when i refresh the page

Selenium RC: Xpath of the link is changed when I refresh the page, and when I run the code it shows "Exception in thread "main" com.thoughtworks.selenium.SeleniumException: ERROR: Element ...
3
votes
0answers
85 views

Attack surface metrics analyzer tool

I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics I found Microsoft surface ...
3
votes
2answers
418 views

Ways to test Web Service security by IP filtering?

As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if ...
2
votes
5answers
156 views

How to convince BA that her software requirement may cause problems?

In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I ...
2
votes
2answers
3k views

Payment gateways checklist

I am now working on payment gateway testing - manual testing- this project has many payments gateways, like credit card and other payments providers like Paypal is there any kind of check list I ...
2
votes
3answers
902 views

How to add a script tag to the end of a URL which can be covered as a part of XSS Testing

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either ...
2
votes
2answers
169 views

What methods do you use to analyze / define attack surface for a software?

It is good to define an attack surface before security testing. Different places to attack: Open pages & services (like login) Attack to underlying layers/servers/etc Attack to other users ... ...
2
votes
2answers
45 views

How can I learn more about desktop software security and testing?

I am looking for some good resources that I can use to improve my security testing skills, or just even my security analysis skills. Desktop client applications are the main target for this question. ...
2
votes
1answer
133 views

Any testing resource for security testing of mobile web applications

i have gone through the following question security sources and found testing resources for testing desktop and web applications, any realtime resource to test an mobile web applications?
2
votes
3answers
207 views

Mobile app security testing

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider ...
2
votes
2answers
140 views

How to load test a very complex, security heavy application?

Testing can sometimes get tricky. Especially when the application is very complex. I am currently working on a project and I have no idea how to test this. I work a lot with CMS based websites and ...
2
votes
2answers
71 views

Security issues in websites-Automation Testing

What kind of security issue or point should be consider during automation testing, which are the most prominent area of an website should be considered for security point of view, also comment in ...
2
votes
5answers
284 views

Best Opensource Tool available for Security Testing of Web applications

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I wants to use an open source tool. There are many type of vulnerabilities like Cross Site ...
1
vote
2answers
41 views

What is security testing? Please suggest how can I start. Any tools or any methods? [duplicate]

I want to learn security testing. To be candid I have just heard this term and never tried it. Is it beneficial for the product if security testing is done? How can I start? Do organizations value ...
1
vote
1answer
123 views

Security testing - functional or non-functioal, ISO 9126 vs ISO 25010

Some sources, e.g. ISTQB, claim that security testig is a functional one. This would be compliant with ISO 9126 (which the ISTQB is based on) but it goes against most other sources - as far as I know, ...
1
vote
1answer
66 views

REST Testing for CSRF Enable Website

I want to perform rest testing, like strong text rest client but issue here is website which I am performing testing sets CSRF token in browser in such situation rest client gives 403 error, is there ...
1
vote
1answer
52 views

Security testing for iOS app

I got task today to do Security testing of Ios App. I have read many articles and answers on google search and in http://sqa.stackexchange.com/ But still there is no one provides exact tricks for ...
1
vote
2answers
93 views

Training for Penetration Testing

I have been looking into expanding my skill set into penetration testing for a bit and with all of the recent security breaches, I figured it would be best to start my training and learning quickly. ...
1
vote
1answer
321 views

Fiddler and 2 way pinned certificates

Not completely certain if it's better to post here or security, so, trying here first. I'm currently attempting to test a new feature in a desktop application that uses 2 way pinning for https ...
1
vote
0answers
49 views

How can I test Wordpress 4.1 for stability? [closed]

How could I test (suggest me the test techniques, or what to test) if the latest version of Wordpress (4.1) is stable for building a company presentation website? this is more like a kind of ...
1
vote
0answers
58 views

xss scripts through console of web-developers-tools

So, well i am learning selenium webdriver, junit4. I need to know, is it a proper way to add "xss scripts" through console of web developers tools ? Can anyone help me with example ?
0
votes
1answer
25 views

How to decompile the published ASP.NET web application?

for penetration testing, i am planning to decompile the published source code of ASP.NET web application this have to done by the QA. But i am struggling to check this. is there any tool or any ...
0
votes
2answers
60 views

Top 10 Web Application Security Checks [closed]

What are the Security checks have to be performed while testing the Web Application. Security Plays an very important role. as Web is an POOL with lack of security we have to use our most of our ...
0
votes
0answers
3 views

How to change the dashboard title and content in the dashboard page in Jmeter 3.0 generated Dashboard

I want to know how and where to change the dashboard title and other content in jmeter 3.0 generated dashboard
0
votes
0answers
17 views

Document All SQL Calls in Visual Studio

As a QA tester I need to know all of the SQL Calls that a project is making in order to verify security concerns and access that the application my need. I know that I can find all of the SQL calls by ...
0
votes
0answers
26 views

Firefox error while creating proxy change for burp suite

Once I do Firefox manual proxy settings for burp suite, I am unable to run any live sites. How can I run and login from a live site hosted in GoDaddy to do a security test using burp suite?