Hot answers tagged security-testing
Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.
You can do it with burp : Just make sure that you check Rest style url parameters Steps you can do were : 1)intercept the request with proxy of burp 2)Right click navigate to engagement tools -->CSRF poc 3)generate a csrf token with invalid/vulnerable parameters 4)check with browser to get the request Detailed part can be found here
Only top voted, non community-wiki answers of a minimum length are eligible