Tag Info

Hot answers tagged

5

There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website". Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...


3

I tested credit provider gateways and implementations for years, so I can give a few suggestions: Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway: Data transmitted to the gateway is sent over a secured channel (https or some other secure means) Data logged does not include ...


2

As a tester part of your job is to provide information and to advise others (BAs, Developers, Managers etc.) about the state of the system and any potential risks. With this in mind, what I'd do in your situation is to research examples of this problem and the potential effects. To appear more credible you could outline best case scenarios (e.g. distribution ...


2

ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.


2

Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests. If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent ...


2

Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this: http://www.example.com.:80 Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. ...


1

You'll find OWASP to be a great resource for security/penetration testing. Start here for iOS.


1

Security concerns with website is not related to manual or automation testing. Testing a software manually or using another software/script(automation) is your choice of approach to your task. Security concerns should be defined at the time of analysis or defining requirements. Depending on what your stakeholders want with an addition of your sapience you ...


1

According to me you should keep concentrate on given requirement first. Then you can do other type of testing. As you are doing gateway testing then security testing is must. Also if you want to do more and more test cases to apply on those things then better you create automated test scripts with diff. types of all scenarios and run them so it will give ...


1

Try reading http://security.stackexchange.com/. It is described "a question and answer site for Information security professionals".


1

In order to keep the same build for testing as production there needs to be some sort of toggle in the application. Preferable in a configuration file (or database setting). By default the useCaptcha setting is enabled, but in the test environment you disable this in the configuration file. This means the code will have two paths One that does not load ...


1

I don't have any experience with PenTesting (training or otherwise) but I came across this mindmap and thought of this question. It appears to list practice labs (doesn't state where they are located) for Pen Testing. I know Stack Exchange has a Security Forum and post on learning ethical PenTesting here - maybe this is a good place to follow up? Then you ...


1

If you haven't already looked into it you can register client certificates as mentioned http://docs.telerik.com/fiddler/configure-fiddler/tasks/RespondWithClientCert You can also utilize Soapui to send communications with certificates, but that's just services...not sure if this is a service or part of the webapp...sounds like it's coded in the app. If all ...


1

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative. w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting ...



Only top voted, non community-wiki answers of a minimum length are eligible