Tag Info

Hot answers tagged


In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.


Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing. That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security ...


If your goal is to bypass the confirmation for testing purposes, I know this can be done for Chrome: Open chrome://settings/ in the Chrome browser Select the "Show advanced settings..." link Scroll down to the "Downloads" settings Uncheck the box labeled "Ask where to save each file before downloading" If you run your tests on Chrome you should be able ...


Here's a tool that allows you to get code coverage data per test case and then compare against other tests or all tests: http://www.semanticdesigns.com/Products/TestCoverage/JavaTestCoverage.html


You could implement your own version of minset that would be useful to anyone that uses gcov/lcov or, with a small modification, also to users of other code coverage measuring tools. Export gcov/lcov report to some processable format, e.g. XML. The report should describe coverage per method/class/package (granularity is up to you) for each test you ...


Check this out: http://www.acunetix.com/websitesecurity/cross-site-scripting/ Their example is: <script type="text/javascript"> alert('This is an XSS Vulnerability') </script>


There are already a bunch of really good SO/SQA related pages; including tools.

Only top voted, non community-wiki answers of a minimum length are eligible