Hot answers tagged security-testing
If you have access to the DLLs you can use Reflector. Unless you are accessing the server internally you would not typically have access to the DLLs. If you are doing an internal security audit (Someone who has access to your network) than they would quite possibly have access to the DLLs. This could lead to a scenario where they could decompile the code. ...
Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.
ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.
10 security checks for any web application are as follows - #1 SQL Injection Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). #2 Broken authentication and session management Authentication and session ...
You can do it with burp : Just make sure that you check Rest style url parameters Steps you can do were : 1)intercept the request with proxy of burp 2)Right click navigate to engagement tools -->CSRF poc 3)generate a csrf token with invalid/vulnerable parameters 4)check with browser to get the request Detailed part can be found here
It mostly depends on whatever you have access to both authentication server and authenticated client. I was able to automate OTP using email. But it required either own email server or email account on a real server, for example gmail or yahoo. It may be possible to automate OTP via SMS by using google voice and redirecting SMS into your email address. ...
Only top voted, non community-wiki answers of a minimum length are eligible