Hot answers tagged security-testing
Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests. If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent ...
Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.
ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.
Try reading http://security.stackexchange.com/. It is described as "a question and answer site for Information security professionals".
In order to keep the same build for testing as production there needs to be some sort of toggle in the application. Preferable in a configuration file (or database setting). By default the useCaptcha setting is enabled, but in the test environment you disable this in the configuration file. This means the code will have two paths One that does not load ...
You can do it with burp : Just make sure that you check Rest style url parameters Steps you can do were : 1)intercept the request with proxy of burp 2)Right click navigate to engagement tools -->CSRF poc 3)generate a csrf token with invalid/vulnerable parameters 4)check with browser to get the request Detailed part can be found here
It mostly depends on whatever you have access to both authentication server and authenticated client. I was able to automate OTP using email. But it required either own email server or email account on a real server, for example gmail or yahoo. It may be possible to automate OTP via SMS by using google voice and redirecting SMS into your email address. ...
Only top voted, non community-wiki answers of a minimum length are eligible