Tag Info

Hot answers tagged


In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.


Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing. That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security ...


This is a technique in penetration testing to detect a vulnerability called "Insecure Direct Object References", 4th on OWASP Top 10 list. Regarding whether this is security or confidentiality testing. I would say both as confidentiality is just one of the measures in security testing: A security measure which protects against the disclosure of ...


Check this out: http://www.acunetix.com/websitesecurity/cross-site-scripting/ Their example is: <script type="text/javascript"> alert('This is an XSS Vulnerability') </script>


Here's a tool that allows you to get code coverage data per test case and then compare against other tests or all tests: http://www.semanticdesigns.com/Products/TestCoverage/JavaTestCoverage.html


You could implement your own version of minset that would be useful to anyone that uses gcov/lcov or, with a small modification, also to users of other code coverage measuring tools. Export gcov/lcov report to some processable format, e.g. XML. The report should describe coverage per method/class/package (granularity is up to you) for each test you ...

Only top voted, non community-wiki answers of a minimum length are eligible