Hot answers tagged

3

If you have access to the DLLs you can use Reflector. Unless you are accessing the server internally you would not typically have access to the DLLs. If you are doing an internal security audit (Someone who has access to your network) than they would quite possibly have access to the DLLs. This could lead to a scenario where they could decompile the code. ...


2

Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.


2

ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.


2

There are different types of security testing all with their own path. It could be from actual penetration testing to just risks analysis. From my experience (in the software development world) security testing is often ignored until a client asks for an audit or only executed after a security breach has happened. This greatly depends on the industry and ...


1

To change the title add the following line to user.properties file: jmeter.reportgenerator.report_title=Your desired title You cannot change the content as it is being generated from result files. You can tune the representation of the existing content again by manipulating JMeter Properties which names start with jmeter.reportgenerator. References: ...


1

Things have changed now, most of the companies management is Aware that Security testing should be included as part of Testing.Many critical Banking Applications, E-commerce Websites which stores customer Credit details have to oblige to PCI compliance. To me, it's really interesting field to Dig bugs that may break down your systems and can get access to ...


1

10 security checks for any web application are as follows - #1 SQL Injection Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). #2 Broken authentication and session management Authentication and session ...


1

Web apps consist of two parts: front-end and backend. Front-end lives in a browser instance, so you don't need to verify front-end itself for more than one users, while backend you should -- it will collect data from many users. However, still overloaded backend may impact performance of the frontend, because I expect there's some "thread" in JavaScript ...


1

You can do it with burp : Just make sure that you check Rest style url parameters Steps you can do were : 1)intercept the request with proxy of burp 2)Right click navigate to engagement tools -->CSRF poc 3)generate a csrf token with invalid/vulnerable parameters 4)check with browser to get the request Detailed part can be found here


1

It mostly depends on whatever you have access to both authentication server and authenticated client. I was able to automate OTP using email. But it required either own email server or email account on a real server, for example gmail or yahoo. It may be possible to automate OTP via SMS by using google voice and redirecting SMS into your email address. ...



Only top voted, non community-wiki answers of a minimum length are eligible