Tag Info

Hot answers tagged

5

There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website". Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...


3

I tested credit provider gateways and implementations for years, so I can give a few suggestions: Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway: Data transmitted to the gateway is sent over a secured channel (https or some other secure means) Data logged does not include ...


2

Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this: http://www.example.com.:80 Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. ...


2

As a tester part of your job is to provide information and to advise others (BAs, Developers, Managers etc.) about the state of the system and any potential risks. With this in mind, what I'd do in your situation is to research examples of this problem and the potential effects. To appear more credible you could outline best case scenarios (e.g. distribution ...


1

You'll find OWASP to be a great resource for security/penetration testing. Start here for iOS.


1

Security concerns with website is not related to manual or automation testing. Testing a software manually or using another software/script(automation) is your choice of approach to your task. Security concerns should be defined at the time of analysis or defining requirements. Depending on what your stakeholders want with an addition of your sapience you ...


1

According to me you should keep concentrate on given requirement first. Then you can do other type of testing. As you are doing gateway testing then security testing is must. Also if you want to do more and more test cases to apply on those things then better you create automated test scripts with diff. types of all scenarios and run them so it will give ...


1

This is a technique in penetration testing to detect a vulnerability called "Insecure Direct Object References", 4th on OWASP Top 10 list. Regarding whether this is security or confidentiality testing. I would say both as confidentiality is just one of the measures in security testing: A security measure which protects against the disclosure of ...


1

Pls find useful links (references) to get started http://resources.infosecinstitute.com/net-penetration-testing-test-case-cheat-sheet/ https://www.pentesterlab.com/exercises/ http://darkassassinscybercrew.blogspot.in/2013/01/sqlmap-tutorial-for-window-7.html http://www.fuzzysecurity.com/tutorials/4.html


1

I don't have any experience with PenTesting (training or otherwise) but I came across this mindmap and thought of this question. It appears to list practice labs (doesn't state where they are located) for Pen Testing. I know Stack Exchange has a Security Forum and post on learning ethical PenTesting here - maybe this is a good place to follow up? Then you ...


1

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative. w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting ...



Only top voted, non community-wiki answers of a minimum length are eligible