0

What are the Security checks have to be performed while testing the Web Application.

Security Plays an very important role. as Web is an POOL with lack of security we have to use our most of our effort to make our Application secure or to enhance the security of our application.

List our some of the security test for making our Application secure.

closed as too broad by Dhiman, Kate Paulk, Paul Muir, corsiKa Apr 21 '16 at 20:31

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • And what's the issue you are facing? Did you asked this question to share information? – Dhiman Apr 20 '16 at 13:24
  • Check this link for the information you are looking for ibm.com/developerworks/library/se-owasptop10 and you should read about OWASP. – Dhiman Apr 20 '16 at 13:30
  • This is far too broad here. This site is for specific questions that net specific answers. Making large lists of things is generally not what we're about. – corsiKa Apr 21 '16 at 20:32
  • This question was mentioned on Meta – Malachi Jun 24 '16 at 16:08
4

10 security checks for any web application are as follows -

#1 SQL Injection

Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

#2 Broken authentication and session management

Authentication and session management includes all aspects of handling user authentication and managing active sessions. Even solid authentication mechanisms can be undermined by flawed credential management functions, including password change, "forgot my password", "remember my password", account update, and other related functions.

Ex - if the user has a valid session id, in case an attacker has discovered a session where the original user has failed to log out.

#3 Cross-site scripting

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

#4 Insecure direct object reference

A direct object reference is likely to occur when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key without any validation mechanism which will allow attackers to manipulate these references to access unauthorized data.

#5 Security Misconfiguration

Security Misconfiguration arises when Security settings are defined, implemented, and maintained as defaults.

It is equally important to have the software up to date.

Security misconfigurations are easy to exploit but there are a number of proactive ways to prevent them, including the following recommendations from industry experts :-

a). Develop a repeatable process to reduce the surface of vulnerability

b). Disable default accounts and change passwords

c). Keep software up-to-date

d). Develop a strong application architecture that effectively isolates components and encrypts data which is especially important with sensitive data.

e). Disable any unnecessary files or features

f). Don’t present stack tracers to users

g). Ensure security settings in development frameworks and libraries are set to secure values

h)Run tools (i.e. automated scanners) and perform regular audits to identify holes in the security configuration

#6 Sensitive data exposure

Sensitive data leakage is a leading cause of embarrassment and data exploitation world-wide. This blog post will discuss number six on the Open Web Application Security Project (OWASP) top ten list, sensitive data exposure.

QUES : How Does Sensitive Data Exposure Vulnerability Affect You?

ANS : Sensitive Data Exposure occupies the 7th spot in the list of OWASP Top 10 Web Application Vulnerabilities. It deals with the threats associated with the unauthorized handling of business sensitive information.

#7 Missing function level access control

missing function level access control, occurring when a lower-level-access user is inadvertently allowed access to a part of a website restricted to higher-level access. Administrators who elect to "hide" functions instead of protecting their applications at the function level can create these vulnerabilities.

#8 Cross-site request forgery

Cross-site request forgery (CSRF ) is a web application vulnerability that makes it possible for an attacker to force a user to unknowingly perform actions while they are logged into an application. Attackers commonly use CSRF attacks to target cloud storage, social media, banking, and online shopping sites because of the user information and actions available in those types of applications.

#9 Using components with known vulnerabilities

No software package is perfect, and even though the organizations distributing these components work hard to make good products, they are aware that mistakes happen. When using external libraries in your project it’s important to keep in mind that you are bringing in good functionality and important features, but you are also opening the door for potential bugs and security vulnerabilities.

A recent example of this is the remote-code execution with 'Expression Language injection' vulnerability that was recently introduced through the Spring Framework for Java. However, it is estimated that 29.8 million downloads contain the known vulnerability.

#10 Invalidated redirects and forwards

Most Web applications on net frequently redirect and forward users to other pages or other external websites, however, without validating the credibility of those pages, hackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

1

Normally, though, developers are more focused with the functional and visual output of their changes, and spend far less time on the security ramifications. When they do focus on security, though, commonly the only things that come to mind are typical, like protecting against SQL injections or access control bugs, but a focus on security should cover far more than that. When testing your web application, this list can give you a good place to start looking for vulnerabilities outside the normal areas. And while this is nowhere near comprehensive, it will give you at least ten areas you should apply more focus on security to, if you do not already.

Go through this link to check the list: http://www.softwaretestingclass.com/top-10-web-security-checks-how-to-test-for-a-secure-website/

Not the answer you're looking for? Browse other questions tagged or ask your own question.