I want to learn security testing. The most important security testing types are : sql injection attacks, cross-site scripting, phishing attack. I don't know how to start learning. I want to find some tutorial or can anyone please explain to me how to start ? Are there any tools available ?

closed as too broad by dzieciou, Kate Paulk, Michael Durrant, Yu Zhang, IAmMilinPatel Nov 16 '16 at 2:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Security testing is a specialized domain: you will probably find more information and get better answers at security.stackexchange.com – Kate Paulk Nov 15 '16 at 12:38
  • Read the OWASP site. – user246 Nov 15 '16 at 13:16
  • There are either too many possible answers, or good answers would be too long for this format. This question is very broad. – Malachi Nov 15 '16 at 14:17

Check this really good list: http://katrinatester.blogspot.de/2015/09/security-testing-pathway.html

And this free courses: https://www.cybrary.it


To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and try to manipulate data going to your application. (I have no affiliation with Telerik - I just use the software as my first pass security tool).

Beyond that, I'd recommend searching for tutorials in the different types of security testing, as well as searching the Information Security stack exchange site for beginner-level information.

A few other pieces of general advice for you:

  • If you/your employer doesn't control the software, don't try to learn security testing on it. Not every public site wants to have their security tested by anyone who feels like it.
  • Try to learn on a test environment. It may not have everything locked down (e.g. many test environments don't use SSL), but the fundamentals of the application should be the same. More importantly, on a test environment, if you accidentally do something horrible to the server or database, you can recover. Doing that to your employer's live software could get you fired.
  • Search engines are your friend.
  • 3
    I'll reiterate part of that advice: performing security testing on a public site without the owner's permission is almost indistinguishable from black hat hacking. In some countries, it can land you in jail. – user246 Nov 15 '16 at 13:18