I want to learn security testing. The most important security testing types are : sql injection attacks, cross-site scripting, phishing attack. I don't know how to start learning. I want to find some tutorial or can anyone please explain to me how to start ? Are there any tools available ?

  • 4
    Security testing is a specialized domain: you will probably find more information and get better answers at security.stackexchange.com
    – Kate Paulk
    Nov 15 '16 at 12:38
  • Read the OWASP site.
    – user246
    Nov 15 '16 at 13:16
  • There are either too many possible answers, or good answers would be too long for this format. This question is very broad.
    – Malachi
    Nov 15 '16 at 14:17

Check this really good list: http://katrinatester.blogspot.de/2015/09/security-testing-pathway.html

And this free courses: https://www.cybrary.it


To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and try to manipulate data going to your application. (I have no affiliation with Telerik - I just use the software as my first pass security tool).

Beyond that, I'd recommend searching for tutorials in the different types of security testing, as well as searching the Information Security stack exchange site for beginner-level information.

A few other pieces of general advice for you:

  • If you/your employer doesn't control the software, don't try to learn security testing on it. Not every public site wants to have their security tested by anyone who feels like it.
  • Try to learn on a test environment. It may not have everything locked down (e.g. many test environments don't use SSL), but the fundamentals of the application should be the same. More importantly, on a test environment, if you accidentally do something horrible to the server or database, you can recover. Doing that to your employer's live software could get you fired.
  • Search engines are your friend.
  • 3
    I'll reiterate part of that advice: performing security testing on a public site without the owner's permission is almost indistinguishable from black hat hacking. In some countries, it can land you in jail.
    – user246
    Nov 15 '16 at 13:18