I want to learn security testing. The most important security testing types are : sql injection attacks, cross-site scripting, phishing attack. I don't know how to start learning. I want to find some tutorial or can anyone please explain to me how to start ? Are there any tools available ?
Check this really good list: http://katrinatester.blogspot.de/2015/09/security-testing-pathway.html
And this free courses: https://www.cybrary.it
To start with, I'd suggest installing Fiddler and exploring your website with it. There's plenty of information available about how to use Fiddler and it makes a decent starting point to explore and try to manipulate data going to your application. (I have no affiliation with Telerik - I just use the software as my first pass security tool).
Beyond that, I'd recommend searching for tutorials in the different types of security testing, as well as searching the Information Security stack exchange site for beginner-level information.
A few other pieces of general advice for you:
- If you/your employer doesn't control the software, don't try to learn security testing on it. Not every public site wants to have their security tested by anyone who feels like it.
- Try to learn on a test environment. It may not have everything locked down (e.g. many test environments don't use SSL), but the fundamentals of the application should be the same. More importantly, on a test environment, if you accidentally do something horrible to the server or database, you can recover. Doing that to your employer's live software could get you fired.
- Search engines are your friend.