I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the information stored in them is encrypted.
My current site implements SSO. When I check the post request it sends the parameters:
- Mobile No
The weird thing is that if I use different value of
RequestVerificationToken and do the post request manually via
jmeter, it allows me to do the same.
So my questions are:
- What is the use of this token here?
- How can I be sure that my site authentication is secure?
- What are other things I can test in cookies and get and post request?