I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools/sites/docs/ or classes preferably for security testing where i can learn from them?


I would start here: https://www.owasp.org/index.php/Main_Page

Lots of good reading, tools, videos, etc.


There are already a bunch of really good SO/SQA related pages; including tools.


BurpSuite and Fiddler are two important tools for my security testing tasks. Definitely check them out.

As for the approach I have found it is good to find out if your organization is required to allow 3rd party audits and security scans. Make sure your security tests cover these cases first. Then move to the most sensitive areas. Usually anything to do with authentication, sessions, user authorization levels and money transactions are a good place to start. It may be controversial to say this but as far as security goes I feel that the low hanging fruit / obvious exploits are a good place to start. Most attackers will try those first as well.


Another good starting point would be to read up, please see https://www.guru99.com/software-testing.html


Here are some manual test cases written by testers for security verification of website which you can use as a reference. It also contains test cases for wordpress security. By going through it you will able to identify where you need security and why. http://mundrisoft.com/tech-bytes/tips-for-security-testing-of-wordpress-website/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.