I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools/sites/docs/ or classes preferably for security testing where i can learn from them?
-
3Welcome to SQA, userjain. You might start by searching this site for other questions about security testing. – user246 Jun 19 '13 at 20:03
Add a comment
|
I would start here: https://www.owasp.org/index.php/Main_Page
Lots of good reading, tools, videos, etc.
answered Jun 19 '13 at 22:44
Pls find useful links (references) to get started
BurpSuite and Fiddler are two important tools for my security testing tasks. Definitely check them out.
As for the approach I have found it is good to find out if your organization is required to allow 3rd party audits and security scans. Make sure your security tests cover these cases first. Then move to the most sensitive areas. Usually anything to do with authentication, sessions, user authorization levels and money transactions are a good place to start. It may be controversial to say this but as far as security goes I feel that the low hanging fruit / obvious exploits are a good place to start. Most attackers will try those first as well.
Another good starting point would be to read up, please see https://www.guru99.com/software-testing.html
Here are some tools I use for penetration testing
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
https://www.owasp.org/index.php/OWASP_Dependency_Check
and there is a lot of materials for learning:
https://portswigger.net/web-security
Here are some manual test cases written by testers for security verification of website which you can use as a reference. It also contains test cases for wordpress security. By going through it you will able to identify where you need security and why. http://mundrisoft.com/tech-bytes/tips-for-security-testing-of-wordpress-website/
