I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, except for some light SQL Injection, which is easy to test for either way. The problem I'm having is that they want me to come up with actual cases for XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery). While Google provides some examples for programmers, they do nothing to teach testers on how exactly to test for these vulnerabilities. Is there a place, a tutorial, something that provides actual examples of how people can attempt these types of exploits and how to discover them in your web application?
Add a comment
|
4 Answers
If you're willing to spend a little bit of cash, I'd recommend both How to Break Web Software and the Web Security Testing Cookbook. I also recommend playing around with things like Damn Vulnerable Web Application and WebGoat. Should give you a decent start.
Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns.
You can look at those examples then try to relate them to where they would apply to your application.
http://www.hackthissite.org/ is a useful resource
Use Ironwasp tool fro CSRF attack if the application have CSRF attack we can easily identify by CSRF POC generator tool
