Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [security-testing]

Security testing is a process to determine that an information system protects data and maintains functionality as intended.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

How to automate a fido token login

I need to automate a login which uses a fido token. No person can be behind the screen as it is supposed to be automated. I can build a small device which would move the "finger" up and down....
Hola Soy Edu Feliz Navidad's user avatar
1 vote
0 answers
157 views

list the cyphers of a tls client

So, I have to test that client that connects to an HTTPS server, and ensure it offer the listed cyphersuites during the tls handshake. But I'm finding no way to start a server and have it tell me what ...
Spoutnik16's user avatar
6 votes
1 answer
145 views

How to export fuzzing report from ZAP with request and response?

I'm doing fuzzing test on a project using OWASP ZAP. After the test is completed, I export the results in CSV format from the Fuzzer tab in results. This result doesn't have the Request and response. ...
Latika Karlos's user avatar
1 vote
0 answers
66 views

Security testing for a AAD authentication web application using OWASP ZAP

I'm having difficulty in how to start security testing for these type of application which has Azure AD authentication. Can someone guide me on how to start this? Do I need to use Zest script for this?...
PVS's user avatar
  • 11
1 vote
1 answer
124 views

How can you test if a page can be anonymously accessible within an app you have already authenticated in?

I am trying to ensure that a page that can be visited from within an app that requires user to be logged in, can be accessed anonymously. A controller has been introduced that can present views as ...
metavaronos's user avatar
4 votes
6 answers
995 views

Is security testing the sole responsibility of testers or part of a mixed team?

Details: The well-known differences between API/GUI i.e. Functional Test are clearly defined. However, I ask myself the question: Does security testing belong in the focus of testers at all? Or ...
Mornon's user avatar
  • 1,117
0 votes
4 answers
248 views

How to calculate security test or penetration test cost for the customer?

Details: A customer would like to know in detail what costs penetration testing causes on the one hand, and what benefits penetration has on the other hand. Also, what it effectively means to save ...
Mornon's user avatar
  • 1,117
2 votes
1 answer
245 views

Vulnerability regression testing in an agile environment

Starting point: We used different solutions in the test team to test our websites for vulnerabilities in different ways. In doing so, we naturally also want to retest the bugs anchored in the backlog ...
Mornon's user avatar
  • 1,117
-1 votes
2 answers
77 views

How can one test the security measures or vulnerability when it comes to API testing? [closed]

I use REST for API Testing. What are good tools and/or approaches to testing security issues ? Any information through which I can broaden my perspective,ways,tools for testing when it comes to API.
Hetvi shah's user avatar
0 votes
1 answer
39 views

For a beginner,how can one start with the security testing? [closed]

Are there any areas which need to be looked before starting with the security testing? What tools can be helpful for it?
Hetvi shah's user avatar
-2 votes
1 answer
654 views

OWASP ZAP integration into SOAPUI for REST API Testing

One of the topics I am currently working on is the testing of APIs on the security level, e.g. as integration in SOAPUI and OWASP in WSO2. The integration of SOAPUI and WSO2 is set up and also works. ...
Mornon's user avatar
  • 1,117
-1 votes
1 answer
57 views

Can I make test cases for web application security testing?

We have been performing application security testing based on OWASP standards. We use JIRA to report the bugs or improvements. However, is there any way where we can make a generic test case for these ...
Xterm's user avatar
  • 31
0 votes
1 answer
909 views

How to test SSO integration?

I am doing QA for a website, and they have recently added SSO integration for their website. How can I manually test that this SSO integration is working fine. Also I need to automate the testing ...
Dawood Abbas 's user avatar
7 votes
3 answers
8k views

Is it really possible to be a Full-Stack QA & if yes then list the technical skills required?

Everyone needs an all-rounder whether it is a software developer or Tester these days. Hence we are hearing the term “Full Stack QA” these days so my question is what skill-set makes a Full Stack QA &...
Nitin Rastogi's user avatar
0 votes
1 answer
195 views

Security Testing for brute force attacks on login page

I want to perform testing for brute force attacks on login page of a website. I am new to security testing and I think i can test this by multiple failed login attempts. I wrote the below code to test ...
Swati Mittal's user avatar
3 votes
1 answer
165 views

Is there any good browser plugin or tool to quickly identify any security issues of a web site?

I'm working on a web project and need to give a quick update on how the security of the web site. So is there any tool or browser plugin to do a quick scan for my web project and get an analysis ...
ChathuD's user avatar
  • 2,147
2 votes
1 answer
137 views

Which penetration test tools can be used in the agile and CI environment?

since I have different projects, with different development environments, it is, of course, important for me which penetration tools I use. The projects: Project 1 is a pure web project which is ...
Mornon's user avatar
  • 1,117
0 votes
1 answer
106 views

How to plan penetration testing in agile development?

Of course, as is well known, we plan of course Unit Test (in my case Junit) in the sprint, we have with QfS a GUI / Acceptance Test Framework which we plan accordingly in the sprint. The question but ...
Mornon's user avatar
  • 1,117
1 vote
0 answers
40 views

Is there any Mobile app Security Testing tool which uses a server-agent configuration instead of using proxy for intercepting requests?

I want to perform the security testing of a mobile app. I am using ZAP for Testing Web application. For testing web application, we no longer need to use a proxy, but for mobile application, proxy ...
Rishi's user avatar
  • 885
0 votes
1 answer
111 views

Which files should I validate on an image upload feature?

I'm curious which files I should be checking for on a typical image upload feature. This particular one I'm testing is for a profile picture. Things I'm already checking for: Image file size (e.g. &...
TheGRS's user avatar
  • 3
0 votes
1 answer
134 views

Security Standards Compliance testing library with Selenium

I've been using Selenium for awhile and I know many testers have compiled lists of standard security compliance types of tests to perform, like are listed here These fall into a list of tests that ...
jmbmage's user avatar
  • 101
2 votes
1 answer
1k views

How to test oAuth Authentication?

We are making a mobile application that will be communicating with the backend, which also we are building. Authorization of users and application itself with the backend is going to be made using ...
mdymek's user avatar
  • 469
1 vote
1 answer
83 views

Why does it take a long time to spider an application?

Is it normal to take 10mins for bdd-security to spider an application? And should the spidering be done after log in or before login? Basically we have a web application on which we need to do the ...
Swastik's user avatar
  • 324
4 votes
3 answers
170 views

As an outsourced SQA Testing provider: how would you estimate the workload (an therefore the costs) for testing your client's next project?

Let's say you are in charge of an SQA & Testing company that offers outsourced testing services to other companies that develop software. Let's say you offer 4 general types of testing: ...
Pablo Messina's user avatar
0 votes
1 answer
53 views

Security test for .net desktop application: upload a file (shell) to check how software behaves

I am looking for a most common injection file (shell) to import my software to check if it is open to these kind of attacks or not. Any recommendation, web sites or blogs? (summary: i will upload ...
RecepC's user avatar
  • 61
2 votes
1 answer
73 views

How can someone prevent to become a victim of social engineering? [closed]

There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information. ...
Nitin Rastogi's user avatar
21 votes
4 answers
7k views

One of my team members executed security test without any consent

One of my team members, when deployed at a customer's site, executed a password attack against the customer's database. As a result, this customer's database was locked down for 30 minutes. Now ...
oscar's user avatar
  • 1,495
1 vote
3 answers
1k views

How to do automated SSL server testing?

I want to do automated SSL server testing. Like what Qualys, Inc is offering with SSL Server Test but running fully automated in a build environment like TeamCity or Jenkins. Does anybody know tools/...
Markus Neifer's user avatar
-1 votes
3 answers
967 views

How to Test security of the android mobile application?

I am new to testing the security of applications. I know basic security like invalid credentials, but I don't know much about security testing for mobile app. Please tell me what all can I try to do a ...
Rutvi Soni's user avatar
1 vote
1 answer
1k views

Are OWASP security standards applicable for desktop applications?

I am looking for some tools to help me with security test on a desktop application, but I haven't figured it out yet. Any help will be highly appreciated.
RecepC's user avatar
  • 61
2 votes
2 answers
129 views

If we can not catch all of security bugs, why do we still test?

Someone asked me a question next to water cooler: It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests? I was speechless, could not provide any ...
oscar's user avatar
  • 1,495
1 vote
1 answer
191 views

One question from ISTQB security exam, how to test SQL injection efficiently?

If we are to use equivalent partitioning technique, which one of the following answers is the most efficient to test against SQL injection? bbbbb,12345,' %, ', @, abn123 ', ab123 '
oscar's user avatar
  • 1,495
1 vote
1 answer
64 views

What are different type of gamers and how it is helpful for game testing? [closed]

What are the different types of gamers? How can we categorize it? How is it helpful for performing game testing? Sorry to post this question under an irrelevant tag.
IndiumSoftware's user avatar
1 vote
1 answer
42 views

Security policies and procedures [closed]

I am compiling a list of general security policies and procedures at the moment. The following items have been included: Acceptable use - this policy defines what behaviors are acceptable and what ...
QAbird's user avatar
  • 1,007
6 votes
4 answers
444 views

Is security assessment a one-off task?

I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team. He put lots effort in saying "We only need one security assessment, as we need to tick ...
QAbird's user avatar
  • 1,007
6 votes
2 answers
110 views

Should I offer free security tests to my clients?

I have been engaging a client for two months now. They are a major electricity generation and distribution company. For each project, I have got more than enough time to finish my SoapUI test cases ...
QAbird's user avatar
  • 1,007
8 votes
4 answers
2k views

The difference between security audit and security testing

I am a bit confused by security audit and security testing, do they not both test against security holes? What are the differences between them?
oscar's user avatar
  • 1,495
0 votes
1 answer
203 views

Best security and performance testing tool as a fresher tester [closed]

What are the best security and performance tool as a fresher tester i should know? I am new to the testing field and my seniors have asked me to learn tools for performance and security testing.
Manish 5893's user avatar
1 vote
1 answer
429 views

How simple authentication and Token based authentication differs?

I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the ...
NarendraR's user avatar
  • 1,573
0 votes
2 answers
183 views

Security testing tools for android and ios apps [closed]

What are the available security testing tools for Android and iOS apps? Mainly for a passive scan for known vulnerabilities.
ChathuD's user avatar
  • 2,147
0 votes
2 answers
134 views

How to analyze the result of vulnerability scanner

I need to do penetration testing, I'm scanning the vulnerability of My Web Application using VEGA tool. I did this using proxy mode set the manual proxy and recorded the actions after login in the ...
NarendraR's user avatar
  • 1,573
1 vote
3 answers
213 views

Career focus on single testing skills or multiple? (e.g. Manual, Selenium, Performance and or Security) [closed]

Currently I'm working in Selenium, REST API testing. And our company wants us to do security testing and ethical hacking. I want to know the difference between them, if I take the responsibility of ...
user avatar
7 votes
3 answers
2k views

Ethical Hacking career options for qa professionals

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
prinz's user avatar
  • 552
2 votes
1 answer
78 views

Analytics Platform(AP) + Performance Testing + Need a Open Source tool to Test AP

We Developed a Application, where we can track the Analytics of the Users. Like Installs, Uninstalls, Sessions, Events, Sending Notifications, Large scale of Information where we can Track down the ...
RamaSwamy's user avatar
1 vote
1 answer
221 views

Penetration testing certificate, Kali Linux certificate?

ISTQB, iSQI, Agile, Scrum certificates are well known to us. I am wondering if there is a security penetration testing certificate? (Certified Ethical Hacker is one example, but I am specifically ...
Yu Zhang's user avatar
  • 9,942
1 vote
2 answers
3k views

Looking for alternative security testing tool like Acunetix?

Is there any tool similar like Acunetix?, because it's really "user-friendly" for me, and I haven't found something similar yet, preferable with a cheaper price. So what I like from Acunetix is clear ...
BetaTester's user avatar
-2 votes
4 answers
218 views

How a Software Tester or Q & A should move ahead in his career [closed]

When one person joins a company as a software tester, the basic skills he contains within himself is Manual Testing. Is it enough for him to sustains for a long period in the company? If not then ...
Sandeep's user avatar
  • 333
1 vote
1 answer
459 views

How to create an SSL certificate for my demo server and access the client through "https" without any warning in browser [closed]

I'm a QA guy working on a java based web application running on JBoss. The server is running on CentOS 6.6 (bash). When I access the client in a web browser from my PC through "https" (say https://10....
Bala Krishnan's user avatar
1 vote
1 answer
72 views

Do we need a security officer to safeguard security of an application?

Currently I am thinking about how we can improve the focus of security testing and integration it into our development cycle. Now I am wondering, do we need a CSO or Security Officer role? Or is it ...
Niels van Reijmersdal's user avatar
0 votes
1 answer
112 views

What are some Software Testing Attacks that can be used in black box testing? [closed]

If I am doing functional testing of a web application, what are some attacks I can perform on input fields, forms, etc. that can cause the application to crash?
tester33's user avatar