Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security-testing]

Security testing is a process to determine that an information system protects data and maintains functionality as intended.

2
votes
1answer
127 views

Is it really possible to be a Full-Stack QA & if yes then list the technical skills required?

Everyone needs an all-rounder whether it is a software developer or Tester these days. Hence we are hearing the term “Full Stack QA” these days so my question is what skill-set makes a Full Stack QA &...
-1
votes
1answer
27 views

Security Testing for brute force attacks on login page

I want to perform testing for brute force attacks on login page of a website. I am new to security testing and I think i can test this by multiple failed login attempts. I wrote the below code to test ...
3
votes
1answer
152 views

Is there any good browser plugin or tool to quickly identify any security issues of a web site?

I'm working on a web project and need to give a quick update on how the security of the web site. So is there any tool or browser plugin to do a quick scan for my web project and get an analysis ...
1
vote
0answers
55 views

Which penetration test tools can be used in the agile and CI environment?

since I have different projects, with different development environments, it is of course important for me which penetration tools I use. The projects: Project 1 is a pure web project which is only ...
0
votes
1answer
48 views

How to plan penetration testing in agile development?

Of course, as is well known, we plan of course Unit Test (in my case Junit) in the sprint, we have with QfS a GUI / Acceptance Test Framework which we plan accordingly in the sprint. The question but ...
0
votes
0answers
17 views

Is there a method to perform sql inject for prepared statements?

I've been trying to learn sql injection and tried perform on a site that we developed. Following code is sample code taken from internet. I want to know is there a way to do sql injection even on a ...
0
votes
0answers
23 views

I am using Mobile Security Framework. When run python manage.py runserver, it displays this kind of error

File "manage.py", line 8, in from django.core.management import execute_from_command_line ModuleNotFoundError: No module named 'django' Kindly help me out to solve this error. I have installed ...
0
votes
0answers
39 views

I can't see issues and advisory tabs in my burpsuite Tool

I am using Burp suite free edition security tool for testing my web application. I need to do SQL injection testing for my web application . So that i have done 'SQLiPy Sqlmap' Integration with ...
3
votes
2answers
119 views

Want to move to testing after having almost 7 years of development experience

I am having almost 7 years of experience as a developer and would like to know if I can move to testing without having any experience in it except for Unit testing ofcourse. My reasons for moving to ...
1
vote
0answers
33 views

Is there any Mobile app Security Testing tool which uses a server-agent configuration instead of using proxy for intercepting requests?

I want to perform the security testing of a mobile app. I am using ZAP for Testing Web application. For testing web application, we no longer need to use a proxy, but for mobile application, proxy ...
0
votes
1answer
29 views

Which files should I validate on an image upload feature?

I'm curious which files I should be checking for on a typical image upload feature. This particular one I'm testing is for a profile picture. Things I'm already checking for: Image file size (e.g. &...
0
votes
1answer
70 views

Security Standards Compliance testing library with Selenium

I've been using Selenium for awhile and I know many testers have compiled lists of standard security compliance types of tests to perform, like are listed here These fall into a list of tests that ...
2
votes
1answer
507 views

How to test oAuth Authentication?

We are making a mobile application that will be communicating with the backend, which also we are building. Authorization of users and application itself with the backend is going to be made using ...
1
vote
1answer
71 views

Why does it take a long time to spider an application?

Is it normal to take 10mins for bdd-security to spider an application? And should the spidering be done after log in or before login? Basically we have a web application on which we need to do the ...
4
votes
3answers
149 views

As an outsourced SQA Testing provider: how would you estimate the workload (an therefore the costs) for testing your client's next project?

Let's say you are in charge of an SQA & Testing company that offers outsourced testing services to other companies that develop software. Let's say you offer 4 general types of testing: ...
0
votes
1answer
43 views

Security test for .net desktop application: upload a file (shell) to check how software behaves

I am looking for a most common injection file (shell) to import my software to check if it is open to these kind of attacks or not. Any recommendation, web sites or blogs? (summary: i will upload ...
2
votes
1answer
67 views

How can someone prevent to become a victim of social engineering? [closed]

There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information. ...
21
votes
4answers
7k views

One of my team members executed security test without any consent

One of my team members, when deployed at a customer's site, executed a password attack against the customer's database. As a result, this customer's database was locked down for 30 minutes. Now ...
1
vote
3answers
429 views

How to do automated SSL server testing?

I want to do automated SSL server testing. Like what Qualys, Inc is offering with SSL Server Test but running fully automated in a build environment like TeamCity or Jenkins. Does anybody know tools/...
0
votes
2answers
544 views

How to Test security of the android mobile application

I am new to testing the security of applications. I know basic security like invalid credentials but I don't know about mobile app security testing Please let me know how to check?
1
vote
1answer
446 views

Are OWASP security standards applicable for desktop applications?

I am looking for some tools to help me with security test on a desktop application, but I haven't figured it out yet. Any help will be highly appreciated.
2
votes
2answers
81 views

If we can not catch all of security bugs, why do we still test?

Someone asked me a question next to water cooler: It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests? I was speechless, could not provide any ...
1
vote
1answer
124 views

One question from ISTQB security exam, how to test SQL injection efficiently?

If we are to use equivalent partitioning technique, which one of the following answers is the most efficient to test against SQL injection? bbbbb,12345,' %, ', @, abn123 ', ab123 '
1
vote
1answer
55 views

What are different type of gamers and how it is helpful for game testing? [closed]

What are the different types of gamers? How can we categorize it? How is it helpful for performing game testing? Sorry to post this question under an irrelevant tag.
1
vote
1answer
33 views

Security policies and procedures [closed]

I am compiling a list of general security policies and procedures at the moment. The following items have been included: Acceptable use - this policy defines what behaviors are acceptable and what ...
6
votes
4answers
419 views

Is security assessment a one-off task?

I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team. He put lots effort in saying "We only need one security assessment, as we need to tick ...
4
votes
1answer
69 views

Should I offer free security tests to my clients?

I have been engaging a client for two months now. They are a major electricity generation and distribution company. For each project, I have got more than enough time to finish my SoapUI test cases ...
5
votes
3answers
884 views

The difference between security audit and security testing

I am a bit confused by security audit and security testing, do they not both test against security holes? What are the differences between them?
-1
votes
1answer
190 views

Best security and performance testing tool as a fresher tester [closed]

What are the best security and performance tool as a fresher tester i should know? I am new to the testing field and my seniors have asked me to learn tools for performance and security testing.
1
vote
1answer
315 views

How simple authentication and Token based authentication differs?

I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the ...
0
votes
2answers
132 views

Security testing tools for android and ios apps [closed]

What are the available security testing tools for Android and iOS apps? Mainly for a passive scan for known vulnerabilities.
0
votes
2answers
88 views

How to analyze the result of vulnerability scanner

I need to do penetration testing, I'm scanning the vulnerability of My Web Application using VEGA tool. I did this using proxy mode set the manual proxy and recorded the actions after login in the ...
1
vote
3answers
198 views

Career focus on single testing skills or multiple? (e.g. Manual, Selenium, Performance and or Security) [closed]

Currently I'm working in Selenium, REST API testing. And our company wants us to do security testing and ethical hacking. I want to know the difference between them, if I take the responsibility of ...
7
votes
3answers
831 views

Ethical Hacking career options for qa professionals

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
2
votes
1answer
57 views

Analytics Platform(AP) + Performance Testing + Need a Open Source tool to Test AP

We Developed a Application, where we can track the Analytics of the Users. Like Installs, Uninstalls, Sessions, Events, Sending Notifications, Large scale of Information where we can Track down the ...
1
vote
1answer
169 views

Penetration testing certificate, Kali Linux certificate?

ISTQB, iSQI, Agile, Scrum certificates are well known to us. I am wondering if there is a security penetration testing certificate? (Certified Ethical Hacker is one example, but I am specifically ...
1
vote
2answers
3k views

Looking for alternative security testing tool like Acunetix?

Is there any tool similar like Acunetix?, because it's really "user-friendly" for me, and I haven't found something similar yet, preferable with a cheaper price. So what I like from Acunetix is clear ...
-2
votes
4answers
181 views

How a Software Tester or Q & A should move ahead in his career [closed]

When one person joins a company as a software tester, the basic skills he contains within himself is Manual Testing. Is it enough for him to sustains for a long period in the company? If not then ...
1
vote
1answer
308 views

How to create an SSL certificate for my demo server and access the client through “https” without any warning in browser [closed]

I'm a QA guy working on a java based web application running on JBoss. The server is running on CentOS 6.6 (bash). When I access the client in a web browser from my PC through "https" (say https://10....
0
votes
1answer
67 views

Do we need a security officer to safeguard security of an application?

Currently I am thinking about how we can improve the focus of security testing and integration it into our development cycle. Now I am wondering, do we need a CSO or Security Officer role? Or is it ...
0
votes
1answer
102 views

What are some Software Testing Attacks that can be used in black box testing? [closed]

If I am doing functional testing of a web application, what are some attacks I can perform on input fields, forms, etc. that can cause the application to crash?
0
votes
1answer
159 views

on-premise SSL/TLS Cert testing tool (100's of sites)

Has anyone found a good way to on-premise test SSL/TLS certs for many (100's) of sites on a regular basis? The usecase is websites setup both internally, and with VPN tunnels to many customers, as ...
0
votes
1answer
468 views

How to change the dashboard title and content in the dashboard page in Jmeter 3.0 generated Dashboard

I want to know how and where to change the dashboard title and other content in jmeter 3.0 generated dashboard
0
votes
2answers
97 views

What is security testing? Please suggest how can I start. Any tools or any methods? [duplicate]

I want to learn security testing. To be candid I have just heard this term and never tried it. Is it beneficial for the product if security testing is done? How can I start? Do organizations value ...
0
votes
2answers
195 views

Top 10 Web Application Security Checks [closed]

What are the Security checks have to be performed while testing the Web Application. Security Plays an very important role. as Web is an POOL with lack of security we have to use our most of our ...
0
votes
1answer
394 views

How to decompile the published ASP.NET web application?

For penetration testing, I am planning to decompile the published source code of ASP.NET web application. This has to done by the QA. But I am struggling to check this. Is there any tool or any ...
3
votes
2answers
518 views

Ideas for testing for Man in the middle attack vulnerabilities?

I am currently looking for ideas to test my application for Man in the middle (MITM) vulnerabilities. I was thinking about using Fiddler or Cain to examine the network traffic to see if a MITM attack ...
1
vote
1answer
649 views

REST Testing for CSRF Enable Website

I want to perform rest testing, like strong text rest client but issue here is website which I am performing testing sets CSRF token in browser in such situation rest client gives 403 error, is there ...
7
votes
3answers
9k views

Is it possible to automate testing involving Two-factor Authentication?

Are there methods for testing 2FA signup or login? I would assume judicious use of dummy phone numbers and/or emails would be involved.
1
vote
1answer
782 views

Security testing - functional or non-functioal, ISO 9126 vs ISO 25010

Some sources, e.g. ISTQB, claim that security testig is a functional one. This would be compliant with ISO 9126 (which the ISTQB is based on) but it goes against most other sources - as far as I know, ...