Questions tagged [security-testing]

Security testing is a process to determine that an information system protects data and maintains functionality as intended.

Filter by
Sorted by
Tagged with
23
votes
8answers
691 views

Security testing resources

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...
5
votes
4answers
449 views

Is it really possible to be a Full-Stack QA & if yes then list the technical skills required?

Everyone needs an all-rounder whether it is a software developer or Tester these days. Hence we are hearing the term “Full Stack QA” these days so my question is what skill-set makes a Full Stack QA &...
-2
votes
1answer
88 views

OWASP ZAP integration into SOAPUI for REST API Testing

One of the topics I am currently working on is the testing of APIs on the security level, e.g. as integration in SOAPUI and OWASP in WSO2. The integration of SOAPUI and WSO2 is set up and also works. ...
-1
votes
1answer
38 views

Can I make test cases for web application security testing?

We have been performing application security testing based on OWASP standards. We use JIRA to report the bugs or improvements. However, is there any way where we can make a generic test case for these ...
9
votes
7answers
336 views

Security testing of web application

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools/sites/docs/ or classes preferably for security testing where i ...
6
votes
3answers
1k views

The difference between security audit and security testing

I am a bit confused by security audit and security testing, do they not both test against security holes? What are the differences between them?
2
votes
1answer
636 views

How to test oAuth Authentication?

We are making a mobile application that will be communicating with the backend, which also we are building. Authorization of users and application itself with the backend is going to be made using ...
0
votes
1answer
53 views

Security Testing for brute force attacks on login page

I want to perform testing for brute force attacks on login page of a website. I am new to security testing and I think i can test this by multiple failed login attempts. I wrote the below code to test ...
0
votes
1answer
79 views

How to test SSO integration?

I am doing QA for a website, and they have recently added SSO integration for their website. How can I manually test that this SSO integration is working fine. Also I need to automate the testing ...
3
votes
1answer
155 views

Is there any good browser plugin or tool to quickly identify any security issues of a web site?

I'm working on a web project and need to give a quick update on how the security of the web site. So is there any tool or browser plugin to do a quick scan for my web project and get an analysis ...
1
vote
0answers
70 views

Which penetration test tools can be used in the agile and CI environment?

since I have different projects, with different development environments, it is of course important for me which penetration tools I use. The projects: Project 1 is a pure web project which is only ...
0
votes
1answer
52 views

How to plan penetration testing in agile development?

Of course, as is well known, we plan of course Unit Test (in my case Junit) in the sprint, we have with QfS a GUI / Acceptance Test Framework which we plan accordingly in the sprint. The question but ...
7
votes
3answers
12k views

Is it possible to automate testing involving Two-factor Authentication?

Are there methods for testing 2FA signup or login? I would assume judicious use of dummy phone numbers and/or emails would be involved.
0
votes
0answers
17 views

Is there a method to perform sql inject for prepared statements?

I've been trying to learn sql injection and tried perform on a site that we developed. Following code is sample code taken from internet. I want to know is there a way to do sql injection even on a ...
3
votes
2answers
137 views

Want to move to testing after having almost 7 years of development experience

I am having almost 7 years of experience as a developer and would like to know if I can move to testing without having any experience in it except for Unit testing ofcourse. My reasons for moving to ...
1
vote
0answers
33 views

Is there any Mobile app Security Testing tool which uses a server-agent configuration instead of using proxy for intercepting requests?

I want to perform the security testing of a mobile app. I am using ZAP for Testing Web application. For testing web application, we no longer need to use a proxy, but for mobile application, proxy ...
0
votes
1answer
30 views

Which files should I validate on an image upload feature?

I'm curious which files I should be checking for on a typical image upload feature. This particular one I'm testing is for a profile picture. Things I'm already checking for: Image file size (e.g. &...
4
votes
2answers
751 views

Open source security testing tool faster than Zed Attack Proxy?

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow. I am looking for an open source tool that will be faster and ...
0
votes
1answer
76 views

Security Standards Compliance testing library with Selenium

I've been using Selenium for awhile and I know many testers have compiled lists of standard security compliance types of tests to perform, like are listed here These fall into a list of tests that ...
12
votes
4answers
35k views

Automation and bypassing Google No CAPTCHA reCAPTCHA

My client want to use Google's No CAPTCHA reCAPTCHA (NCRC) to prevent robots completing an application. QA have automated this process, but if the business introduce NCRC into the form, then this ...
4
votes
3answers
151 views

As an outsourced SQA Testing provider: how would you estimate the workload (an therefore the costs) for testing your client's next project?

Let's say you are in charge of an SQA & Testing company that offers outsourced testing services to other companies that develop software. Let's say you offer 4 general types of testing: ...
1
vote
1answer
74 views

Why does it take a long time to spider an application?

Is it normal to take 10mins for bdd-security to spider an application? And should the spidering be done after log in or before login? Basically we have a web application on which we need to do the ...
0
votes
1answer
103 views

What are some Software Testing Attacks that can be used in black box testing? [closed]

If I am doing functional testing of a web application, what are some attacks I can perform on input fields, forms, etc. that can cause the application to crash?
1
vote
3answers
565 views

How to do automated SSL server testing?

I want to do automated SSL server testing. Like what Qualys, Inc is offering with SSL Server Test but running fully automated in a build environment like TeamCity or Jenkins. Does anybody know tools/...
6
votes
4answers
424 views

Is security assessment a one-off task?

I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team. He put lots effort in saying "We only need one security assessment, as we need to tick ...
0
votes
2answers
593 views

How to Test security of the android mobile application

I am new to testing the security of applications. I know basic security like invalid credentials but I don't know about mobile app security testing Please let me know how to check?
0
votes
1answer
44 views

Security test for .net desktop application: upload a file (shell) to check how software behaves

I am looking for a most common injection file (shell) to import my software to check if it is open to these kind of attacks or not. Any recommendation, web sites or blogs? (summary: i will upload ...
0
votes
1answer
198 views

on-premise SSL/TLS Cert testing tool (100's of sites)

Has anyone found a good way to on-premise test SSL/TLS certs for many (100's) of sites on a regular basis? The usecase is websites setup both internally, and with VPN tunnels to many customers, as ...
0
votes
2answers
138 views

Security testing tools for android and ios apps [closed]

What are the available security testing tools for Android and iOS apps? Mainly for a passive scan for known vulnerabilities.
2
votes
1answer
68 views

How can someone prevent to become a victim of social engineering? [closed]

There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information. ...
21
votes
4answers
7k views

One of my team members executed security test without any consent

One of my team members, when deployed at a customer's site, executed a password attack against the customer's database. As a result, this customer's database was locked down for 30 minutes. Now ...
4
votes
5answers
806 views

Best Opensource Tool available for Security Testing of Web applications

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I wants to use an open source tool. There are many type of vulnerabilities like Cross Site ...
9
votes
2answers
2k views

How to use soapUI for Boundary Scan security tests?

I've tried to use soapUI to set up a Boundary Scan security test, using the sample wsdl provided in the soapUI tutorial. I changed it so that it has a restriction on the username field for the ...
1
vote
1answer
381 views

How simple authentication and Token based authentication differs?

I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the ...
1
vote
1answer
534 views

Are OWASP security standards applicable for desktop applications?

I am looking for some tools to help me with security test on a desktop application, but I haven't figured it out yet. Any help will be highly appreciated.
2
votes
2answers
82 views

If we can not catch all of security bugs, why do we still test?

Someone asked me a question next to water cooler: It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests? I was speechless, could not provide any ...
1
vote
1answer
132 views

One question from ISTQB security exam, how to test SQL injection efficiently?

If we are to use equivalent partitioning technique, which one of the following answers is the most efficient to test against SQL injection? bbbbb,12345,' %, ', @, abn123 ', ab123 '
1
vote
1answer
55 views

What are different type of gamers and how it is helpful for game testing? [closed]

What are the different types of gamers? How can we categorize it? How is it helpful for performing game testing? Sorry to post this question under an irrelevant tag.
1
vote
1answer
35 views

Security policies and procedures [closed]

I am compiling a list of general security policies and procedures at the moment. The following items have been included: Acceptable use - this policy defines what behaviors are acceptable and what ...
4
votes
1answer
70 views

Should I offer free security tests to my clients?

I have been engaging a client for two months now. They are a major electricity generation and distribution company. For each project, I have got more than enough time to finish my SoapUI test cases ...
-1
votes
1answer
197 views

Best security and performance testing tool as a fresher tester [closed]

What are the best security and performance tool as a fresher tester i should know? I am new to the testing field and my seniors have asked me to learn tools for performance and security testing.
1
vote
2answers
3k views

Looking for alternative security testing tool like Acunetix?

Is there any tool similar like Acunetix?, because it's really "user-friendly" for me, and I haven't found something similar yet, preferable with a cheaper price. So what I like from Acunetix is clear ...
0
votes
2answers
93 views

How to analyze the result of vulnerability scanner

I need to do penetration testing, I'm scanning the vulnerability of My Web Application using VEGA tool. I did this using proxy mode set the manual proxy and recorded the actions after login in the ...
1
vote
3answers
199 views

Career focus on single testing skills or multiple? (e.g. Manual, Selenium, Performance and or Security) [closed]

Currently I'm working in Selenium, REST API testing. And our company wants us to do security testing and ethical hacking. I want to know the difference between them, if I take the responsibility of ...
3
votes
1answer
118 views

Attack surface metrics analyzer tool [closed]

I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics. I found Microsoft surface ...
2
votes
1answer
57 views

Analytics Platform(AP) + Performance Testing + Need a Open Source tool to Test AP

We Developed a Application, where we can track the Analytics of the Users. Like Installs, Uninstalls, Sessions, Events, Sending Notifications, Large scale of Information where we can Track down the ...
7
votes
3answers
929 views

Ethical Hacking career options for qa professionals

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
9
votes
5answers
4k views

How to plan security testing of a web application?

Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security. ...
1
vote
1answer
181 views

Penetration testing certificate, Kali Linux certificate?

ISTQB, iSQI, Agile, Scrum certificates are well known to us. I am wondering if there is a security penetration testing certificate? (Certified Ethical Hacker is one example, but I am specifically ...
-2
votes
4answers
181 views

How a Software Tester or Q & A should move ahead in his career [closed]

When one person joins a company as a software tester, the basic skills he contains within himself is Manual Testing. Is it enough for him to sustains for a long period in the company? If not then ...