Questions tagged [security-testing]

Security testing is a process to determine that an information system protects data and maintains functionality as intended.

Filter by
Sorted by
Tagged with
23
votes
8answers
691 views

Security testing resources

Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. ...
21
votes
4answers
7k views

One of my team members executed security test without any consent

One of my team members, when deployed at a customer's site, executed a password attack against the customer's database. As a result, this customer's database was locked down for 30 minutes. Now ...
16
votes
4answers
9k views

How do I test an application for SQL injections?

I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on ...
15
votes
4answers
1k views

XSS/CSRF security testing

I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, ...
15
votes
3answers
9k views

What are some tools for fuzz testing?

Fuzz Testing as defined by Wikipedia is: a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer ...
12
votes
4answers
35k views

Automation and bypassing Google No CAPTCHA reCAPTCHA

My client want to use Google's No CAPTCHA reCAPTCHA (NCRC) to prevent robots completing an application. QA have automated this process, but if the business introduce NCRC into the form, then this ...
11
votes
3answers
2k views

Is there a successful approach to automating security testing?

My team uses a security testing tool called Burp Suite. We currently try to manually run it once a release. One of my tasks is to determine if/how we can make that into more of an automated process. ...
10
votes
2answers
20k views

What tools do you use to test for XSS injections?

What tools would you recommend to use for testing for XSS injections? Apparently, what I need is a tool that can find all the places in the HTTP request where inputs are possible (including data ...
9
votes
5answers
4k views

How to plan security testing of a web application?

Security testing requires thinking out of the box, it noes not have clear test cases, and it is not repeatable, meaning running same set of actions over and over again will never assure security. ...
9
votes
7answers
336 views

Security testing of web application

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools/sites/docs/ or classes preferably for security testing where i ...
9
votes
2answers
2k views

How to use soapUI for Boundary Scan security tests?

I've tried to use soapUI to set up a Boundary Scan security test, using the sample wsdl provided in the soapUI tutorial. I changed it so that it has a restriction on the username field for the ...
8
votes
1answer
701 views

Open source web security testing tools

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd ...
8
votes
3answers
4k views

Abuse cases and misuse cases

Are abuse cases and misuse cases for security the same? From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same. Please clarify my doubt.
7
votes
3answers
929 views

Ethical Hacking career options for qa professionals

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
7
votes
3answers
12k views

Is it possible to automate testing involving Two-factor Authentication?

Are there methods for testing 2FA signup or login? I would assume judicious use of dummy phone numbers and/or emails would be involved.
6
votes
3answers
1k views

The difference between security audit and security testing

I am a bit confused by security audit and security testing, do they not both test against security holes? What are the differences between them?
6
votes
4answers
424 views

Is security assessment a one-off task?

I visited a client today. The manager I was talking to wanted me to perform a security assessment for his team. He put lots effort in saying "We only need one security assessment, as we need to tick ...
6
votes
2answers
481 views

Tool to minimize tests number and maximize code coverage

I am currently undergoing black-box testing campaigns for applications that require file input in linux environments. For that I need sets of test files of different formats that can be used to be ...
5
votes
2answers
215 views

Does adding the port number to a URL redirect pose a Security risk?

I am testing a new version of a web site and when requesting the site URL it redirects to a URL with the port number 80 appended to it, for example requesting www.example.com redirects to www.example....
5
votes
2answers
203 views

Testing Paradigms for Network Security

In software engineering, I am familiar with some basic, often-overlapping types of testing, for example: unit testing functional / use-case testing alpha / beta testing branch / boundary testing ...
5
votes
2answers
566 views

Netsparker community edition: how to start with it?

I like to do SQL injection security testing. So I installed Netsparker (community edition 1.7). If any one have used this application to test SQL injection an web applications, then please tell me the ...
5
votes
4answers
453 views

Is it really possible to be a Full-Stack QA & if yes then list the technical skills required?

Everyone needs an all-rounder whether it is a software developer or Tester these days. Hence we are hearing the term “Full Stack QA” these days so my question is what skill-set makes a Full Stack QA &...
4
votes
2answers
751 views

Open source security testing tool faster than Zed Attack Proxy?

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow. I am looking for an open source tool that will be faster and ...
4
votes
2answers
2k views

How do I test injection attacks similar to SQL injection for non sql solutions, or do I?

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that ...
4
votes
1answer
70 views

Should I offer free security tests to my clients?

I have been engaging a client for two months now. They are a major electricity generation and distribution company. For each project, I have got more than enough time to finish my SoapUI test cases ...
4
votes
3answers
151 views

As an outsourced SQA Testing provider: how would you estimate the workload (an therefore the costs) for testing your client's next project?

Let's say you are in charge of an SQA & Testing company that offers outsourced testing services to other companies that develop software. Let's say you offer 4 general types of testing: ...
4
votes
5answers
806 views

Best Opensource Tool available for Security Testing of Web applications

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I wants to use an open source tool. There are many type of vulnerabilities like Cross Site ...
4
votes
2answers
100 views

What's the name of the technique for getting data from a web application you aren't supposed to get?

This question is about getting the name of a testing concept. For example, say you have a REST route which requires that you be logged in. When you call that route and provide the ID of another user ...
3
votes
1answer
155 views

Is there any good browser plugin or tool to quickly identify any security issues of a web site?

I'm working on a web project and need to give a quick update on how the security of the web site. So is there any tool or browser plugin to do a quick scan for my web project and get an analysis ...
3
votes
2answers
554 views

Ideas for testing for Man in the middle attack vulnerabilities?

I am currently looking for ideas to test my application for Man in the middle (MITM) vulnerabilities. I was thinking about using Fiddler or Cain to examine the network traffic to see if a MITM attack ...
3
votes
3answers
279 views

Mobile app security testing

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider ...
3
votes
1answer
160 views

Any testing resource for security testing of mobile web applications

i have gone through the following question security sources and found testing resources for testing desktop and web applications, any realtime resource to test an mobile web applications?
3
votes
2answers
137 views

Want to move to testing after having almost 7 years of development experience

I am having almost 7 years of experience as a developer and would like to know if I can move to testing without having any experience in it except for Unit testing ofcourse. My reasons for moving to ...
3
votes
1answer
118 views

Attack surface metrics analyzer tool [closed]

I am trying to find a tool to measure vulnerability into my application ( each entry point and exit point into my application ) and then apply it to Manadhata's metrics. I found Microsoft surface ...
3
votes
2answers
499 views

Ways to test Web Service security by IP filtering?

As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if ...
2
votes
5answers
189 views

How to convince BA that her software requirement may cause problems?

In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I ...
2
votes
2answers
82 views

If we can not catch all of security bugs, why do we still test?

Someone asked me a question next to water cooler: It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests? I was speechless, could not provide any ...
2
votes
2answers
10k views

Payment gateways checklist

I am now working on payment gateway testing - manual testing- this project has many payments gateways, like credit card and other payments providers like Paypal is there any kind of check list I ...
2
votes
3answers
6k views

How to add a script tag to the end of a URL which can be covered as a part of XSS Testing

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either ...
2
votes
2answers
195 views

What methods do you use to analyze / define attack surface for a software?

It is good to define an attack surface before security testing. Different places to attack: Open pages & services (like login) Attack to underlying layers/servers/etc Attack to other users ... ...
2
votes
2answers
74 views

How can I learn more about desktop software security and testing?

I am looking for some good resources that I can use to improve my security testing skills, or just even my security analysis skills. Desktop client applications are the main target for this question.
2
votes
1answer
68 views

How can someone prevent to become a victim of social engineering? [closed]

There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information. ...
2
votes
1answer
636 views

How to test oAuth Authentication?

We are making a mobile application that will be communicating with the backend, which also we are building. Authorization of users and application itself with the backend is going to be made using ...
2
votes
1answer
57 views

Analytics Platform(AP) + Performance Testing + Need a Open Source tool to Test AP

We Developed a Application, where we can track the Analytics of the Users. Like Installs, Uninstalls, Sessions, Events, Sending Notifications, Large scale of Information where we can Track down the ...
2
votes
2answers
182 views

How to load test a very complex, security heavy application?

Testing can sometimes get tricky. Especially when the application is very complex. I am currently working on a project and I have no idea how to test this. I work a lot with CMS based websites and ...
2
votes
2answers
109 views

Security issues in websites-Automation Testing

What kind of security issue or point should be consider during automation testing, which are the most prominent area of an website should be considered for security point of view, also comment in ...
1
vote
3answers
566 views

How to do automated SSL server testing?

I want to do automated SSL server testing. Like what Qualys, Inc is offering with SSL Server Test but running fully automated in a build environment like TeamCity or Jenkins. Does anybody know tools/...
1
vote
3answers
199 views

Career focus on single testing skills or multiple? (e.g. Manual, Selenium, Performance and or Security) [closed]

Currently I'm working in Selenium, REST API testing. And our company wants us to do security testing and ethical hacking. I want to know the difference between them, if I take the responsibility of ...
1
vote
1answer
820 views

Security testing - functional or non-functioal, ISO 9126 vs ISO 25010

Some sources, e.g. ISTQB, claim that security testig is a functional one. This would be compliant with ISO 9126 (which the ISTQB is based on) but it goes against most other sources - as far as I know, ...
1
vote
1answer
74 views

Why does it take a long time to spider an application?

Is it normal to take 10mins for bdd-security to spider an application? And should the spidering be done after log in or before login? Basically we have a web application on which we need to do the ...