29
As Yu Zhang has said NEVER perform security tests without consent. There are no exceptions to this rule.
You need to make it clear to the team member that senior management would be justified in firing him for his reckless actions. For that matter, your customer could choose to take legal action against him including criminal charges.
That said, there are ...
14
Security tests should be only executed with a written customer's consent.
Your team member's intention might not have been malicious but due to its highly sensitive nature of software security, all security related testings must be executed after acquiring a customer's written consent.
In some countries, owning security testing tools is not legal. The ...
11
The fact that this thing happened means that there is something wrong in the security testing processes inside your team. At least, there should have been an agreement/consent between both parties - a team that does the testing and customer itself.
Some of the practical things you can do to prevent this from happening again:
improve education and awareness ...
9
Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests.
If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent ...
7
Differences between security audit and security testing
Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes with more technical focus.
Security audit is testing something that is difficult to be tested directly (do passwords change on a regular basis?), while security ...
5
There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website".
Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...
5
Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible ...
4
Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.
That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security ...
4
I found this solution and I think it might be much more useful. You just do the authentication inside your automation: https://dev.to/j_sakamoto/selenium-testing---how-to-sign-in-to-two-factor-authentication-2joi No outside authenticator is necessary.
For example in Java:
import org.jboss.aerogear.security.otp.Totp;
...
String otpKeyStr = "...
4
I tested credit provider gateways and implementations for years, so I can give a few suggestions:
Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway:
Data transmitted to the gateway is sent over a secured channel (https or some other secure means)
Data logged does not include ...
4
10 security checks for any web application are as follows -
#1 SQL Injection
Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).
#2 Broken authentication and session management
Authentication and session ...
4
You have a few options if you want to become a security QA.
CEH: please bear in mind, CEH council needs you to demonstrate that you have worked in software security industry for a few years otherwise you will have to attend their training course.
ISTQB security tester certificate.
Kali Linux certificate.
As a test engineer or QA engineer it is very ...
4
how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?
A security assessment is never a one-off task. Any security assessment is nothing but a screenshot of an ever-changing process. Saying one security assessment is enough is like to say watching a frame of a film is as good as ...
4
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.
The purposes are:
Identify risks and evaluate the effectiveness of existing ...
4
The first thing that comes to my mind is sslyze.
https://github.com/nabla-c0d3/sslyze
I use it for penetration testing, in the event that I can't use online SSL-tests like https://www.ssllabs.com/ssltest/index.html, because the test-site can only be reached over a proxy server.
It has a GPLv2-license and the source code can be downloaded from above link. ...
4
Yes for a few things but overall really I feel the answer is no single tool for what you seek.
Reviewing security is a manual process because it is is a multi-faceted process. It will frequently involve using various tools but there is not an overarching tool you can use to simply run a security report that I am aware of.
Also, if such a tool exists it ...
3
Try reading https://security.stackexchange.com/. It is described as "a question and answer site for Information security professionals".
3
ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.
3
Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this:
http://www.example.com.:80
Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. (...
3
In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.
3
As a tester part of your job is to provide information and to advise others (BAs, Developers, Managers etc.) about the state of the system and any potential risks. With this in mind, what I'd do in your situation is to research examples of this problem and the potential effects. To appear more credible you could outline best case scenarios (e.g. distribution ...
3
Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.
3
As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing employees to get the promotion in their respective field in large MNC’s.
This is merely a myth. Most certifications out there don't really help you learn ...
3
An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party doing that. Security testing could be for development/penetration/boundary/audit/etc...
In general, I would hope that the security testing performed is ...
3
Frequency
A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be performed by a different group than those who write the software and the security tests that go with it.
Security testing is a constant on-going practice, ideally ...
3
Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC).
What I do is pretty simple:
Annual External Penetration Test using a crowd-sourced security
testing service.
Weekly static and dynamic scans on the code
Security analysts review new user stories for security impact
Your client may ...
3
The answer is 3.
bbbbb,12345,'
This answer is correct, but from equivalent partitioning point of view, it offers two valid inputs, bbbbb and 12345, from valid input partitioning.
%, ', @, abn123
This answer has three valid inputs from valid input partitioning.
', 123
This answer has one valid input and one escape character.
'
This answer ...
3
A full stack QA engineer should be skilled in testing Web apps, APIs, performance, Databases, and Mobile.
The common skills that are in-demand are:
Selenium(Java or C#): For web app
API Testing: Postman
Performance: Jmeter
DBtesting : DBUnit , Database Benchmark
Mobile: Testcomplete, Appium
These are not listed out from blue, but from the job ...
3
That's a broad question. I recommend taking one or two resources and start exploring from there. You can find some ideas about API testing here and specifically if you ask about security, you can focus on OWASP API security
In general, some ideas relating to security:
authentication: what endpoints could be used only when authenticated? are there some that ...
2
You could implement your own version of minset that would be useful to anyone that uses gcov/lcov or, with a small modification, also to users of other code coverage measuring tools.
Export gcov/lcov report to some processable format, e.g. XML. The report should
describe coverage per method/class/package (granularity is up to you) for each test you ...
Only top voted, non community-wiki answers of a minimum length are eligible