29
As Yu Zhang has said NEVER perform security tests without consent. There are no exceptions to this rule.
You need to make it clear to the team member that senior management would be justified in firing him for his reckless actions. For that matter, your customer could choose to take legal action against him including criminal charges.
That said, there are ...
14
Security tests should be only executed with a written customer's consent.
Your team member's intention might not have been malicious but due to its highly sensitive nature of software security, all security related testings must be executed after acquiring a customer's written consent.
In some countries, owning security testing tools is not legal. The ...
11
Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
And generally I would advise browsing the site to learn more about security
Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/
11
The fact that this thing happened means that there is something wrong in the security testing processes inside your team. At least, there should have been an agreement/consent between both parties - a team that does the testing and customer itself.
Some of the practical things you can do to prevent this from happening again:
improve education and awareness ...
8
Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS.
Prevention is the best defense. The best first line of defense is to integrate security into your software ...
8
I've used a couple of solutions for this in the past. Both Acunetix and IBM Rational AppScan will test for Reflected, Stored, and DOM based Cross Site Scripting. Both applications will provide you all relevant information including request, response, potential impact, etc. AppScan will actually provide a screen shot from what I can remember. Both will ...
8
Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not?
Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow?
Your BA approved this. Did she say why it should be permitted?
What happens in your portal when an ...
8
Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests.
If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent ...
7
Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;).
However there are still various options available to you.
One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the '...
7
Welkome Ashok. I think that you need to be very careful with this.
Security testing is a field that you REALLY, REALLY need to know what you are testing for.
Security testing does not simply mean "point a tool at a site and get the results"
If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking ...
6
I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing.
Network security testing is typically related to network ...
6
Differences between security audit and security testing
Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes with more technical focus.
Security audit is testing something that is difficult to be tested directly (do passwords change on a regular basis?), while security ...
5
There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website".
Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...
5
Injection Attacks can be thought of as a generalized version of SQL Injection Attacks.
Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack.
Consider what kinds of escape characters, improper type handling, etc could make their ...
4
If you are hoping to find the vulnerabilities through an automate scan
Open the application, click "Start New Scan", enter the address, and then start scan.
Please note, the community edition will really only find low hanging fruit. Anything more difficult requires a subscription.
If you're hoping to do some manual testing for injection vulnerabilities, ...
4
I think much like any new application, once you get it up and running walk through any demos that may be provided. If there are forums you might want to look at those as well. Clearly as their site indicates as you are working with it be sure you are only doing it against a site that you are authorized to perform that sort of penetration testing on.
4
I would start here: https://www.owasp.org/index.php/Main_Page
Lots of good reading, tools, videos, etc.
4
I tested credit provider gateways and implementations for years, so I can give a few suggestions:
Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway:
Data transmitted to the gateway is sent over a secured channel (https or some other secure means)
Data logged does not include ...
4
10 security checks for any web application are as follows -
#1 SQL Injection
Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).
#2 Broken authentication and session management
Authentication and session ...
4
You have a few options if you want to become a security QA.
CEH: please bear in mind, CEH council needs you to demonstrate that you have worked in software security industry for a few years otherwise you will have to attend their training course.
ISTQB security tester certificate.
Kali Linux certificate.
As a test engineer or QA engineer it is very ...
4
Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible ...
4
how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick?
A security assessment is never a one-off task. Any security assessment is nothing but a screenshot of an ever-changing process. Saying one security assessment is enough is like to say watching a frame of a film is as good as ...
4
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.
The purposes are:
Identify risks and evaluate the effectiveness of existing ...
4
The first thing that comes to my mind is sslyze.
https://github.com/nabla-c0d3/sslyze
I use it for penetration testing, in the event that I can't use online SSL-tests like https://www.ssllabs.com/ssltest/index.html, because the test-site can only be reached over a proxy server.
It has a GPLv2-license and the source code can be downloaded from above link. ...
4
Yes for a few things but overall really I feel the answer is no single tool for what you seek.
Reviewing security is a manual process because it is is a multi-faceted process. It will frequently involve using various tools but there is not an overarching tool you can use to simply run a security report that I am aware of.
Also, if such a tool exists it ...
3
Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this:
http://www.example.com.:80
Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. (...
3
Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.
That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security ...
3
Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com.
For example, most vulnerabilities in many common web-applications (e.g. WordPress, osCommerce, Joomla) are/were because folders were left write-enabled and/or file-...
3
In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.
3
For the most part mobile web applications behave exactly the same as their counterparts on a desktop. Even if the user input is slightly different, the mobile application is still interfacing with the device running it in a similar fashion, sending along similar protocols and being interpreted on the back end is as well (likely). If information is being ...
Only top voted, non community-wiki answers of a minimum length are eligible
