29 votes
Accepted

One of my team members executed security test without any consent

As Yu Zhang has said NEVER perform security tests without consent. There are no exceptions to this rule. You need to make it clear to the team member that senior management would be justified in ...
Kate Paulk's user avatar
  • 31.5k
14 votes

One of my team members executed security test without any consent

Security tests should be only executed with a written customer's consent. Your team member's intention might not have been malicious but due to its highly sensitive nature of software security, all ...
Yu Zhang's user avatar
  • 9,952
11 votes

One of my team members executed security test without any consent

The fact that this thing happened means that there is something wrong in the security testing processes inside your team. At least, there should have been an agreement/consent between both parties - a ...
alecxe's user avatar
  • 11.4k
8 votes

Is security testing the sole responsibility of testers or part of a mixed team?

Most of the data breaches come as a result of human error - social engineering, phishing, etc. I think management should organize security education for everyone. I don't see testers needing to be ...
Mate Mrše's user avatar
  • 4,129
7 votes
Accepted

The difference between security audit and security testing

Differences between security audit and security testing Security audit is performed to look for security weaknesses in a company's security processes and infrastructure, while security testing comes ...
Yu Zhang's user avatar
  • 9,952
7 votes
Accepted

Should I offer free security tests to my clients?

Should I add value to my engagement by doing free security testing? No, you should not and the reason is not about money. Security testings need to always involve your clients' consents, which means ...
Yu Zhang's user avatar
  • 9,952
7 votes
Accepted

How to export fuzzing report from ZAP with request and response?

Currently in OWASP ZAP there is no direct way to export Fuzzer test report with request and response of each request. So, what you can do is, select a record from the Fuzzer tab. Now, you can copy ...
IAmMilinPatel's user avatar
5 votes
Accepted

Is security testing the sole responsibility of testers or part of a mixed team?

All aspects of quality - functional and non-functional testing - should be solved by the whole team. Introducing a wall where developers develop and testers test introduces hand-offs, which increases ...
Thomas Owens's user avatar
  • 1,452
4 votes

Is it possible to automate testing involving Two-factor Authentication?

I found this solution and I think it might be much more useful. You just do the authentication inside your automation: https://dev.to/j_sakamoto/selenium-testing---how-to-sign-in-to-two-factor-...
Doug Noel's user avatar
  • 141
4 votes
Accepted

Top 10 Web Application Security Checks

10 security checks for any web application are as follows - #1 SQL Injection Code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an ...
Ravi Ojha's user avatar
  • 395
4 votes

Ethical Hacking career options for qa professionals

You have a few options if you want to become a security QA. CEH: please bear in mind, CEH council needs you to demonstrate that you have worked in software security industry for a few years otherwise ...
Yu Zhang's user avatar
  • 9,952
4 votes

Is security assessment a one-off task?

how I can convince him that security assessment is not a one-off task? And he should not treat it as simply as a checklist tick? A security assessment is never a one-off task. Any security assessment ...
Yu Zhang's user avatar
  • 9,952
4 votes
Accepted

If we can not catch all of security bugs, why do we still test?

It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks. But the purpose for us to execute ...
Yu Zhang's user avatar
  • 9,952
4 votes

How to do automated SSL server testing?

The first thing that comes to my mind is sslyze. https://github.com/nabla-c0d3/sslyze I use it for penetration testing, in the event that I can't use online SSL-tests like https://www.ssllabs.com/...
Martin Fürholz's user avatar
4 votes

Is there any good browser plugin or tool to quickly identify any security issues of a web site?

Yes for a few things but overall really I feel the answer is no single tool for what you seek. Reviewing security is a manual process because it is is a multi-faceted process. It will frequently ...
Michael Durrant's user avatar
3 votes

Ethical Hacking career options for qa professionals

As a test engineer or QA engineer it is very important to have at least one of the Software testing certifications. This will help to broaden the software testing knowledge, also helpful for testing ...
IAmMilinPatel's user avatar
3 votes
Accepted

Penetration testing certificate, Kali Linux certificate?

After some digging, I have found this one, Offensive Security Certified Professional, please follow this link for more information. OSCP certificate on Wikipedia This certificate offer a certain ...
Yu Zhang's user avatar
  • 9,952
3 votes

Do we need a security officer to safeguard security of an application?

Not really, at least not in this case, but also is not a good thing to place this responsibility to the QA team or to another member of the team, especially if that someone does not have a security ...
lauda's user avatar
  • 977
3 votes

The difference between security audit and security testing

An "audit" by nature implies a third party outside of the functionally responsible party is performing an independent assessment on whatever. So a security audit would be an external party ...
mutt's user avatar
  • 1,693
3 votes

The difference between security audit and security testing

Frequency A security audit is either a one-off or infrequent, but scheduled, event such as annually or quarterly and is often done for compliance with regulations. It may also be required to be ...
Michael Durrant's user avatar
3 votes
Accepted

Is security assessment a one-off task?

Typically, for products that are in the market, security assessment is done using a Secure Development Life-cycle (SDLC). What I do is pretty simple: Annual External Penetration Test using a crowd-...
jruberto's user avatar
  • 1,304
3 votes
Accepted

One question from ISTQB security exam, how to test SQL injection efficiently?

The answer is 3. bbbbb,12345,' This answer is correct, but from equivalent partitioning point of view, it offers two valid inputs, bbbbb and 12345, from valid input partitioning. %, ', @, ...
Yu Zhang's user avatar
  • 9,952
3 votes

Is it really possible to be a Full-Stack QA & if yes then list the technical skills required?

A full stack QA engineer should be skilled in testing Web apps, APIs, performance, Databases, and Mobile. The common skills that are in-demand are: Selenium(Java or C#): For web app API Testing: ...
PDHide's user avatar
  • 11.1k
3 votes

How can one test the security measures or vulnerability when it comes to API testing?

That's a broad question. I recommend taking one or two resources and start exploring from there. You can find some ideas about API testing here and specifically if you ask about security, you can ...
pavelsaman's user avatar
  • 4,548
2 votes

What is security testing? Please suggest how can I start. Any tools or any methods?

There are different types of security testing all with their own path. It could be from actual penetration testing to just risks analysis. From my experience (in the software development world) ...
Niels van Reijmersdal's user avatar
2 votes
Accepted

How to decompile the published ASP.NET web application?

If you have access to the DLLs you can use Reflector. Unless you are accessing the server internally you would not typically have access to the DLLs. If you are doing an internal security audit (...
Paul Muir's user avatar
  • 3,282
2 votes

How to change the dashboard title and content in the dashboard page in Jmeter 3.0 generated Dashboard

To change the title add the following line to user.properties file: jmeter.reportgenerator.report_title=Your desired title You cannot change the content as it is being generated from result files. ...
Dmitri T's user avatar
  • 13.5k
2 votes

What are some Software Testing Attacks that can be used in black box testing?

You should make more clear what you want to know because you mixed two things up. Let me give you some hints. On the one hand you want to know, how to do functional testing, especially black-box ...
Sascha Kretzschmann's user avatar
2 votes

Security testing tools for android and ios apps

Many passive scanners exist to give holistic views of both a device and services running on it. So, while running a scan against a device with the application running and its ports open will give you ...
maznika's user avatar
  • 601
2 votes

Security testing tools for android and ios apps

I don't specifically know any security testing tools for mobile, but I wouldn't rely on them because you won't learn security testing by only using tools. Try to manually test for security ...
return's user avatar
  • 445

Only top scored, non community-wiki answers of a minimum length are eligible