maznika
  • Member for 10 years
  • Last seen more than 4 years ago
  • Seattle, WA
Facebook App testing
5 votes

Mocking up the interaction w/ FB like user246 suggests would probably be the fastest route as far as getting things set up and having full control over your environment. But if you want real ...

View answer
Comparing Sqlite databases
4 votes

If you only need rough precision, the dump method is crude but does get the job done. If you want a lot of precision, I have done a similar task using Python's SQLite module. (http://docs.python....

View answer
How can I spoof HTTP request data while testing?
4 votes

Fiddler is a great (and free) tool for this, like Sam mentioned. It accomplishes a lot for a free app and even has a few features that others don't, like changing your user agent. I do have Fiddler ...

View answer
How to approach the BBST Courses
4 votes

As testerab said above, the course is quite intensive. I have successfully completed it as well and it requires quite a bit of commitment. You work a great deal with a team/group to generate ideas ...

View answer
How to add a script tag to the end of a URL which can be covered as a part of XSS Testing
Accepted answer
3 votes

In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 I would also encourage you to look a bit further than OWASP once you ...

View answer
Any testing resource for security testing of mobile web applications
Accepted answer
3 votes

For the most part mobile web applications behave exactly the same as their counterparts on a desktop. Even if the user input is slightly different, the mobile application is still interfacing with ...

View answer
Is there an easy way to verify all elements of an application have been translated?
3 votes

This is a difficult one because even if you do get a great scenario where you can get all of the copy stripped out, you could still run into encoding issues in the application or several other things ...

View answer
Wireshark capturing WiFi traffic
2 votes

From what it sounds like, you just need to capture traffic. Capturing packets may be more complicated than what you need to do. If you are the source of the traffic, or you know where it is going, ...

View answer
Security testing tools for android and ios apps
2 votes

Many passive scanners exist to give holistic views of both a device and services running on it. So, while running a scan against a device with the application running and its ports open will give you ...

View answer
How to analyze the result of vulnerability scanner
Accepted answer
2 votes

Essentially what Gewure said. The vulnerability you posted an image of is for what is called "command injection". The resulting HTML was because the scanner was able to craft a GET that then returns ...

View answer
Ethical Hacking career options for qa professionals
2 votes

As someone who was in test for 13 years and has transitioned to information security in the last 2 years, I've thought long and hard about all of this. First, as others have already said, ...

View answer
Automated network capture and analysis?
Accepted answer
2 votes

There are a few different solutions off the top of my head. There are several proxies that others have already mentioned that have APIs that can be made to listen on whatever port you need. They may ...

View answer
Is a web application bug found on the Android emulator more likely than not to be a legitimate bug?
2 votes

I have a moderate amount of time spent with the emulator, but rarely use it for testing. My experience has been mostly with games and other performance intensive applications. Many times the ...

View answer
Compare screenshots of rendered web pages
1 votes

I agree with DuncN in many regards. Maybe a proof of concept would be helpful to try out before committing a great deal of time to it? There are paid services that have almost zero setup time and ...

View answer
on-premise SSL/TLS Cert testing tool (100's of sites)
1 votes

I don't know of any tools that do this pre-made. But a loop and a list of your cert files in a shell with openssl installed should do it. To verify the full chain, check out the openssl verify ...

View answer
How to do automated SSL server testing?
1 votes

Both options provided already are quite good and will net you a good amount of information. However, there is also another option to test that should be built into any system with OpenSSL installed (...

View answer
Testing native application of Android and iOS
1 votes

Selenium does function across both of those platforms using different drivers. But only for browser functionality. For Android, there is support for a native automation using a tool very similar to ...

View answer
How do I determine which Android devices to test on so that I get the best coverage?
1 votes

Welcome Habba! This is a very troublesome issue that will likely never go away. And I rather like that, as it keeps the market more interesting. There are several strategies I use in my org to ...

View answer
Protecting credentials in Selenium project
0 votes

Late answer, but better late than never I suppose. A properties file works and can allow you to set authorization, true. Better, would be to set up a secured repository for such credentials that can ...

View answer
Looking for alternative security testing tool like Acunetix?
0 votes

There are open source and free (as in beer) versions of vulnerability scanners. Some of which will perform similar tests to Acunetix. Some of which will only have a subset of those tests. Many of ...

View answer
Attack surface metrics analyzer tool
0 votes

Any of the popular vulnerability scanners will do this for you. None of them are going to apply a particular person's guidelines though. They will use standards agreed upon like CVSS scores, and you'...

View answer