Security testing of web application

Question

I am a manual tester with limited knowledge of how to code. How to approach the security testing of a web site. Are there any good tools/sites/docs/ or classes preferably for security testing where i can learn from them?

• user246: Welcome to SQA, userjain. You might start by searching this site for other questions about security testing.

Answer 1

I would start here: https://www.owasp.org/index.php/Main_Page

Lots of good reading, tools, videos, etc.

Answer 2

Pls find useful links (references) to get started

• http://resources.infosecinstitute.com/net-penetration-testing-test-case-cheat-sheet/
• https://www.pentesterlab.com/exercises/
• http://darkassassinscybercrew.blogspot.in/2013/01/sqlmap-tutorial-for-window-7.html
• http://www.fuzzysecurity.com/tutorials/4.html

Answer 3

There are already a bunch of really good SO/SQA related pages; including tools .

Answer 4

BurpSuite and Fiddler are two important tools for my security testing tasks. Definitely check them out.

As for the approach I have found it is good to find out if your organization is required to allow 3rd party audits and security scans. Make sure your security tests cover these cases first. Then move to the most sensitive areas. Usually anything to do with authentication, sessions, user authorization levels and money transactions are a good place to start. It may be controversial to say this but as far as security goes I feel that the low hanging fruit / obvious exploits are a good place to start. Most attackers will try those first as well.

Answer 5

Another good starting point would be to read up, please see https://www.guru99.com/software-testing.html

Answer 6

Here are some tools I use for penetration testing

https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

https://portswigger.net/burp

https://www.owasp.org/index.php/OWASP_Dependency_Check

https://www.defectdojo.org/

and there is a lot of materials for learning:

https://portswigger.net/web-security

https://www.owasp.org/images/1/19/OTGv4.pdf

https://repo.zenk-security.com/Magazine%20E-book/The%20web%20application%20hackers%20handbook%20finding%20and%20exploiting%20security%20flaws%20-ed2%202011.pdf

Answer 7

Here are some manual test cases written by testers for security verification of website which you can use as a reference. It also contains test cases for wordpress security. By going through it you will able to identify where you need security and why. http://mundrisoft.com/tech-bytes/tips-for-security-testing-of-wordpress-website/

Answer 8

Web application security testing is the process of testing and analyzing, reporting on the security level of a Web application. It is used by Web developers and security administrators to test how secured the web application is using various manual and automated security testing techniques. The main motive is to identify any underline vulnerabilities or threats that can hinder the security or integrity of the Web application. https://www.qasource.com/security-testing-services