Introduction to web application security testing
1 like1,513 views
The document outlines the process of web application security testing, emphasizing the necessity of thinking like a hacker and focusing on negative testing. It describes four stages of testing: mapping the application, analyzing its functionality, testing/breaking it, and reporting results, while also suggesting various testing tools for different browsers and comprehensive tools for vulnerability scanning. Overall, it serves as a guide for effectively identifying and addressing security vulnerabilities in web applications.
Introduction to web application security testing
- 1. Introduction to web application security testing Alexandr Romanov
- 2. What is security testing and why it is neccessary?
- 3. Prepare your mind for security testing - Think like a hacker :) - Concentrate on negative testing - Vulnerabilities = bugs
- 4. Security testing in action - stage 1 Mapping the application - web spidering - user directed spidering - brute force scanning
- 5. Security testing in action - stage 2 Analyze the application - application functionality - data entry points - application technologies
- 6. Security testing in action - stage 3 Test/break the application Test: - client-side controls - authentication mechanizm - session management mechanizm - access controls - input-based vulnerabilities .....
- 7. Security testing in action - stage 4 Report the results 1. Exclusive summary 2. Detailed report 3. Raw output
- 8. Security tester tools Firefox: - Firebug/FirePath - HTTPWatch - FoxyProxy - XSSme/SQLme Chrome: - XSSRays IE: - HTTPWatch/IEWatch
- 9. Security tester tools Complex tools: - BurpSuite - WebScarab - Zed Attack Proxy - Fiddler Vulnerability scanners: - Acunetix - Nikto - Nessus