How to Test Application Security – Web and Desktop Application Security Testing Techniques

Need of Security Testing?

Software industry has achieved a solid recognition in this age. In the recent decade, however, cyber-world seems to be even more dominating and driving force which is shaping up the new forms of almost every business. Web based ERP systems used today are the best evidence that IT has revolutionized our beloved global village.

These days, websites are not meant only for publicity or marketing but these have been evolved into the stronger tools to cater complete business needs. Web based Payroll systems, Shopping Malls, Banking, Stock Trade application are not only being used by organizations but are also being sold as products today.

This means that online applications have gained the trust of customers and users regarding their vital feature named as SECURITY. No doubt, the security factor is of primary value for desktop applications too. However, when we talk about web, importance of security increases exponentially. If an online system cannot protect the transaction data, no one will ever think of using it. Security is neither a word in search of its definition yet, nor is it a subtle concept. However, I would like to list some complements of security.

Security Testing

Examples of security flaws in an application:

1) A Student Management System is insecure if ‘Admission’ branch can edit the data of ‘Exam’ branch
2) An ERP system is not secure if DEO (data entry operator) can generate ‘Reports’
3) An online Shopping Mall has no security if customer’s Credit Card Detail is not encrypted
4) A custom software possess inadequate security if an SQL query retrieves actual passwords of its users

Security Testing Definition:
Now, I present you a simplest definition of Security in my own words. “Security means that authorized access is granted to protected data and unauthorized access is restricted”. So, it has two major aspects; first is protection of data and second one is access to that data. Moreover, whether the application is desktop or web based, security revolves around the two aforementioned aspects. Let us have an overview of security aspects for both desktop and web based software applications.

Desktop and Web Security Testing:
A desktop application should be secure not only regarding its access but also with respect to organization and storage of its data. Similarly, a web application demands even more security with respect to its access, along with data protection. Web developer should make the application immune to SQL Injections, Brute Force Attacks and XSS (cross site scripting). Similarly, if the web application facilitates remote access points then these must be secure too. Moreover, keep in mind that Brute Force Attack is not only related to web applications, desktop software is also vulnerable to this.

I hope this foreword is enough and now let me come to the point. Kindly accept my apology if you so far thought that you are reading about the subject of this article. Though I have briefly explained software Security and its major concerns, but my topic is ‘Security Testing’. In order to know further details of security aspects, kindly refer to – Web application security testing article.

I will now explain how the features of security are implemented in software application and how should these be tested. My focus will be on Whats and Hows of security testing, not of security.

Security Testing Techniques:

1) Access to Application:

Whether it is a desktop application of website, access security is implemented by ‘Roles and Rights Management’. It is often done implicitly while covering functionality, e.g.in a Hospital Management System a receptionist is least concerned about the laboratory tests as his job is to just register the patients and schedule their appointments with doctors. So, all the menus, forms and screen related to lab tests will not be available to the Role of ‘Receptionist’. Hence, the proper implementation of roles and rights will guarantee the security of access.

How to Test: In order to test this, thorough testing of all roles and rights should be performed. Tester should create several user accounts with different as well multiple roles. Then he should use the application with the help of these accounts and should verify that every role has access to its own modules, screens, forms and menus only. If tester finds any conflict, he should log a security issue with complete confidence.

2. Data Protection:

There are further three aspects of data security. First one is that a user can view or utilize only the data which he is supposed to use. This is also ensured by roles and rights e.g. a TSR (telesales representative) of a company can view the data of available stock, but cannot see how much raw material was purchased for production.

So, testing of this aspect is already explained above. The second aspect of data protection is related to how that data is stored in the DB. All the sensitive data must be encrypted to make it secure. Encryption should be strong especially for sensitive data like passwords of user accounts, credit card numbers or other business critical information. Third and last aspect is extension of this second aspect. Proper security measures must be adopted when flow of sensitive or business critical data occurs. Whether this data floats between different modules of same application, or is transmitted to different applications it must be encrypted to make it safe.

How to Test Data Protection: The tester should query the database for ‘passwords’ of user account, billing information of clients, other business critical and sensitive data and should verify that all such data is saved in encrypted form in the DB. Similarly (s)he must verify that between different forms or screens, data is transmitted after proper encryption. Moreover, tester should ensure that the encrypted data is properly decrypted at the destination. Special attention should be paid on different ‘submit’ actions. The tester must verify that when the information is being transmitted between client and server, it is not displayed in the address bar of web browser in understandable format. If any of these verifications fail, the application definitely has security flaw.

3. Brute-Force Attack:

Brute Force Attack is mostly done by some software tools. The concept is that using a valid user ID, software attempts to guess the associated password by trying to login again and again. A simple example of security against such attack is account suspension for a short period of time as all the mailing applications like ‘Yahoo’ and ‘Hotmail’ do. If, a specific number of consecutive attempts (mostly 3) fail to login successfully, then that account is blocked for some time (30 minutes to 24 hrs).

------------

How to test Brute-Force Attack: The tester must verify that some mechanism of account suspension is available and is working accurately. (S)He must attempt to login with invalid user IDs and Passwords alternatively to make sure that software application blocks the accounts that continuously attempt login with invalid information. If the application is doing so, it is secure against brute-force attack. Otherwise, this security vulnerability must be reported by the tester.

The above three security aspects should be taken into account for both web and desktop applications while, the following points are related with web based applications only.

4. SQL Injection and XSS (cross site scripting):

Conceptually speaking, the theme of both these hacking attempts is similar, so these are discussed together. In this approach, malicious script is used by the hackers in order to manipulate a website. There are several ways to immune against such attempts. For all input fields of the website, field lengths should be defined small enough to restrict input of any script e.g. Last Name should have field length 30 instead of 255. There may be some input fields where large data input is necessary, for such fields proper validation of input should be performed prior to saving that data in the application. Moreover, in such fields any html tags or script tag input must be prohibited. In order to provoke XSS attacks, the application should discard script redirects from unknown or untrusted applications.

How to test SQL Injection and XSS: Tester must ensure that maximum lengths of all input fields are defined and implemented. (S)He should also ensure that defined length of input fields does not accommodate any script input as well as tag input. Both these can be easily tested e.g. if 20 is the maximum length specified for ‘Name’ field; and input string “<p>thequickbrownfoxjumpsoverthelazydog” can verify both these constraints. It should also be verified by the tester that application does not support anonymous access methods. In case any of these vulnerabilities exists, the application is in danger.

5. Service Access Points (Sealed and Secure Open)

Today, businesses depend and collaborate with each other, same holds good for applications especially websites. In such case, both the collaborators should define and publish some access points for each other. So far the scenario seems quite simple and straightforward but, for some web based product like stock trading, things are not so simple and easy. When there is large number of target audience, the access points should be open enough to facilitate all users, accommodating enough to fulfill all users’ requests and secure enough to cope with any security-trial.

How to Test Service Access Points: Let me explain it with the example of stock trading web application; an investor (who wants to purchase the shares) should have access to current and historical data of stock prices. User should be given the facility to download this historical data. This demands that application should be open enough. By accommodating and secure, I mean that application should facilitate investors to trade freely (under the legislative regulations). They may purchase or sale 24/7 and the data of transactions must be immune to any hacking attack. Moreover, a large number of users will be interacting with application simultaneously, so the application should provide enough number access point to entertain all the users.

In some cases these access points can be sealed for unwanted applications or people. This depends upon the business domain of application and its users, e.g. a custom web based Office Management System may recognize its users on the basis of IP Addresses and denies to establish a connection with all other systems (applications) that do not lie in the range of valid IPs for that application.

Tester must ensure that all the inter-network and intra-network access to the application is from trusted applications, machines (IPs) and users. In order to verify that an open access point is secure enough, tester must try to access it from different machines having both trusted and untrusted IP addresses. Different sort of real-time transactions should be tried in a bulk to have a good confidence of application’s performance.  By doing so, the capacity of access points of the application will also be observed clearly.

Tester must ensure that the application entertains all the communication requests from trusted IPs and applications only while all the other request are rejected. Similarly, if the application has some open access point, then tester should ensure that it allows (if required) uploading of data by users in secure way. By this secure way I mean, the file size limit, file type restriction and scanning of uploaded file for viruses or other security threats. This is all how a tester can verify the security of an application with respect to its access points.

If you enjoy reading this article please make sure to share it with your friends. Please leave your questions/tips/suggestions in the comment section below and I’ll try to answer as many as I can.



The Best Software Testing Training You'll Ever Get!

software testing QA training

58 comments ↓

#1 Dennis Guldstrand on 09.05.11 at 8:40 pm

Well written. I like your simple, but to the point, definition of security testing:
“Security means that authorized access is granted to protected data and unauthorized access is restricted.”

We use a similar description description, and it helps to keep focus on what the core reason for what we are doing something (within security testing) is.

#2 Ankit on 09.06.11 at 5:17 am

Valuable and brief
Thanks

#3 RAmani on 09.06.11 at 7:00 am

USEFUL.

#4 Anu on 09.06.11 at 8:58 pm

Thank you for the article. Very informative. The section “How to Test Service Access Points” is more informative.

cheers

#5 aruna on 09.07.11 at 2:27 pm

Wow. very well defined and expressed the depth with clear examples. Thanks .

#6 Sushil Pansare on 09.09.11 at 2:53 am

Nice info.

#7 Rajesh Reddy on 09.12.11 at 2:56 pm

This article has helped me to get good insight on security related vulnerabilities and how to test those cases.
Thanks for your very good effort in articulating it in a easy & understandable manner.

#8 Pratap on 09.13.11 at 8:20 am

Hi all

Can anybody tell me how to test a website in which

“iFrames” plays a very important role.

i mean few things that i must remember while testing

these kind of site ?

plz help me guys

#9 Tal on 09.17.11 at 6:21 pm

Great stuff. thank you for the info!

#10 anil yadav on 09.18.11 at 11:21 am

hi all
can anyboby tell me software testing in jaipur
plz

#11 Imran on 09.19.11 at 10:04 am

Hi All,

In most of the interviews they are asking this question.

Explain Test Plan & Test Strategy ?

Can anyone give a breif or a link for the answer for this question if its available in this website.

#12 m on 09.20.11 at 6:17 am

very well. thanks

#13 Anand Nandargi on 09.20.11 at 7:38 am

good one..lyk it..

#14 Karthik on 09.20.11 at 8:34 am

Very good one

#15 Sanju on 09.21.11 at 10:24 am

v.gud article

#16 Gaurav Khanna on 09.26.11 at 5:20 am

Nice Article. Thumbs Up. :)

#17 Digvijay on 09.26.11 at 9:08 am

Hey! could you please provide the information about how to analyze the jmeter load test report.

#18 Lakshmi on 10.08.11 at 11:28 am

Good information for all the topics…………please keep going on like this

#19 Deepak Kashyap on 11.08.11 at 1:07 pm

Good..Very Good…

#20 Rishi Mathur on 11.16.11 at 1:01 pm

Ultimate

#21 suman on 12.06.11 at 11:31 am

Good article. Verymuch useful for the Testers.

#22 sagar on 12.14.11 at 8:06 am

Testing job

Dont join Seed Infotech & SQTL Pune & Mumbai People .
Telll other not to join it

Apply ur cv Capgemini, chennai
nagaprasady@yahoo.com

#23 ajit pawar on 12.18.11 at 5:16 am

wow it’s a good example…

#24 ajit pawar on 12.18.11 at 5:25 am

please give me some sites or references to apply job in testing field.i have sound knowledge in manual testing.

#25 Zara on 01.05.12 at 1:14 pm

well written …thanks

#26 Yamraaj on 01.06.12 at 7:53 pm

Excellent article.
Comprehensive and convincing, covering almost all the major areas of security and security testing in the field of softwares.

#27 Nagesh on 01.24.12 at 7:40 am

I Need The qtp Advanced interview questions

#28 Nagesh on 01.24.12 at 7:43 am

I Am Looking for Software Testing Opening With 3+ yrs of exp If Any One Find the opening in any company
ple send me the details on

nagesh.gts@gmail.com

#29 Amit on 02.14.12 at 8:37 pm

Hi..please give me some sites or references to apply job in testing field.i have sound knowledge in manual testing.

#30 Mohan on 02.15.12 at 3:52 pm

Excellent knowledge spreaded!!! looking forward more stuff like this….Thanks a lot

Can you please publish article related to QTP and Load runner more!!!

#31 Deepak Kumar on 02.27.12 at 4:28 pm

Thanks for such a knowledgable information.

#32 Eugenia Yakhnin on 03.22.12 at 2:29 am

Excellent article! Simple and clear, useful in the daily work, thanks.

#33 kumar on 03.30.12 at 11:14 am

Nice post, I’m little bit expecting some more examples on your post.

#34 kumar on 03.30.12 at 11:21 am

Hi am new in QTP, Can any one post vb script tutorials to learning purpose.

Please mail me if you found any

swamy.kumar02@gmail.com

#35 Svetlana on 04.20.12 at 7:46 am

Thank you for a great article and useful tips, guys!

#36 ravindra on 05.03.12 at 11:28 am

Hi,
Really good keep it going with different advanced concepts

#37 ravindra on 05.03.12 at 11:29 am

good and helpful

#38 ravindra on 05.03.12 at 11:29 am

thanku very much for providing the valuable information

#39 swati on 06.05.12 at 12:29 pm

This site is awsome!!!! Whichever topic the respective author has explained, they have done a great job!!! information shared is so helpful,concise and easily understood!! Just Awsome!! :)

#40 JD on 06.07.12 at 3:23 am

Hi,
How to Performed security testing of basic levels in the Finance Tracker application??

If someone help me..

Thanks
JD

#41 Maheedhar on 07.11.12 at 11:19 am

Well said.. nice topic with interesting definitions which can be easily understandable.

Good going…

#42 Asad on 07.31.12 at 11:44 am

Well Summurized

#43 Asad on 07.31.12 at 11:44 am

Well Summarized

#44 Deepti on 08.15.12 at 8:09 pm

Well written article. I have read some of your other articles too and all of them and simple enough to understand. I also liked the examples used in above article. Keep up the good work.

#45 Ajju on 09.25.12 at 10:30 am

Simply clear…

#46 Satish on 10.06.12 at 11:18 am

How to test XSS (cross site scripting)?

#47 Rajendra Rajput on 11.06.12 at 8:40 am

this is very2 good Helpful place!

#48 Supriya on 11.07.12 at 6:49 am

Please clearify how to do Xss test.I have a site to test,and this is my first time to test,no training has provided ,so please give me some solutions.

#49 M.Siddiqui on 11.29.12 at 12:38 pm

No doubt, Very informative article, I liked it.

#50 Srilekha on 12.15.12 at 6:27 am

Send me Resumes to this mail. Well give placements free of cost

#51 maoj on 01.07.13 at 12:55 pm

hi..

#52 Abdul on 02.12.13 at 5:53 am

Its very helpful description. Described how to handle security concerns of software in very simple words

#53 Naresh on 02.18.13 at 10:18 am

Am Looking for Software Testing Opening With 3+ yrs of exp in banking domain applications. If Any One Find the opening in any company
please send me the details on m.nareshkmr@gmail.com

#54 Cally on 07.23.13 at 4:20 pm

Thanks so much for this article; it is very informative. I especially appreciate your clear and concise explanations of all five security testing techniques. My favorite technique that was mentioned was “Data Protection” and the three aspects of data security it provides. All three of these aspects on data protection is extremely helpful in understanding and using application security testing.

Get a free application security scan

Hope this helps!

#55 Cally on 07.23.13 at 4:42 pm

Thanks so much for this article; it is very informative. I especially appreciate your clear and concise explanations of all five security testing techniques. My favorite technique that was mentioned was “Data Protection” and the three aspects of data security it provides. All three of these aspects on data protection is extremely helpful in understanding and using application security testing.
Get a free application security scan
Hope this helps!

#56 Prajakta on 01.13.14 at 10:49 am

Hi, i am a beginner in the pen testing field, want to know the in & out of Vulnerability Assessment & Penetration Testing(VAPT), i.e want the knowledge of OWASP listed vulnerabilities, how to find them(step by step detail) in thin and thick client using automated & by manual process. please email me regarding the same.
my Email ID: prajakata.patil189@gmail.com

#57 vikram on 02.03.14 at 9:45 am

Am Looking for Software Testing Opening With 1 yrs of exp . If Any One Find the opening in any company
please send me the details on vikram.jagtap2010@@gmail.com

#58 Riham on 02.16.14 at 11:41 am

what a great article !!

Thanks a lot :)

Leave a Comment