An approach for Security Testing of Web Applications

This is guest article by “Inder P Singh”

Introduction

As more and more vital data is stored in web applications and the number of transactions on the web increases, proper security testing of web applications is becoming very important. Security testing is the process that determines that confidential data stays confidential (i.e. it is not exposed to individuals/ entities for which it is not meant) and users can perform only those tasks that they are authorized to perform (e.g. a user should not be able to deny the functionality of the web site to other users, a user should not be able to change the functionality of the web application in an unintended way etc.).

Some key terms used in security testing

Before we go further, it will be useful to be aware of a few terms that are frequently used in web application security testing:

What is “Vulnerability”?
This is a weakness in the web application. The cause of such a “weakness” can be bugs in the application, an injection (SQL/ script code) or the presence of viruses.

What is “URL manipulation”?
Some web applications communicate additional information between the client (browser) and the server in the URL. Changing some information in the URL may sometimes lead to unintended behavior by the server.

What is “SQL injection”?
This is the process of inserting SQL statements through the web application user interface into some query that is then executed by the server.

What is “XSS (Cross Site Scripting)”?
When a user inserts HTML/ client-side script in the user interface of a web application and this insertion is visible to other users, it is called XSS.

What is “Spoofing”?
The creation of hoax look-alike websites or emails is called spoofing.
Security testing approach:

In order to perform a useful security test of a web application, the security tester should have good knowledge of the HTTP protocol. It is important to have an understanding of how the client (browser) and the server communicate using HTTP. Additionally, the tester should at least know the basics of SQL injection and XSS. Hopefully, the number of security defects present in the web application will not be high. However, being able to accurately describe the security defects with all the required details to all concerned will definitely help.

1. Password cracking:

The security testing on a web application can be kicked off by “password cracking”. In order to log in to the private areas of the application, one can either guess a username/ password or use some password cracker tool for the same. Lists of common usernames and passwords are available along with open source password crackers. If the web application does not enforce a complex password (e.g. with alphabets, number and special characters, with at least a required number of characters), it may not take very long to crack the username and password.

If username or password is stored in cookies without encrypting, attacker can use different methods to steal the cookies and then information stored in the cookies like username and password.

For more details see article on “Website cookie testing”.

2. URL manipulation through HTTP GET methods:

The tester should check if the application passes important information in the querystring. This happens when the application uses the HTTP GET method to pass information between the client and the server. The information is passed in parameters in the querystring. The tester can modify a parameter value in the querystring to check if the server accepts it.

Via HTTP GET request user information is passed to server for authentication or fetching data. Attacker can manipulate every input variable passed from this GET request to server in order to get the required information or to corrupt the data. In such conditions any unusual behavior by application or web server is the doorway for the attacker to get into the application.

3. SQL Injection:

------------

The next thing that should be checked is SQL injection. Entering a single quote (‘) in any textbox should be rejected by the application. Instead, if the tester encounters a database error, it means that the user input is inserted in some query which is then executed by the application. In such a case, the application is vulnerable to SQL injection.

SQL injection attacks are very critical as attacker can get vital information from server database. To check SQL injection entry points into your web application, find out code from your code base where direct MySQL queries are executed on database by accepting some user inputs.

If user input data is crafted in SQL queries to query the database, attacker can inject SQL statements or part of SQL statements as user inputs to extract vital information from database. Even if attacker is successful to crash the application, from the SQL query error shown on browser, attacker can get the information they are looking for. Special characters from user inputs should be handled/escaped properly in such cases.

4. Cross Site Scripting (XSS):

The tester should additionally check the web application for XSS (Cross site scripting). Any HTML e.g. <HTML> or any script e.g. <SCRIPT> should not be accepted by the application. If it is, the application can be prone to an attack by Cross Site Scripting.

Attacker can use this method to execute malicious script or URL on victim’s browser. Using cross-site scripting, attacker can use scripts like JavaScript to steal user cookies and information stored in the cookies.

Many web applications get some user information and pass this information in some variables from different pages.

E.g.: http://www.examplesite.com/index.php?userid=123&query=xyz

Attacker can easily pass some malicious input or <script> as a ‘&query’ parameter which can explore important user/server data on browser.

Important: During security testing, the tester should be very careful not to modify any of the following:

  •  Configuration of the application or the server
  •  Services running on the server
  •  Existing user or customer data hosted by the application

Additionally, a security test should be avoided on a production system.

The purpose of the security test is to discover the vulnerabilities of the web application so that the developers can then remove these vulnerabilities from the application and make the web application and data safe from unauthorized actions.



The Best Software Testing Training You'll Ever Get!

software testing QA training

157 comments ↓

#1 Sudhir Ujagare on 11.17.08 at 8:09 pm

Awesome!!!!!!!!!!!!!!!!!!!

Thanks….

#2 shekhar rai on 11.18.08 at 5:08 am

very precious and Awesome articale

alot of thanks to give a such a nice article

#3 kasuvu on 11.18.08 at 5:49 am

Nice description and very much useful.

#4 Prashant Jadhav on 11.18.08 at 5:52 am

Nice Article and it is useful for us, Could u please give detail information(article) on SQL Injection. No one can famaliries it.

Thanks…….

#5 Beena on 11.18.08 at 6:23 am

Very Nice Article By Inder P Singh. Thank u Vry Much.

#6 Pankaj Sharma on 11.18.08 at 6:29 am

Very nice article but it will be very helhul if you provide some example with every Security Testing Approch.

Thanks…….

#7 Ambarish Karnik on 11.18.08 at 7:32 am

Thanks for a great article! :)

#8 its shantha on 11.18.08 at 8:44 am

hi,
This is shantha from chennai.plz tel me when the security testing has to do?

#9 prasan on 11.18.08 at 8:46 am

boldrps1479@gmail.com

hi shantha

security testing is done for particular products

mail me
will send details

#10 Fatema on 11.18.08 at 9:27 am

Great article, these days I am very much keen to go into depth and to look for work as penetration tester and this article covers the depth overview of it.Thanks for it.

b/w does any one knows good institute in UK/India for web security testing training?

Thanks and Regards

#11 prasan on 11.18.08 at 9:58 am

boldrps1479@gmail.com

hi fatema whats ur id

#12 Sushil on 11.18.08 at 10:05 am

Nice information!
Can you please send detailed infromation on ‘SQL Injection’ at sushil344@yahoo.com ?

#13 suyash on 11.18.08 at 10:30 am

Its realy worthy information for all testers. I think in india there are very few peoples who are realy in the Security Testing i want to be one of them. thanks for such a great information.
thanks

#14 Shilpa on 11.18.08 at 10:58 am

I think web applications should be througly tested for security testing. Any penetration in web application or server can lead to loss of important data as well company revenue.

In our company we are not concentrating more on securtiy testing, i have pointed this out to my lead and he is convienced now.

You can set aside some fix test plan time for security testing of web application.

I would also love to see detailed article on SQL injection..

#15 Sureshkumar on 11.18.08 at 11:16 am

very useful article and it helps me in some way.Thanks for it…and can any one please explain me about SQL Injection…

#16 shanti on 11.18.08 at 12:07 pm

Great article, these days I am very much keen to go into depth and to look for work as penetration tester and this article covers the depth overview of it.Thanks for it.

#17 Fatema on 11.18.08 at 2:08 pm

Hi Prasan, my id is fatemadawoodi786@gmail.com

Also would like to share with you all a very useful and detail information on SQL Injection.

http://www.sitepoint.com/article/sql-injection-attacks-safe/

Hope it will give you all a start up.
Thanks n Rgds
F.

#18 kashan on 11.18.08 at 2:35 pm

Thanks alot its very very very helpful

#19 Ngoc Vu on 11.18.08 at 2:58 pm

Thanks alot. That’s great article. It’s very useful.

#20 anil on 11.18.08 at 4:36 pm

hi ,
i was working as a manual testing engineer could u plz cooperate to get job in pune this my cell no 9325767762.

#21 kishor on 11.19.08 at 4:39 am

hi,

nice and very easy to understand.

#22 Priyaa Arora on 11.19.08 at 5:40 am

Thanks alot for such a useful information,it helps me in building up my basics for web testing.

Thanks for Sharing.

#23 purabi on 11.19.08 at 7:57 am

Hi,

I want to know about client side and server side Security. As a tester how can I test it ??

Regard,
Purabi

#24 PKDuong on 11.19.08 at 10:06 am

Dear all,

Long time to visit this site. I love this one, it’s just basic thing of security testing as the article mention, just the term. We have lot of things to talk about this topic. Hope to see another one deeper :)

For moment, I just thought one question:

To be a security tester, should we try to study hacking technique and practice to hack some sites?

Thanks for reading my comment :),
Duong

#25 arun kurle on 11.21.08 at 5:01 am

articals are realy good and helpfull thanks for that
i wan to the difference between sanity and smoke testing plz let me know

#26 Kotesh on 11.21.08 at 6:47 am

Very Nice Article
very helpful to understand security types.

#27 Kotesh on 11.21.08 at 6:47 am

Very Nice Article
very helpful to understand security types.
thx

#28 hitesh shah on 11.21.08 at 8:29 am

nice its very useful but should be in more details with example.

#29 Inder P Singh on 11.23.08 at 4:04 am

Dear Prashant and others,

I will definitely write an article on the SQL injection and share it with you.

Thanks

#30 jagadeeshan on 11.24.08 at 11:04 am

Hi Inder P Singh,
Nice article. Could u explain SQL injection topic in a simplest way. Then it would be helpful for us.

#31 Girish chander raju on 11.25.08 at 2:43 pm

hi sir,

Security testing is always demanding.right now iam working as manual testing professional.iam very ambitious to become as security testing professional.

thank you

#32 Girish chander raju on 11.25.08 at 2:48 pm

sir inder p singh,

i need your help to reach my goal as LEGEND IN SECURITY TESTING.

Thank you sir

#33 hitesh shah on 11.28.08 at 6:46 am

Hi, How to test Server security? explain with example.
thanks

#34 Siddharth on 11.28.08 at 8:26 am

Hi,
I found this site very useful for getting answer to my queries.

#35 CH.GIRISH on 11.28.08 at 10:51 am

Hi QA/TEST ENGINEERS,

IAM A 1+EXP AS MANUAL TESTER IN MNC,IAM GOOD AT COMPLETE STLC(SOFTWARE TESTING LIFE CYCLE).PLEASE GUIDE ME WHAT I NEED TO LEARN TO MAKE A PERFECT BASEMENT IN SOFTWARE TESTING.
THANKS A LOT IN ADVANCE.
MY MAIL ID:girish_bio4u@yahoo.com
MOBILE : 9391395989

#36 Faraz on 11.29.08 at 5:27 am

thanks
i was seeking for SQL injection concept from a long time

#37 Piyush Agn on 11.30.08 at 2:13 pm

Good article, I got enought information regarding the tesing, but some points are provided in very brief, more discription is required. kindly suggest me some good book for web based application testing.
Thanks in advance

#38 hiqbal on 12.01.08 at 11:18 am

very useful to think and research web security testing, thnx v. much

#39 Nisha arun on 12.02.08 at 10:16 am

Nice article

#40 varun on 12.03.08 at 6:37 am

very good

it helped me a lot

thanks a lot

#41 GIRISH on 12.03.08 at 2:08 pm

dear pkduong,

sure as a security we need to study hacking and anti hacking too.i need explanation regarding hacking and antic hacking.
thank you

#42 Hemant on 12.04.08 at 10:23 am

Hi All,

Its nice artical ,I am thank full to Inder P Singh but could you please elobarate the security testing with steps by steps,

#43 monalisa on 12.04.08 at 11:49 am

Thanks for the ebook

#44 monalisa on 12.04.08 at 11:49 am

thanks

#45 Madhu on 12.05.08 at 6:58 pm

very nice, it’s very useful 4 all

#46 Yoginder on 12.10.08 at 3:55 am

Hello Inder P,

You article on Security testing is very informative one. I am hoping to see an article on SQL Injection as well..

Thanks again for sharing this great information with us.

Regards,
Yoginder

#47 neelamohan on 12.10.08 at 10:37 am

Thanks for a great article!

#48 Jenish on 12.15.08 at 4:12 am

Thats a very nice article.. Keep going..

#49 Ashish Trivedi on 12.20.08 at 8:46 am

H! I read this Article. this is very good for me for more knowledge.

#50 Chandra on 12.23.08 at 9:43 am

Wavvvv. Its really amazing. The way they explain is really down to earth.Hope it is enough to get a minimum knowledge on security testing.Once again thanks to website.

#51 Vishal on 12.24.08 at 1:31 pm

Hi Vijay,

Recently I had been to an interview and encounted to a new term hard error and soft error.

They have asked me the difference between Hard and soft error.

If u have the ans. pls reply for the thread.

Regards
Vis

#52 Subhadip on 12.26.08 at 10:40 am

Previously I was involved in security testing, but didn’t know the impact of “security test defects”. This material helped me a lot to understand the same.

#53 hitseh shah on 01.02.09 at 11:06 am

Its normal artical but could you please elobarate the security testing with steps by steps . how to test any Server with example.

#54 saravanan on 01.03.09 at 6:04 am

hi dude
i selected a topic security testing as my company presentation for 25 min time could u send some tips to make this one effective

#55 Priya on 01.03.09 at 8:49 am

Its very nice.

#56 Nanjil Tiger on 01.05.09 at 9:37 am

Also look in to data encryption which is very important for security testing.

#57 Sandip Wagh on 01.08.09 at 7:41 am

Hello,

I am QA Engg.
Nice Article and it is useful for us, Could u please give detail information(article) on SQL Injection. No one can famaliries it.some example pls.

Thanks…….

#58 Sandip Wagh on 01.08.09 at 7:44 am

Hi,

pllease give details information on Cross Site Scripting & SQL Injection.

#59 Mallikarjun. on 01.15.09 at 11:01 am

Hello Inder P Singh
wat a nice article,its beautiful, am xpecting more and more from u.really gr8.

#60 SQL Injection – How to Test Application for SQL Injection Attacks on 01.17.09 at 5:24 pm

[...] Couple of months back Inder wrote an interesting article on “Security testing of web application“  Have a look at it for more details on different web vulnerabilities. [...]

#61 sushil on 01.19.09 at 8:27 am

Nice article!!!!

#62 PETER on 01.19.09 at 9:59 am

This is a good and expository article. This is timely and helpful. Thank you.

#63 Arjun on 01.29.09 at 3:27 pm

Hello Famtema,
Thanx 2 u, bcoz u hv given nice site for sql injection.
It has useful info.
bye bye

#64 Arjun on 01.29.09 at 3:27 pm

Hello Fatema,
Thanx 2 u, bcoz u hv given nice site for sql injection.
It has useful info.
bye bye

#65 rajiv on 02.09.09 at 11:41 am

I need more information on security testing. Please send the details to my email address.

#66 Top 25 common programming bugs every tester should know on 02.12.09 at 6:57 pm

[...] to avoid some common but serious coding mistakes. For software testers list will be useful as a security testing checklist for Internet as well as for testing desktop [...]

#67 Sandip Wagh on 02.20.09 at 12:20 pm

very precious and Awesome articale

alot of thanks to give a such a nice article

#68 vaibhav Maheshwari on 02.23.09 at 1:42 pm

It’s really such a great article to get started to know the security testing concepts. However that would really helpful if you could also provide some examples or websites Url WHERE readers can get such adequate information about all the concepts for security testing.

#69 Anil on 03.11.09 at 9:17 am

Hi Vijay,
Pl. give a link at the bottom to reach at the top of page.
Thanks!

#70 saran on 03.18.09 at 5:16 am

Hi could any one say more about the security testing or mail at saran_loyola05@yahoo.co.in

#71 Meghana on 03.20.09 at 10:41 am

very Informative article

#72 Pritish on 03.26.09 at 1:04 pm

Can Some One help me with the testing related to Pay Pal and credit card transaction. What points should be take care while testing it.

#73 Alphonsa on 04.02.09 at 2:48 pm

Came across this website/blog just randomly. Looks great… lot of information, tips and techniques!
Hope to keep visiting :)

#74 swapnil on 04.06.09 at 9:26 am

Can you please send detailed infromation on ‘SQL Injection’ at swapnil_nishith@yahoo.com

#75 prashant on 04.07.09 at 6:32 am

im working on ASLC(application security life cycle) with 3i-infotech. ihave 2years exp in testing.any job for me in testing

#76 Sudhakar Arige on 04.28.09 at 10:28 am

its a very precious information provided, on web , like this very very few sites existing with required full information

#77 syed on 04.28.09 at 3:25 pm

Can anyone just provide the checklist of Security Testing…

Thanks in advance..

#78 HT on 05.20.09 at 9:48 am

Very nice article and written with clarity. proved to be useful.

#79 Vishal Pate on 06.09.09 at 12:04 pm

Hi Inder P Singh,

It is a very basic and nice information for Security Testing.
Inder, Could you possible to give example on the above information?

#80 sanjeev on 06.11.09 at 10:16 am

Hi…This is very bad information that i got from this site..I just suggest to every one please don’t visit it.All information are wrong.

#81 Mahesh D on 06.12.09 at 11:34 am

Great article.. thanks a lot..

#82 Sri Balaji on 06.30.09 at 12:10 pm

Great explaination provided in this article..
Really easy to understood
Thanks to the author..

#83 Priyam on 07.08.09 at 2:20 pm

Anybody would like to know about frameworks, Automation tools (QTP,Selenium,Test Partner, Load runner……) or looking for jobs please mail me qaprofiles81@rediffmail.com

#84 Nacourja on 07.09.09 at 2:50 pm

The article was very informative and useful. Thanks for sharing your knowledge.

#85 Sandy on 07.25.09 at 1:55 am

Thanks for the usefull article.
Please cont.. the good work.

#86 Samadhan on 09.02.09 at 1:03 pm

Nice Article………!!!!!!!
This one will help me a lot.

#87 Tejas on 09.11.09 at 9:19 am

This is really nice info mentioned here. But as far as Security Testing is concerned, can anyone provide me links from where I can get the collective information on the famous attacks on web applications till date…..
Kindly share your thoughts on this forum or send me email on tejas.gandhe@lionbridge.com

#88 aaaaaaaaa on 10.23.09 at 8:44 am

Gr8 article very informative

#89 moses Gandi on 10.26.09 at 11:00 am

IAM A 1+EXP AS MANUAL TESTER IN MNC,IAM GOOD AT COMPLETE STLC(SOFTWARE TESTING LIFE CYCLE).PLEASE GUIDE ME WHAT I NEED TO LEARN TO MAKE A PERFECT BASEMENT IN SOFTWARE TESTING.
THANKS A LOT IN ADVANCE.
MY MAIL ID: moses.welcome@gmail.com
MOBILE : 9431577453

#90 aaaaaa on 11.04.09 at 9:22 am

gr8 article

#91 Anmol on 11.04.09 at 9:31 am

agree with aaaaaaaaa

#92 ~Anmol on 11.04.09 at 9:37 am

Very nice article and written with clarity
anmol.a.gupta@gmail.com

#93 vvv on 11.04.09 at 9:58 am

useful….

#94 vvv on 11.04.09 at 10:04 am

very useful article and it helps me in some way.Thanks for it…and can any one please explain me about SQL Injection…

#95 Govardhan Reddy M on 11.04.09 at 1:52 pm

Dear Mr.Inder P Singh (Article Author),
Great Article.
Thanks for your time.

What I feel is, Its good, If you would have discussed about

HTTPS (HTTP Secured), Thats where
encription,
decription,
public key,
private key,
digital signature,
ciphers,
authentication,
authorization,
SSL/TLS,
128 bit encription,
SSL Hand shake etc., Comes in to picture (for better idea about security).

Its worth reading your article.

Thanks,
Govardhan Reddy M,
Software Test Engineer,
“The best is yet to come”.

#96 Root0x on 11.22.09 at 3:38 pm

this information sucks!10 years old information dude need some thing new like yuor ==@@

#97 Archana on 12.01.09 at 3:32 pm

Hello,
I found this article interesting and came across it while trying to find out more info on security testing. I have good manual testing experience and I am keen on learning the security testing. Can anyone let me know of any online training for web application security testing. What are the pre-requisities required before taking up this training.

#98 Archana on 12.01.09 at 3:36 pm

Hello,
I found this article interesting and came across it while trying to find out more info on security testing. I have good manual testing experience and I am keen on learning the security testing. Can anyone let me know of any online training for web application security testing. What are the pre-requisities required before taking up this training.
Please mail me on archtj@gmail.com
Thanks

#99 Sudha Ranjan Das on 01.20.10 at 7:44 am

Inder’s topic on Web Security testing and SQL Injection are excellent

#100 Navneet on 02.11.10 at 11:25 am

Hi Friends,

I’m new in testing field Manual testing. can any one tell me about security testing.
How do we done or check security testing in manually.

plz gave me som examples.

and also send example in SQL injection attack

on my mail id
mail2navneetgupta@gmail.com

#101 Meer on 02.19.10 at 11:45 am

Hi,
This is Meer Sr Test Engineer, I was hard to me to understand SQL Injection,After reading this article. Its so easy to to understand, even a layman(LLR in testing) can come to know, thanks to all that shares their real time knowledge.
Plz can anyone mail the information on XSS and SQL injection more detail as when n how to start the testing.

Thnx in adv,
My mail ID:meer.saif@gmail.com

regards,
Meer

#102 Nikhil Sharma on 03.13.10 at 10:07 am

WOW!!!!!!! Nice article.Thank you all for such useful information……..

#103 sumit bhatnagar on 03.23.10 at 8:27 am

fantastic article ……

#104 nitin on 04.09.10 at 6:49 am

hi my self nitin i have 1 yer exprience in software development. before one month i got a job in software testing company as QA now i want to do career in software testing. so plz help me……..
Thanks in advance

#105 Rajaselvan on 04.10.10 at 10:38 am

This article is very nice

#106 Komala on 05.20.10 at 12:06 pm

This article is very useful.. I exept detailed description on security testing with example in further articles.
Thanks

#107 Vaibhav on 06.22.10 at 8:16 am

Very helpful ! .. keep it up dude !

#108 Anil on 06.22.10 at 8:26 am

Hi Vijay Kindly do not send any updates on my email ID..
My Email ID is anillnaik@gmail.com

Thanks,
Anil

#109 maya shah on 06.22.10 at 9:26 am

I was expecting the detailed description of whole Security Testing…
Information is good for intermediates but for lyman like me freshers i think little bit detailed description must be given…

#110 Sradhanjali on 07.20.10 at 9:38 am

I am working as a manual tester.Interest to know about SQL Injection. Can you please send me in the easiest way.

#111 Vivek joshi on 10.16.10 at 9:59 am

This is the realy usefull for me and also for those who want to learn more about the SQL injection and software testing, but i was expecting more can anyone send me detailed description???

#112 VIJAY on 10.27.10 at 6:18 am

HI,
pllease give details information on Cross Site Scripting & SQL Injection WITH EXAMPLES TO MY MAILD

#113 VIJAY on 10.27.10 at 6:20 am

HI,
pllease give details information on Cross Site Scripting & SQL Injection WITH EXAMPLES TO MY MAILD My Mailid is vijaykumar.jalanila25@gmail.com .

#114 Amira Soliman on 11.22.10 at 1:20 pm

Very Good Article but needs more details
thank u so much…and waiting for the detailed one .. !

#115 Gul on 12.01.10 at 6:30 am

Its realy good article…..

#116 Naresh on 12.15.10 at 11:08 am

It is very good info.

Thanks a lot!!!

#117 Mugil k on 12.23.10 at 4:29 am

Hi,
SQL Injection and Security testing articles are very useful for all web tester..

#118 Mugil k on 12.23.10 at 4:30 am

hi,
Its very useful for all web testers..

#119 sabari raj r on 12.29.10 at 2:12 pm

hi,

There are lots of good works to do in your website.I prefer oracle for testing skills.I wish you a happy new year 2011.

#120 Prashanthi on 01.10.11 at 2:29 pm

Thanks to all. I came to know valuable info from this site.

#121 Arun on 04.07.11 at 11:39 am

bad article

#122 Sapan on 05.04.11 at 7:01 pm

Hi,
I am new to security testing.
Can any one send me a sample test plan for secuty testing of web application.
Thanks

#123 peeyush on 05.20.11 at 7:41 am

Good article

#124 peeyush on 05.20.11 at 7:43 am

As i m a new to testing field and need lot knowledge.can any one plz elaborate tis article like how fresher ll be expecting.Thinking tat no one knows abt security and how to implement sql injection in real scenario.

#125 Narendran on 05.27.11 at 6:48 am

You must watch this w w w. filimography. blogspot. com

#126 ram on 05.31.11 at 4:24 pm

Thanks a lot singh ji….SINGH IS KING

#127 Laxman on 07.01.11 at 10:31 am

Really very good article. We vll get to know many concepts after reading this article.

Thanks a lot for good article……….

#128 sharad on 07.06.11 at 6:28 am

Hi,

Can any body elaborate me,
that same username with different mail id and password can be used for login or registration.

#129 hamsa on 07.08.11 at 2:29 pm

very helpful article

#130 How to Test Application Security – Web and Desktop Application Security Testing Techniques — Software Testing Help on 09.05.11 at 8:08 pm

[...] Testing’. In order to know further details of security aspects, kindly refer to – Web application security testing [...]

#131 Divya on 09.12.11 at 5:40 pm

Please suggest an institute for web application security testing in hyderabad

#132 wilson mantri on 09.29.11 at 7:04 am

Very Nice Article By Inder P Singh. Thank u Vry Much.

#133 priyanka singh on 09.29.11 at 7:07 am

very precious and Awesome article….

alot of thanks to give a such a nice article..:-)

#134 neeraj on 11.15.11 at 1:24 pm

All contents are really very useful for understanding the concept of Security Testing.

Thankyou so much……..

#135 suresh on 05.02.12 at 1:10 pm

It is very use ful …….Plz send the any information about the Security testing. My mail ID is pvsureshkumar2005@yahoo.com

#136 prachi on 05.07.12 at 12:25 pm

good, nice article

#137 SQL Injection – How to Test Web Applications against SQL Injection Attacks « Junaid Vanoo's Weblog on 05.09.12 at 9:25 am

[...] of months back Inder wrote an interesting article on “Security testing of web application“  Have a look at it for more details on different web [...]

#138 How to Test Application Security – Web and Desktop Application Security Testing Techniques « Junaid Vanoo's Weblog on 05.09.12 at 9:32 am

[...] I hope this foreword is enough and now let me come to the point. Kindly accept my apology if you so far thought that you are reading about the subject of this article. Though I have briefly explained software Security and its major concerns, but my topic is ‘Security Testing’. In order to know further details of security aspects, kindly refer to – Web application security testing article. [...]

#139 Pradeep on 06.28.12 at 7:21 am

Hi,
Thanx for sharing Security and SQL injection topic,it’s very helpful to me.

#140 jasmine on 07.27.12 at 6:39 am

ja oye chad pare

#141 Vasudev on 08.14.12 at 7:13 am

Very good article.. :)

#142 Megha on 09.25.12 at 12:07 pm

Can anyone pls shed a light on web application security scanners in terms of desktop assessment services

#143 hi on 10.30.12 at 9:19 am

df

#144 sam on 11.19.12 at 6:28 pm

Indeed a nice article. Good to see youngsters being curious about website security issues and testing techniques.

#145 sreenu on 01.08.13 at 4:50 pm

could you tell me the leading security testing tool in the market

#146 uday on 01.09.13 at 7:35 pm

hi..i don’t have that much experience in security testing can u please guide me i’m interested to learn some basics regarding how to hack the application by using script injections………..i’m waiting for your informative reply dear:)

#147 Pallavi on 01.13.13 at 11:40 am

Thank you ..These are very helpful. I’m looking for WAP testing, what all things should be taken into consideration whil WAP testing and specially security testing.

#148 Santhosh Tuppad on 01.25.13 at 5:39 am

For those who want to start with security testing, they can look into this and also write to me if you need any guidance to start.

http://tuppad.com/blog/2012/05/14/how-do-i-start-security-testing/

You can find me on Twitter @santhoshst | LinkedIn – http://www.linkedin.com/profile/view?id=44693468&goback=%2Enmp_*1_*1_*1_*1_*1_*1_*1_*1_*1&trk=spm_pic

Thanks!

#149 Laloo Thadhani on 04.12.13 at 1:57 pm

thanks man for passing such valuable information.

#150 Tim Edward on 05.06.13 at 11:46 am

There is a very good online free course for for those who want to learn ethical hacking – http://hackvidhi.com/courses.php .

This course covers basic of web programming and ethical hacking, both. It will be starting in this summer. Seats limited, please enroll now!

#151 Samir on 07.05.13 at 5:01 am

One of the finest articles I’ve came across. I’m willing to use it for the internal training of my QA Team.

#152 Monisha on 08.15.13 at 5:29 am

Thank you… the article really helped me….

#153 Satish on 11.21.13 at 8:28 am

Dear Vijay,

Really very helpful article.

Thanks

#154 Ranjan Kumar on 01.15.14 at 1:25 pm

Thanks. This is very useful information about Security testing.Please notify me whenever you got something new.

#155 Mark on 02.17.14 at 1:08 pm

I think this is the best article I have come across on the internet on Security Testing, Thanks Inder

#156 Kavitha Gurunathan on 03.23.14 at 11:26 am

Information given was very useful, simple and easy to understand
Thanks!!!

#157 Asnu on 04.02.14 at 10:50 am

Hi ,

Really Really Helpful…