Security Testing

S ECURITY T ESTING FOR W EB
AND M OBILE D EVELOPMENT
Prepared by: Jyothi Venugopalan
(QA Team Member)
BOSS Webtech Private Limited
www.bosswebtech.com

S ECURITY T ESTING
 The security testing is performed to check
whether there is any information leakage in
the sense by encrypting the application.

 Security testing is a process to determine that
an information system protects data and
maintains functionality as intended.

S ECURITY T ESTING
 The six basic security concepts:
 Authentication - It allows a receiver to have confidence that information it
receives originated from a specific known source.

 Authorization - Determining that a requester is allowed to receive a service
or perform an operation.

 Confidentiality - A security measure which protects the disclosure of data or
information to parties other than the intended.

 Integrity – Whether the intended receiver receives the information or data
which is not altered in transmission.

 Non-repudiation - Interchange of authentication information with some form
of provable time stamp e.g. with session id etc.

 Availability - Assuring information and communications services will be ready
for use when expected.

N EED OF S ECURITY
T ESTING
 Security test helps in finding out loopholes that can
cause loss of important information and allow any
intruder enter into the systems.

 Security Testing helps in improving the current
system.

 Ensures that the system will work for longer time.

 Ensures that people in your organization understand
and obey security policies.

D IFFERENT T YPES OF
S ECURITY T ESTING
 Security Auditing: Security Auditing includes direct inspection of
the application developed and Operating Systems. This also
involves code walk-through.
 Security Scanning: It is all about scanning and verification of the
system and applications.
 Vulnerability Scanning: Vulnerability scanning involves scanning
of the application for all known vulnerabilities.
 Risk Assessment: Risk assessment is a method of analyzing and
deciding the risk that depends upon the type of loss and the
possibility of loss occurrence.
 Penetration Testing: In this type of testing, a tester tries to
forcibly access and enter the application under test.
 Ethical Hacking: It’s a forced intrusion of an external element
into the system & applications that are under Security Testing.

S ECURITY T HREATS FOR
W EBSITE
 SQL Injection - Insertion of the SQL query
into the web application which can directly
interact with the backend database on
server to reveal information stored in it.

 Cross Site Scripting- Insertion of the
scripting code into client browser. So when
client send data to server database,
scripting code on client side get stored into
the server database.

W EBSITE

S ECURITY T ESTING
A PPROACH FOR W EBSITE
 Password cracking: In order to log in to the private areas of the
application, one can either guess a username/ password or use
some password cracker tool for the same.

 URL manipulation through HTTP GET methods: The tester
should check if the application passes important information in
the querystring.

 SQL Injection: Entering a single quote (‘) in any textbox should
be rejected by the application.

 Cross Site Scripting (XSS): Any HTML e.g. <HTML> or any script
e.g. <SCRIPT> should not be accepted by the application.

M OBILE A PPLICATION
 Mobile malware and viruses: A mobile virus is an
electronic virus that targets mobile phones or wireless-
enabled PDAs.

 Eavesdropping: Eavesdropping is the unauthorized real-time
interception of a private communication, such as a phone call,
instant message etc.

 Unauthorized access: careful attention needs to be paid to
AAA – authentication, authorization, and accounting.

 Physical security: While many notebook computers are indeed
lost or stolen every year, it's a lot easier to simply misplace a
mobile device.

S ECURITY T ESTING A PPROACH
FOR M OBILE A PPLICATION
 Authentication checks

 Input Validation checks

 Session Management checks

 Encryption checks

 Application checks

 SQL injection checks

 LDAP injection checks

 XPATH injection checks

S ECURITY T ESTING TOOLS
 Netsparker Community Edition
 Websecurify
 Wapiti
 N-Stalker
 skipfish
 Scrawler
 Watcher
 x5s
 Exploit-Me
 WebScarab

S UMMARY
 No Website is 100% Secure. Prevention is the better way to
secure the website.

 Security Vulnerability arise on different ways which up on
risks.

 The Critical risk is attacking the website and stealing the
data.

A BOUT BOSS W EBTECH
 BOSS Webtech is a process oriented design house specializing
in web design, web development, backend web programming,
mobile application development and other web and mobile
related design and support services.

 Recently launched BizPlus – Mobile based survey software.
Check it more here http://bizplusonline.com/

 More products here
http://www.bosswebtech.com/products/products.html

CONTACT BOSS WEBTECH

 Call 831-998-9121 at US EST/CST/MST/PST Zone
or email info@bosswebtech.com

Security Testing

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Security Testing

Similar to Security Testing (20)

Recently uploaded

Recently uploaded (20)

Security Testing