A brief overview of common techniques and tools which can be applied to web application security testing

1. Introduction to web application
security testing
Alexandr Romanov

2. What is security testing and why it is
neccessary?

3. Prepare your mind for
security testing
- Think like a hacker :)
- Concentrate on negative testing
- Vulnerabilities = bugs

4. Security testing in action - stage 1
Mapping the application
- web spidering
- user directed spidering
- brute force scanning

5. Security testing in action - stage 2
Analyze the application
- application functionality
- data entry points
- application technologies

6. Security testing in action - stage 3
Test/break the application
Test:
- client-side controls
- authentication mechanizm
- session management mechanizm
- access controls
- input-based vulnerabilities
.....

7. Security testing in action - stage 4
Report the results
1. Exclusive summary
2. Detailed report
3. Raw output

8. Security tester tools
Firefox:
- Firebug/FirePath
- HTTPWatch
- FoxyProxy
- XSSme/SQLme
Chrome:
- XSSRays
IE:
- HTTPWatch/IEWatch

9. Security tester tools
Complex tools:
- BurpSuite
- WebScarab
- Zed Attack Proxy
- Fiddler
Vulnerability scanners:
- Acunetix
- Nikto
- Nessus