Brief discussion on (safety) test Note II

In addition to the normal functional testing, we consider more of the anomaly test, what should be done when the anomaly test?

1. Intercept and modify post requests

Once the request is intercepted, the content of the request header can be arbitrarily increased, deleted and modified

2. Bypass the input limit

Intercept requests, enter super-long content, and if you receive errors such as Error 500:internal server error, be sure to check the server and the app to find deeper reasons. This indicates that there is too little input validation done.

Even if there is a proper input validation, it is possible to ignore the input length, repeatedly commit such a long input, the server's memory may be filled, and the application's response speed will become more and more slow, it will eventually slow like frozen

This is a form of denial of service.

3. Tampering with URLs

Manually to modify the URL, such as http://example.com/web/this URL

can modify Http://root:[email protected]:8080/web/main.php?readonly=false&section=1;

If you have a URL with key=value content, you can add more random key=value content before or after, to try to find the inferior code

4, automatically modify the URL

http://www.squarefree.com/pornzilla/

For the URL contains a number of variables, you can use the above tools in Firefox batch build connection, you can choose to manually click or copy the save, with curl or wget, such as the following

5. Test the processing of URL length

6, editing Cookies,cookise store a lot of users of information, when you can edit cookies, you can consider the security aspects of testing.

When editing cookies, it is important to consider the coding method described in the previous section, which is useful if the authentication can be easily predicted.

7. Uploading files or large files with malicious names

Many XML parsers leave the entire XML structure in memory when parsing XML, and billion laughs attacks are based on this. The entity of this document references the

Two times the previous entity, so when each entity is parsed correctly, there will be billions of ha in memory, usually draining the program's available memory

The XML processor in Windows XP is the victim of this attack and cannot be placed on the desktop or in any system directory

Brief discussion on (safety) test Note II