Web security test Two steps away

Web security testing should also follow the principle of early testing, when performing functional testing (should perform the following test Checklist security test scenario), and then after the completion of the functional test, the performance test before the scan test, you can use the tool appscan,hp WebInspect, Scan the vulnerability scanning tool such as AWS.

The first step: compare commonly used security test checklist as follows:

1: Do not log into the system, directly enter the login page URL can be accessed.

2: Do not log into the system, directly enter the download file URL can download files.

3: After logging out, click the browser's Back button to access the previous page.

4: Manually change the parameter values in the URL to access pages that do not have permission to access. If the parameters in the URL of the normal user are l=e, the parameters in the corresponding URL of the advanced user are l=s, and the parameter E in the URL is changed to "s " to access the page without permission when the user logs on to the system.

5. All credentials should be passed through an encrypted transmission channel (e.g. during login).

6: The Security page should use the HTTPS protocol.

7: Verify SQL Injection (including digital injection and character injection, etc.).

8: Verify the XSS Cross-site scripting vulnerability, and when performing a new operation, enter in all input boxes
9. The file upload function should use the file type restriction, or EXE and other executable files, confirm whether the server side can be run directly.

10: Verify the upload vulnerability, as long as the Web application allows uploading files, there may be a file upload vulnerability. Because some programs do not format the uploaded files or simply do JS authentication on the client, the attacker can remove the client's JavaScript validation via Firebug, or pass JavaScript validation via burp suit as normal process , and then tamper with the HTTP layer in transit.

11. The error message contains SQL statements, SQL error messages, and other sensitive information about the Web server.

12: Verify the validity period of the session.

Second step: After the functional test is complete, before the performance test is started, the scanning tool is scanned with professional scanning tools to generate test reports, such as Wvs and AppScan are among the top 10 scanning tools.

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Web security test Two steps away