What is security testing and how to perform security testing on web application?

Security testing on web is nothing but preventing the web application from all the vulnerability. Prevent all the secure data to be published or viewed by unauthorized people. All the private data should be secured and should not be accessible by others who does not have permission to access.

There could be many reason that could break the security boundary of your web application and hack or steal private data.

Here are few areas that you should focus more while performing security testing on web application.

Login – Most critical part where you should focus more. Application should never allow to login with wrong credentials. While sign up or creating username and password for any login, it must be necessary to create strong password (Combination or caps, small letters, numbers and special characters). If forgot login user name and password, the method to recover the password should be very secure process.

Payments – Another important part of security testing on web applications. If your website have payment page, definitely it should be secure page. Make sure cookies are not storing credit card information if page gets refreshed or navigated back or forth. Once payment is done by any method, should not be viewed in insecure way.

Confidential data – There should be authorization level of each login and defined permission to access the secure data. If you have admin permission, make sure unauthorized person does not have permission to access your web application as admin.

SQL injection – Very sensitive method to hack the secure data by injecting code through SQL injection. Hackers passes the malicious SQL queries that gets or delete or modify some data from database and causes the website to be hacked. Using SQL injection hackers could steal the data from database or could get permission to access your web application.

To perform security testing on web for SQL injection, you can take help from developers and prepare some set of queries. Try to insert those queries by any testing tool that bypasses the front end and injects directly through backend. If it is login page try to test web application by different set of data for example- $login, $password. Create some SQL queries based on data stored in database and try to run those queries from any SQL injection tool. Verify your data is not fetched after SQL queries runs by unauthorized way. Make sure firewall and other security services are working and preventing SQL query injection.

XSS – (Cross Site Scripting) – Mostly possible with Web Application. Some set of codes passed from client side application to the web page viewed to the end users. Generally in comment section hackers updates some comments with set of script and those scripts run in server and possibility is to get sensitive data. Similarly sometimes hackers bypass the page shown to the end users and passes some sensitive scripts and become success. Other important way to insert cross site scripting is, if web application has feature to upload files, hacker have really good chance to upload some malicious data.

While performing security testing on web you should keep in mind of all the security cross site scripting and you should try to test with all the possible expect and make sure web application does not allow to upload or comment with malicious data. Even it allows to insert malicious data, those data should not affect the backend.

SSL – (Source Socket Layer) – SSL certificate is a protocol that perform secure online transaction from browser to serer. The certificate implemented from server side which sends the public key to the browser and any request send to the server from browser get encrypted and reaches to the server. SSL insures that authorization of request send to the server are secure and then server decrypt the request using private key. Any request reaches to the server passes through CA (Certificate Authority) via HTTPS request.

While performing security testing on web you should check the implemented certificate is working as expected and certificate gets installed successfully in the browser.

There are many ways that you can test certificates either manually or with help of automation tools.  You can find the way how to test SSL by searching on Google.

XSRF or CSRF– Cross-site request forgery – One of the way to attack on web application and staling secure data like user name and password. XSRF attack could modify the firewall settings. Hackers could execute XARS via browser and get sensitive information from the server as response. This could be done on modifying the request URLs and send the service request to the server. During security testing you should make sure you have not missed this test and server side feature is enabled to protect XSRF attacks.

Cookies Session – Many people who perform their transaction or send any sensitive data like credit card information or user name and password to login web application, are not aware of what is cookies and what it does. But sometimes this makes them to regret and causes big loss. If web application have feature where end users need to send sensitive information to the server, there should be some feature available to execute automatically to expire the cookies session once end users completes the task. Sensitive information should not be saved in browser history and cookies.  

Hope the above information will help you to perform security testing on web application and prevent secure data to be hacked or unauthorized access.