Test automation is the use of software to control the execution of tests, the comparison of actual outcomes to predicted outcomes, the setting up of test preconditions, and other test control and test reporting functions. Commonly, test automation involves automating a manual process already in ...

learn more… | top users | synonyms

0
votes
1answer
89 views

Looking for Wepawet-like open source alternative [closed]

Is there any open source alternative to Wepawet ? I need to study techniques of JavaScript malware detection.
1
vote
2answers
70 views

Automatic vs Manual

When it comes to technologies that directly affect information security, how do you determine when it is better to use an automatic option instead of a manual option, and vice versa? I already feel ...
4
votes
4answers
344 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
2
votes
2answers
352 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
1
vote
3answers
228 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
2
votes
1answer
76 views

Test suite for a white-box fuzzer

I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
12
votes
2answers
1k views

Is there a tool to verify browser TLS/SSL configuration

I am looking for a tool to verify the configuration of ssl/tls settings in the browser. I have found a few sites that enumerate supported ciphers and the preferences but none of them seem to provide ...
4
votes
2answers
4k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
2answers
781 views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
6
votes
1answer
5k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
0
votes
1answer
243 views

Automating tests for XSS in bash?

The book:"Web Security Testing Cookbook By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
1
vote
1answer
174 views

Choosing the right tools [closed]

I'm totally new in the field of penetration testing, like almost no experience, only read lots of books and papers. I encountered lots of interesting tools during studying, many are famous like ...
4
votes
2answers
717 views

Dynamic application security testing tools

Is there a Dynamic application security testing (DAST) tool which can run over dynamic html /JavaScript ajax applications? An open source option would be ideal - or if that does not exist, then a ...
4
votes
6answers
720 views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
8
votes
2answers
251 views

How to mitigate the risk of a continuous integration service security breach?

We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and ...
8
votes
6answers
5k views

Security testing plan template or example

What does a security testing plan look like? Can anyone point out a template for such a document or an example?
4
votes
1answer
547 views

How to determine which security testing method to use if resources are limited

My resources are limited, and thus i am wondering what methodology can I apply to know where black box testing is best fit, where white box testing is best fit? Or even where pen testing is better ...
11
votes
4answers
3k views

Legitimately using tools like Havij

I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
5
votes
3answers
369 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
2
votes
1answer
429 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
3
votes
2answers
99 views

Automated browser-level countermeasures to look-alike login pages

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
8
votes
5answers
1k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
7
votes
1answer
321 views

How many iterations of fuzzing is enough?

Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code. My question: How much fuzzing is enough? Are there are any standards or best ...
3
votes
1answer
143 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
7
votes
1answer
499 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
7
votes
6answers
1k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
6
votes
4answers
794 views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or ...
12
votes
5answers
2k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
10
votes
4answers
172 views

Is external vuln scanning sufficient?

Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it? From the original Area51 proposal.
16
votes
8answers
2k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...