I would like to ask about the differences between Software Testing and Web Application Penetration Testing.
I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) and Web App Pentesting (BurpSuite, SQLMap, etc.).
Also I would like to know if these two disciplines cross over and a Software Tester can become a good Web App Pentester and vice versa?
Many thanks.
I'll put a slight different spin on the second part of your question concerning discipline cross-over, since I have experience doing these in my career.
A good Penetration Tester has a hacker mindset. They work to defeat what security protections have been put in-place, by whatever creative means available to them and their knowledge set. A good PenTester does NOT think like an end-user, but rather thinks in a way to get around rules, restrictions, and blockages. They don't test whether what security protections that were put into place are working properly; they are seeking where the design of the IT system failed to address and mitigate a vulnerability.
A Software Tester generally focuses on testing that the software performs properly according to the requirements. Its mostly grunt work, hopefully using tools to automate that testing. Since the perfect software testing somehow tests EVERY line of code, its alot of grunt work to create more and more test procedures to cover all the lines of code. Note that for the most part, traditional software testing does NOT perform a lot of "negative"/ "failure" test cases, it makes sure that when end-users use the software CORRECTLY that the software also performs CORRECTLY. One usually finds few if any tests of when the end-user uses the software INCORRECTLY, and how the software handles that.
You will find there is also a specialty as a System Security Tester or Software Security Tester. That person usually has a mindset and a knowledge-base that sits between the extremes of the conformance-focused Software Tester and the break-it focus of the Penetration Tester. Usually a system/software security test will validate that CORRECT use of the security features will allow the Authorized end-user to interact with the software as-planned. And will usually test a set of pre-defined and well-known INCORRECT uses of the security features, which should results in logs and blocks of the incorrect usage.
So to summarize:
I would say you should view relationships between these 3 types of activities like that: penetration testing is a subtype of security testing which is in turn is a subtype of software testing. Security testing deals with very specific types of defects: security defects; ones that could result in compromised system, ruined reputation and stained public profile or direct financial losses for web application's owner.
Concerning the second part of your question - that depends. Security testing deals mostly with the processes happening "under the hood" of a web service, be it its client-side part, or backend part. So, if you are mostly deal with GUI/localization/Usability/etc testing, I wouldn't expect this experience to help you become proficient as security tester. Functional testing is a different issue. In fact, according to OWASP methodology, there is a group of security defects - defects in buisness logic - that require the same approach one would use for typical functional testing. So the verge is rather vague.
But, in general, security testing involves much more technical knowledges than functional testing usually do. And despite the later still can provide you with solid foundation in form of learning to implement systematic approach to the task, developing abilities to pre-plan your activities and acquiring some general IT-related knowledges, I can't say they are really "crossed over" so much.
I'll explain in rather simple words by explaining what actually they do.
Lets start with penetration testing, as I work as one !!
Penetration Testers usually are assigned a project (in your case a web application) to test , They go through the website ,Do some reconnaissance and try to find important functions of the web application e.g. For a Ecommerce website it may be the shopping cart or payment gateway. So Pentesters try to bypass normal procedures in the web application and exploit the security loopholes to find out if certain thing can be accessed or done which the end user is not privileged to do. At last they document the findings, Make a detailed report and give it to the clients.Note that pentesters only suggest what changes are required and its job of the developers to do it.
Software Testers on other hand have better coding knowledge and they try to find the errors in the logic used by the developer. They might use tools or do it manually , but the focus is to improve logic and bad codes and compatibility issues.
Hence these two fields might sound similar but are very different from each other. Now as far as crossover is concerned Software Testers can become Application security testers like they can test the application code for security flaws but skillset required for penetration tester is completely different.
A short and sweet answer would be: Software Testing revolves around code review and compliance with secure coding practices. A Penetration Tester utilizes various methods to emulate an attack and fully exploit a target system/network.
They're related because a Penetration Tester may gain access to your system through exploitable software(I.e. buffer overflows) on the network.
On Software Testing:
If you sign up for Fortify-On Demand at http://hpfod.com, you will notice that there are a variety of offerings, the primary three being dynamic security analysis, static security analysis, and mobile analysis.
A few others such as IBM and Cigital mirror this model. All three of these vendors supply Software-Testing-as-a Service (STaaS) capabilities, but none of these are a penetration test. They are security-focused software testing. This is the best test automation in the appsec world that money can buy.
While I have not kept up with test automation in the quality space, all three vendors still perform software quality testing in addition to software security testing.
The best book on software security testing is "The Art of Software Security Assessment", and for software quality testing, "How to Break Software: A Practical Guide to Testing". I personally believe there are cross-over techniques one can utilize from one to the other. Web application security testing, with free resources such as the OWASP Testing Guide v4 -- or the book, "The Web Application Hacker's Handbook, 2nd Edition" -- is a distinct field, as well as mobile app security testing, where the book "The Mobile Application Hacker's Handbook" provides context. Again, I do believe that software quality testing knowledge aids the process. However, these books' methods will not turn your test into a penetration test and the tools/techniques employed will not turn you into a penetration tester.
For the Continuous Integration and Continuous Delivery (CI/CD) app development world, Jenkins, Ant, and Maven have integration to appsec with the OWASP Dependency-Check tool (and the OWASP Dependency Track project). Maven, Ant, and Ivy could also leverage the older Victims project, but I prefer the OWASP one. For Javascript, the OWASP Dependency-Check tool has a class that covers it partially, but the retire.js project provides additional work. There are also strong framework-level appsec integrations such as OWASP ESAPI, Spring Security, and a few libraries that are Node.js or Express integrateable such as Lusca (with Helmet), Kraken.js, Sails.js, etc. There are many component-level improvements to talk about as well, but let's leave that for a separate conversation. In summary, appsec at the software level is more about TDD (at the unit level, useless for security purposes), construction, and build than about security testing.
On Penetration Testing:
Penetration Testing is a completely separate topic. I do not believe that many software testers, no matter how good they are, will make themselves into experts at penetration testing. There are many facets to penetration testing, including deep knowledge of apps AND networks (e.g., network engineering, network security), fingerprinting, enumerating, service identification, protocols, advanced-evasion techniques (AET), social engineering (e.g., spear phishing), watering-hole attacks (e.g., traffic-distrbution systems aka TDS), botnets (e.g., domain-generation algorithms aka DGAs), et al. The knowledge required for deep system analysis is rather uniquely specialized. I believe it is limited to only people who will stop at nothing to deeply understand and analyze every component down to the bit and pattern level. This requires an enormous amount of time and patience. One almost has to give up their informal-learning progression of app development or software quality practices in order to "switch" to the penetration-testing mindset.
The best way to become a penetration tester is to go through all of the Offensive Security and Corelan material, as well as attend some top-tier courses such as thes ones available at BlackHat Training. If you can attend several Derbycons, go through every Derbycon video on Irongeek, and understand 95 percent of the material as deeply as the presenters -- then you can make a mark in penetration testing.
You would not want to specialize in web penetration testing at this time. From a time period between 1993 and 2006, this may have been a worthwhile pursuit. The problem is that today there are many technologies in use, e.g., Java applets, Web Services, Ajax, Adobe Flash, Silverlight, WCF, Apache Flex, etc -- and these require the full penetration-testing knowledge. You can't get away with specializing in a world with wearables, IoTs, digital wallets, mobile devices, mobile apps, and all of these other integrateable components. Penetration testing must take a whole-system approach. It is driven by models and frameworks that focus deeply on analysis.
A true penetration tester can also take his or her capabilities "to the next level" with adversary simulation. The OPFOR would know how to employ analytical tools and techniques such as Red Teaming Analysis (RTA) and Multiple Scenarios Generation. In 2015, this means being able to bypass a variety of controls and countermeasures, as well as the human elements. These are risk hunters who hunt the threat hunters who hunt them. This involves much more than social engineering, network/web/app penetration, et al. It can go beyond even elicitation, investigation, TECHINT, FININT, and CI HUMINT. There are hybrid socio-technical systems models that can describe human, cyber, and physical elements. These dynamical models would typically integrate game theory, deception (i.e., simulation, and dissimulation), and counter deception.
software testing focus on verification and validation of functional and non functional requirements where as penetration testing checks to see if a person can exploit vulnerabilities of a software application
Software testing team will do software quality testing whether it meets quality standard prescribed by organization or any standard it follows. It will also assess whether software meets business requirement given by stakeholders . Penetration testing team will assess technical flaws in the application whether all validations are applied or not, whether any attacker can circumvent the logical flow of software.
