Audience
The course is designed for software testers and test managers who will be involved in the security testing of Web sites and applications.
Prerequisites
A good knowledge of Internet architecture and Web software testing.
Attending our Web Software Testing course would be an ideal prerequisite.
Duration
2 days.
Lecture presentations are supported by a number of Web sites designed for training purposes, which allow reinforcement of learning and hands-on testing. In addition, various security testing tools will be demonstrated.
This course is available on site only. Please call for details.
Course Objectives
Security, or lack of it, is perceived as a major problem for any form of on-line transaction. Whereas no system will ever be 100% secure, there are a number of security measures that can, and should, be implemented to ensure that the users of a website can be confident their data is reasonably protected.
This course introduces attendees to the security problems associated with websites and Web applications and how to test the security measures which have been put into place. The course emphasis is on security tests which can be performed during normal functional testing.
At the end of the course attendees will be able to:
- Examine a security policy and specify the types of tests necessary to ensure that the requirements contained in the policy are being met
- Scope security testing and create tests, test cases and test scripts
- Communicate adequately with appropriate technical personnel to ensure that the correct test or production environments are available
- Understand the capabilities of simple security testing tools and make a significant contribution to tool selection
- Execute basic security tests and understand the results
- Communicate with security professionals and external agencies where there is a requirement for detailed, focused security testing
Course Content
Testing Security
How big is the problem, where is the problem
Vulnerability likelihoods
Common attack methods and vulnerabilities
Security policies, building a policy
Hackers
Security testing techniques
Manual inspections & reviews
Gap analysis, threat modelling, attack trees
A framework for testing
Network Architecture
Communication protocol models, the four-layer model
Packets, Internet Protocol, IP addresses, IP v4 and v6
Transmission Control Protocol, three-way handshake
HyperText Transfer Protocol (HTTP/1.1 and HTTP/2)
HTTP methods GET and POST
Universal Resource Locators (URL)
Wired networks, wireless networks, IP spoofing
Secure Sockets Layer and Transport Layer Security
Encryption, Public Key Infrastructure (PKI)
SSL sessions, wireless encryption
Firewalls
What firewalls can and can't do
Packet filtering, screening routers, proxy servers
Network Address Translation (NAT)
Types of firewall configuration
Information Gathering
Mapping the network topology, scoping the test effort
IP address inventory, Ping sweeps
Service/socket inventory, port scanning
Hardening the system software
Spiders, robots and crawlers
Web application fingerprinting
Using site maps
Testing source code, testing for error code
Testing for weak cipher levels, testing certificate validity
Testing for file extension handling
Old, backup and unreferenced files, server logs
Evaluating intruder detection, intruder detection systems
Authentication Testing
Testing the registration process
Credentials transport testing
Parameter modification
Testing for user enumeration
Default or guessable user accounts, brute force
Weak lockout mechanism
Password remember and reset
Social engineering and insiders
Authorisation testing
Direct page requests
Logout testing, cached pages
Business Logic Testing
Testing integrity checks
Circumvention of workflows
Testing process timing
Multiple function use
Testing defences against application misuse
State transition diagrams, state tables
Uploading unexpected file types
Uploading malicious files
Session Management
Hidden fields, manipulating CGI parameters
Analysis of session management
Cookie poisoning, Cookie reverse engineering
Session IDs in URLs
Session timeouts
Session hijacking and session fixation
Overflow
Exposed session tokens
Data Validation Testing
SQL injection
Relational databases, Structured Query Language
Testing for SQL injection
Testing for authorisation bypass attacks
Testing for SELECT statement attacks
URL-based SQL injection
Testing for INSERT statement attacks
Cross Site Scripting (XSS), phishing
Reflective and persistent XSS
Cross Site Request Forgery (CSRF)
Clickjacking
HTTP verb tampering and Cross Site Tracing
Code and command injection
File inclusion
Buffer overflows