Testing a software application will require you to think about various ways of attempting to break the software. A quality assurance engineer typically will be able to come up with all sorts of methods to verify the functionality of the feature or component. But you need to go deeper. Think like a malicious user, consider the cases that shouldn't be allowed, input things that no one would ever really put in, try to twist and break that application in any way you possibly can.
Take for example a web based form that has a textbox asking for the user to input a number
<form>
<input type="text" size=3 name="age">Enter your age</input>
</form>
Even though the textbox is informing the user to enter the age, think how could I break this. As the QA tester you are attempting to validate the textbox actually works. As the security tester you are verifying that the developer has coded and validated the input as it is being received. Think of ways to break this. You are not verifying that the feature works, you are verifying that nothing bad could occur if invalid data is entered. Try to think like a malicious user would. This requires time and experience to be good at this, but anyone can learn and become more proficient with security testing. Try entering some of the following combinations.
Try letters instead of numbers
Try special characters
Try double byte chars
Try encoded characters
Try to determine the boundaries; Can you enter an age of 0? Can you enter an age of 1024
Try entering nothing. Null character
Try entering an enormous entry
Try entering a SQL backtick ' if the application is fronted by a database
Try entering a ldap search query if the application is fronted by an ldap server
As you can see typically to verify the functionality of the textbox is only the start. The input must be verified and validated before the developer should even begin to use the input. Just because the textbox provides you with help to determine what should be entered in the textbox, does not mean a malicious user will also obey those suggestions.
Security testing takes a different mindset than QA testing. As a security tester you must think how to break and abuse this application as a black hat hacker or malicious user would.
Be mean to the application, try to do something that will cause problems to the underlying code. Just thinking out of the box will considerably help you on your way to become more security oriented.
To really understand how a black hat hacker or malicious user could break and abuse your software, you need to understand some of the techniques that he/she would use. You can refer the blogs under category 'Security Testing'. Each post will describe some how each of the attack methods are performed, how you can test for them, and how to block, protect, and code security protection.
Reading all of this can be a daunting task and requires a large amount of learning. To start the process, create testcases for limit and boundary conditions, test negative input, try special characters. This alone is much more than the typical feature testing that occurs within the normal software development lifecycle.
If a lot of this is over your head, don't worry, everyone started out as a beginner. Because you are here at this site means you are striving to learn. Read, learn, and digest as much information at this site and others to become more proficient at security testing.
Take for example a web based form that has a textbox asking for the user to input a number
<form>
<input type="text" size=3 name="age">Enter your age</input>
</form>
Even though the textbox is informing the user to enter the age, think how could I break this. As the QA tester you are attempting to validate the textbox actually works. As the security tester you are verifying that the developer has coded and validated the input as it is being received. Think of ways to break this. You are not verifying that the feature works, you are verifying that nothing bad could occur if invalid data is entered. Try to think like a malicious user would. This requires time and experience to be good at this, but anyone can learn and become more proficient with security testing. Try entering some of the following combinations.
Try letters instead of numbers
Try special characters
Try double byte chars
Try encoded characters
Try to determine the boundaries; Can you enter an age of 0? Can you enter an age of 1024
Try entering nothing. Null character
Try entering an enormous entry
Try entering a SQL backtick ' if the application is fronted by a database
Try entering a ldap search query if the application is fronted by an ldap server
As you can see typically to verify the functionality of the textbox is only the start. The input must be verified and validated before the developer should even begin to use the input. Just because the textbox provides you with help to determine what should be entered in the textbox, does not mean a malicious user will also obey those suggestions.
Security testing takes a different mindset than QA testing. As a security tester you must think how to break and abuse this application as a black hat hacker or malicious user would.
Be mean to the application, try to do something that will cause problems to the underlying code. Just thinking out of the box will considerably help you on your way to become more security oriented.
To really understand how a black hat hacker or malicious user could break and abuse your software, you need to understand some of the techniques that he/she would use. You can refer the blogs under category 'Security Testing'. Each post will describe some how each of the attack methods are performed, how you can test for them, and how to block, protect, and code security protection.
Reading all of this can be a daunting task and requires a large amount of learning. To start the process, create testcases for limit and boundary conditions, test negative input, try special characters. This alone is much more than the typical feature testing that occurs within the normal software development lifecycle.
If a lot of this is over your head, don't worry, everyone started out as a beginner. Because you are here at this site means you are striving to learn. Read, learn, and digest as much information at this site and others to become more proficient at security testing.
