Web Application Security Test

Web Application Security Test

Definition: Application security is the use of software, hardware, and procedural methods to protect applications from external threats. Security measures built into applications and a sound application security routine minimize the likelihood that hackers will be able to manipulate applications and access, steal, modify, or delete sensitive data. Once an afterthought in software design, security is becoming an integral part of the design process.

Following are different tests to check the application security.

Data injection and manipulation attacks.
1. Reflected cross site scripting. (XSS).
2. Persistent XSS.
3. Cross site request forgery.
4. SQL Injection.
5. Blind SQL injection.
6. Buffer overflows.
7. Integer overflows.
8. Log injection.
9. Remote file include (RFI) injection.
10. Server side include (SSI) injection.
11. Operating command injection.
12. Local file include (LFI)
13. Parameter Redirection.
14. Auditing of redirect chains.

Sessions and authentications
1. Session strength.
2. Authentication attack.
3. Insufficient authentication.
4. Insufficient session expiration.

Server and general HTTP
1. AJAX auditing.
2. FLASH analysis.
3. HTTP header auditing.
4. Detection of client side technologies.
5. Secure sockets layer (SSL) certificate issues.
6. SSL protocol supported.
7. SSL ciphers supported.
8. Server misconfiguration.
9. Directory indexing and enumeration.
10. Denial of service.
11. HTTP response splitting.
12. Windows 8.3 file name.
13. DOS device handle DoS.
14. Canonicalization attacks.
15. URL redirection attack.
16. Password auto complete.
17. Custom fuzzing.
18. Path Manipulation - traversal.
19. Path truncation.
20. WebDEV auditing.
21. Web services auditing.
22. File enumeration.
23. Information disclosure.
24. Directory and path traversal.
25. Spam gateway detection.
26. Brute force authentication attack.
27. Known application and platform vulnerabilities.
Source: HP WebInspect.


One of the best site for understanding different threats, select this link.



List of tools available in the market.
OWASP Security Testing Tools Listing
HP WebInspect
IBM Rational AppScan
Powerfuzzer
SecPoint Penetrator 
Netsparker
ZeroDayScan 
Fortify 360
OWASP Security Testing Tools 
Retina Web Security Scanner 
Hailstorm
GamaSec
 Wikto
Nikto Scanner
Acunetix Web Vulnerability Scanner 
Defensics Core Internet Test Suite
Perimeter Check
Core Impact Pro
C5 Compliance Platform 
Snort
SecurityMetrics Appliance
Nessus
Security Center
SARA
Qualys Free Security Scans
 GFiLANguard
Qualys Guard 
PatchLink Scan 
Secure-Me
SAINT
NMap Network Mapper -
NetIQ Security Analyzer
Foundstone
CERIAS Security Archive
StopBadware Vulnerability Scanner list






----