© 2017
For more details see an article on Website cookie testing. URL Manipulation through HTTP GET methods. A tester should check whether the application passes important information in the query string or not. This happens when the application uses the HTTP GET method to pass information between the client and the server. The information is passed through the parameters in the query string. The tester can modify a parameter value in the query string to check if the server accepts it. Kali Linux on AWS By Frank Siemons on October 12, 2017 The Top 5 Pen Testing Tools You Will Ever Need By Ravi writerrevisions editor on July 26, 2017. Via HTTP GET request user information is passed to the server for authentication or fetching data. The attacker can manipulate every input variable passed from this GET request to a server in order to get the required information or to corrupt the data. In such conditions, any unusual behavior by application or web server is the doorway for the attacker to get into an application. SQL Injection. The next factor that should be checked is SQL injection. Entering a single quote in any textbox should be rejected by the application. Instead, if the tester encounters a database error, it means that the user input is inserted in some query which is then executed by an application. ADNupMnWyR7kCWRvm76Laz/resize=width:705/https://d2vvqscadf4c1f.cloudfront.net/zWwVcSWSyujGlH9Y1Qh8_IOS%20Thumbnail.jpg' alt='Basics Of Hacking And Penetration Testing' title='Basics Of Hacking And Penetration Testing' />In such a case, the application is vulnerable to SQL injection. SQL injection attacks are very critical as an attacker can get vital information from the server database. To check SQL injection entry points into your web application, find out the code from your codebase where direct My. SQL queries are executed on the database by accepting some user inputs. If the user input data is crafted in SQL queries to query the database, an attacker can inject SQL statements or part of the SQL statements as user inputs to extract vital information from a database. Even if an attacker is successful to crash the application, from the SQL query error shown on a browser, the attacker can get the information they are looking for. Special characters from user inputs should be handledescaped properly in such cases. Cross Site Scripting XSSA tester should additionally check the web application for XSS Cross site scripting. Any HTML E. g. lt HTML or any script E. SCRIPT should not be accepted by the application. If it is, then the application can be prone to an attack by Cross Site Scripting. The attacker can use this method to execute malicious script or URL on the victims browser. Using cross site scripting, an attacker can use scripts like Java. Script to steal user cookies and information stored in the cookies. Many web applications get some useful information and pass this information in some variables from different pages. E. g. http www. The attacker can easily pass some malicious input or lt script as a query parameter which can explore important userserver data on the browser. Important During Security testing, the tester should be very careful as not to modify any of the following Configuration of the application or the server Services running on the server Existing user or customer data hosted by the application. Adobe Premiere Cs4 Tutorials Free. Additionally, a security test should be avoided in a production system. Conclusion. The purpose of a security test is to discover the vulnerabilities of the web application so that the developers can remove these vulnerabilities from the application and make the web application and data safe from any unauthorized action. About the Author This is a guest article by Inder P SinghFeel free to share your commentssuggestions about this article.