What is Security Testing and How to Implement Security Testing on a Web App
                     What is Security Testing and How to Implement 
Security Testing on a Web App?
Security testing on the web is protecting the web application from all the vulnerability. 
Prevent all the secure data to be published or seen by unauthorized people. All the secure 
data should be secured and should not be available to others who do not have the authority 
to access. There could be various causes that could break the security end of your web app 
and hack or take personal data.
Here are a few fields that you should concentrate more while working on security testing of 
   a    w  eb application :
Login – the Most important part where you should focus more. The app should never let 
anyone log in with wrong credentials. While signing up or creating username and password 
for any login, it must be important to create a secure password (Combination or caps, small 
letters, numbers and special characters). If forgot login user name and password, the process 
to retrieve the password should be a very safe process.
Payments – Another critical part of security testing on web apps. If your website has a 
payment page, clearly it should be a secure page. Make sure cookies are not storing credit 
card data if the page gets refreshed or navigated back or forth. Once payment is made by any 
means, should not be viewed in an unsafe way.
Private data – There should be a permission level of each login and defined authority to 
access the secure data. If you have admin approval, make sure the unauthorized person does 
not have authority to access your web application as an admin. 
SQL injection – Susceptible method to hack the protected data by injecting code through 
SQL injection. Hackers pass the malicious SQL queries that get or remove or alter some data 
from the database and prompts the website to be hacked. Using SQL injection, hackers 
could take the information from the database or could get approval to access your web app.
To complete security testing on the web for SQL injection, you can take help from 
developers and prepare some set of questions. Try to include those questions by security 
testing tools that bypasses the front end and injects straight through the backend. If it is 
login page, try to test web app by a different set of data for example- login, password. 
Create some SQL queries based on data stored in the database and try to run those queries 
from any SQL injection tool. Check your data is not retrieved after SQL queries run by the 
unauthorized way. Make sure firewall and other security services are running and 
preventing SQL query injection.
XSS – (Cross Site Scripting) – Mostly likely with Web Application. Some set of codes 
transferred from the client-side app to the web page viewed to the end users. Usually, in 
comment section hackers updates, some comments with a set of text and those scripts run 
in server and probability is to get sensitive data. Furthermore, sometimes hackers bypass 
the page shown to the end users and pass some exposed scripts and become a success. 
Another significant way to insert cross-site scripting is, if the web app has a feature to 
upload files, the hacker has a perfect chance to upload some malicious data.
SSL – (Source Socket Layer) – SSL certificate is a protocol that offers reliable online 
transaction from browser to server. The certificate executed from server side which sends 
the public key to the browser and any request to present to the server from browser get 
encrypted and reaches to the server. SSL guarantees that authorization of request transfers 
to the server is secure, and the server decrypts the app using the private key. Any claim 
arrives the server passes through CA (Certificate Authority) via HTTPS request.