0 
0 What is Security Testing?
Security testing is performed to ensure that the data within an information system is protected and is not accessible by unauthorized users. It protects the applications against serious malware and other unanticipated threats that may crash it.
Security testing helps to figure out all the loopholes and weaknesses of the system in the initial stage itself. It is done to test whether the application has encoded security code or not and is not accessible by unauthorized users.
Security testing mainly covers the below critical areas:
- Authentication
- Authorization
- Availability
- Confidentiality
- Integrity
- Non-repudiation
Purpose of Security Testing
Given below are the prime purposes of performing Security Testing:
- The primary purpose of security testing is to identify the security leakage and fix it in the initial stage itself.
- Security testing helps to rate the stability of the current system and also helps to stand in the market for a longer time.
The following security considerations need to be performed during every phase of the software development lifecycle:
Need for Security Testing
Security testing helps to avoid:
- Loss of customer’s trust.
- Loss of important information.
- Information theft by an unauthorized user.
- Inconsistent website performance.
- Unexpected breakdown.
- Additional costs required for repairing websites after an attack.
=> Contact us to suggest a listing here.
Best Open Source Tools for Security Testing
#1) Acunetix
Acunetix online is a premium security testing tool worth trying. You can get the trial version for Acunetix here.
Acunetix Online includes a fully automated network vulnerability scanner that detects and reports on over 50,000 known network vulnerabilities and misconfigurations.
It discovers open ports and running services; assesses the security of routers, firewalls, switches, and load balancers; tests for weak passwords, DNS zone transfer, badly configured Proxy Servers, weak SNMP community strings, and TLS/SSL ciphers, among others.
It integrates with Acunetix Online to provide a comprehensive perimeter network security audit on top of the Acunetix web application audit.=> Visit Official Acunetix Website Here
#2) Netsparker
Netsparker is a dead accurate automated scanner that will identify vulnerabilities such as SQL Injection and Cross-site Scripting in web applications and web APIs including ones developed using open source CMS.
Netsparker uniquely verifies the identified vulnerabilities proving they are real and not false positives, so you do not need to waste hours manually verifying the identified vulnerabilities once a scan is finished. It is available as Windows software and online service.=> Visit Netsparker Official Website
#3) ZED Attack Proxy (ZAP)
It is an open-source tool that is specifically designed to help security professionals to find out the security vulnerabilities present in web applications. It’s developed to run on Windows, Unix/Linux, and Macintosh platforms. It can be used as a scanner/filter of a web page.
Key features:
- Intercepting Proxy
- Passive Scanning
- Automated Scanner
- REST-based API
Open Web Application Security Project (OWASP)
The application is dedicated to providing information about application security.
The OWASP top 10 web application security risks, that are commonly found in web applications are Funct Access Control, SQL Injection, Broken Auth/Session, Direct Object Ref, Security Misconfig, Cross-Site Request Forgery, Vulnerable Components, Cross-Site Scripting, Unvalidated Redirects, and Data Exposure.
These top ten risks will make the application harmful because they may allow the stealing of data or completely take over your web servers.
We can execute OWASP using GUI as well as command prompt:
- Command to trigger OWASP through CLI — zap-cli –zap-path “+EVConfig.ZAP_PATH+” quick-scan –self-contained –spider -r -s xss http://”+EVConfig.EV_1_IP+” -l Informational.
- Steps to run OWASP from GUI :
- Set the local proxy in the browser and record the pages.
- Once recording gets completed, right-click on the link in the OWASP tool, and then click on ‘active scan’.
- After the completion of scanning, download the report in a .html format.
Other options to execute OWASP:
- Set the local proxy in the browser.
- Enter the URL in the ‘URL to attack’ textbox and then click on the ‘Attack’ button.
- On the left side of the screen, view the scanned sitemap content.
- At the bottom, you will see view request, response, and bug severity.
GUI Screenshot:
Download ZED Attack Proxy (ZAP)
#4) Burp suite
It is a tool that is used for performing security testing of web applications. It has professional as well as community editions. With over 100 predefined vulnerability conditions it ensures the safety of the application, Burp suite applies these predefined conditions to find out the vulnerabilities.
Coverage:
More than 100+ generic vulnerabilities such as SQL injection, cross-site scripting (XSS), Xpath injection …etc. have been performing in an application. Scanning can be performed at a different level of speed as fast or normal. Using this tool, we can scan the entire application or a particular branch of a site, or an individual URL.
Clear Vulnerability Presentation:
Burp suite presents the result in a tree view. We can drill down to the details of the individual items by selecting a branch or node. The scanned result comes up with a red indication if any vulnerability is found.
Vulnerabilities are marked with confidence and severity for easy decision making. Detailed custom advisories are available for all the reported vulnerabilities with a full description of the issue, confidence type, issue severity and path of the file. HTML reports with the discovered vulnerabilities can be downloaded.
Download link
#5) SonarQube
It is an open-source tool that is used to measure the quality of source code.
Though written in Java, it can analyze over twenty different programming languages. It can easily integrate with continuous integration tools like Jenkins server, etc. The results will be populated to the SonarQube server with ‘green’ and ‘red lights’.
Nice charts and project level issue lists can be viewed. We can invoke it from the GUI as well as the command prompt.
After successful install, the SonarQube directly uploads the result to HTTP: Ip:9000 web server, Using this URL we can see a detailed result with many classifications.
Installation SonarQube
Project wise Home Page:
This tool classifies the bugs by various conditions like Bugs, vulnerability, code smells, and code duplication.
Issue List:
We will be taken to the issue list page if we click on the bug count in the project dashboard. Bugs will be present with factors like severity, status, assignee, reported time and time taken to fix the issue.
Detect Tricky Issues:
The issue code will be marked by a red line and nearby that we can find suggestions to fix the issue. Those suggestions will really help to fix the issue quickly.
Download link
#6) Klocwork
It is a code analysis tool that is used to identify security, safety and reliability issues of the programming languages like C, C++, Java, and C#. We can easily integrate it with continuous integration tools like Jenkins and can also raise bugs in Jira upon encountering new issues.
Project wise Scanned Result:
Printout of the result can be taken using the tool. On the home page, we can view all the scanned projects with their ‘new’ and ‘existing’ issue count. The range and ratio of the issue can be viewed by clicking on the ‘Report’ icon.
(Note: Click on the below image for an enlarged view)
Detailed Issue:
We can filter the result by entering various search conditions in the ‘search’ textbox. Issues are presented with severity, state, status and taxonomy fields. By clicking on the issue, we can find the line of an issue.
(Note: Click on the below image for an enlarged view)
Mark the Issue Code:
For quick identification, Klocwork highlights the issue raised ‘line of code’, cites the cause of the issue and suggests few measures to overcome the same.
Export to Jira:
We can directly raise a Jira by click on the “Export to Jira” button from the klocwork server.
Integration with Jenkins:
Jenkins has a plugin to integrate with klocwork, Firstly, we need to configure klocwork details in the Jenkins configure page and after that Jenkins will take care of uploading the report to klocwork server once the execution is done.
Jenkins Configuration for Klocwork:
Download link.
