Skip to content

Y-Security

Testing for Stack Traces

Home
Mobile Security Testing Guide
Web Security Testing Guide

Y-Security

Home
Mobile Security Testing Guide
Mobile Security Testing Guide
- 2021
  2021
Web Security Testing Guide
Web Security Testing Guide
- 2021
  2021
  - Web Application Security Testing
  - 00 Introduction and Objectives
    00 Introduction and Objectives
    
    4.0 Introduction and Objectives
  - 01 Information Gathering
    01 Information Gathering
    
    4.1 Information Gathering
    
    Conduct Search Engine Discovery Reconnaissance for Information Leakage
    
    Fingerprint Web Server
    
    Review Webserver Metafiles for Information Leakage
    
    Enumerate Applications on Webserver
    
    Review Webpage Content for Information Leakage
    
    Identify Application Entry Points
    
    Map Execution Paths Through Application
    
    Fingerprint Web Application Framework
    
    Fingerprint Web Application
    
    Map Application Architecture
  - 02 Configuration and Deployment Management Testing
    02 Configuration and Deployment Management Testing
    
    4.2 Configuration and Deployment Management Testing
    
    Test Network Infrastructure Configuration
    
    Test Application Platform Configuration
    
    Test File Extensions Handling for Sensitive Information
    
    Review Old Backup and Unreferenced Files for Sensitive Information
    
    Enumerate Infrastructure and Application Admin Interfaces
    
    Test HTTP Methods
    
    Test HTTP Strict Transport Security
    
    Test RIA Cross Domain Policy
    
    Test File Permission
    
    Test for Subdomain Takeover
    
    Test Cloud Storage
  - 03 Identity Management Testing
    03 Identity Management Testing
    
    4.3 Identity Management Testing
    
    Test Role Definitions
    
    Test User Registration Process
    
    Test Account Provisioning Process
    
    Testing for Account Enumeration and Guessable User Account
    
    Testing for Weak or Unenforced Username Policy
  - 04 Authentication Testing
    04 Authentication Testing
    
    4.4 Authentication Testing
    
    Testing for Credentials Transported over an Encrypted Channel
    
    Testing for Default Credentials
    
    Testing for Weak Lock Out Mechanism
    
    Testing for Bypassing Authentication Schema
    
    Testing for Vulnerable Remember Password
    
    Testing for Browser Cache Weaknesses
    
    Testing for Weak Password Policy
    
    Testing for Weak Security Question Answer
    
    Testing for Weak Password Change or Reset Functionalities
    
    Testing for Weaker Authentication in Alternative Channel
  - 05 Authorization Testing
    05 Authorization Testing
    
    4.5 Authorization Testing
    
    Testing Directory Traversal File Include
    
    Testing for Bypassing Authorization Schema
    
    Testing for Privilege Escalation
    
    Testing for Insecure Direct Object References
  - 06 Session Management Testing
    06 Session Management Testing
    
    4.6 Session Management Testing
    
    Testing for Session Management Schema
    
    Testing for Cookies Attributes
    
    Testing for Session Fixation
    
    Testing for Exposed Session Variables
    
    Testing for Cross Site Request Forgery
    
    Testing for Logout Functionality
    
    Testing Session Timeout
    
    Testing for Session Puzzling
    
    Testing for Session Hijacking
  - 07 Input Validation Testing
    07 Input Validation Testing
    
    4.7 Input Validation Testing
    
    Testing for Reflected Cross Site Scripting
    
    Testing for Stored Cross Site Scripting
    
    Testing for HTTP Verb Tampering
    
    Testing for HTTP Parameter Pollution
    
    Testing for SQL Injection
    
    Testing for Oracle
    
    Testing for MySQL
    
    Testing for SQL Server
    
    Testing PostgreSQL
    
    Testing for MS Access
    
    Testing for NoSQL Injection
    
    Testing for ORM Injection
    
    Testing for Client-side
    
    Testing for LDAP Injection
    
    Testing for XML Injection
    
    Testing for SSI Injection
    
    Testing for XPath Injection
    
    Testing for IMAP SMTP Injection
    
    Testing for Code Injection
    
    Testing for Local File Inclusion
    
    Testing for Remote File Inclusion
    
    Testing for Command Injection
    
    Testing for Buffer Overflow
    
    Testing for Format String Injection
    
    Testing for Incubated Vulnerability
    
    Testing for HTTP Splitting Smuggling
    
    Testing for HTTP Incoming Requests
    
    Testing for Host Header Injection
    
    Testing for Server-side Template Injection
    
    Testing for Server-Side Request Forgery
  - 08 Testing for Error Handling
    08 Testing for Error Handling
    
    4.8 Testing for Error Handling
    
    Testing for Improper Error Handling
    
    Testing for Stack Traces
  - 09 Testing for Weak Cryptography
    09 Testing for Weak Cryptography
    
    4.9 Testing for Weak Cryptography
    
    Testing for Weak Transport Layer Security
    
    Testing for Padding Oracle
    
    Testing for Sensitive Information Sent via Unencrypted Channels
    
    Testing for Weak Encryption
  - 10 Business Logic Testing
    10 Business Logic Testing
    
    4.10 Business Logic Testing
    
    Introduction to Business Logic
    
    Test Business Logic Data Validation
    
    Test Ability to Forge Requests
    
    Test Integrity Checks
    
    Test for Process Timing
    
    Test Number of Times a Function Can Be Used Limits
    
    Testing for the Circumvention of Work Flows
    
    Test Defenses Against Application Misuse
    
    Test Upload of Unexpected File Types
    
    Test Upload of Malicious Files
  - 11 Client side Testing
    11 Client side Testing
    
    4.11 Client-Side Testing
    
    Testing for DOM-Based Cross Site Scripting
    
    Testing for JavaScript Execution
    
    Testing for HTML Injection
    
    Testing for Client-side URL Redirect
    
    Testing for CSS Injection
    
    Testing for Client-side Resource Manipulation
    
    Testing Cross Origin Resource Sharing
    
    Testing for Cross Site Flashing
    
    Testing for Clickjacking
    
    Testing WebSockets
    
    Testing Web Messaging
    
    Testing Browser Storage
    
    Testing for Cross Site Script Inclusion
  - 12 API Testing
    12 API Testing
    
    4.12 API Testing
    
    Testing GraphQL

Testing for Stack Traces

ID
WSTG-ERRH-02

This content has been merged into: Testing for Improper Error Handling.

Copyright © 2021 Y-Security GmbH