Security Testing Introduction

1. What is Security Testing?

• Security testing itself explicate that how tin nosotros protect our personal information yesteryear hacking, code harm or unauthorized user.
• Security testing is the procedure that determines the personal information needs to live on remain protected. Data which is non meant to part too discussed to other user that would non live on allowed to explore too user must live on able to produce those trouble which is authorized to them only. No other functioning should live on allowed to perform amongst saved too protected data.
• For example, if or thence website create got their ain fundamental for Login functionally. Without that Key unauthorized user tin piece of work on this site yesteryear hijacking. This is the big vulnerability of that site. 
• Also nosotros tin accept an instance for Bank Networking systems.
• By testing a security, nosotros tin detect the loopholes inward application too later on solving them nosotros tin protect our data. The principal destination of safety testing is the organisation reaction when unauthorized functioning create got been performed too how to forestall them to access data.
• System analysis tin perform a major component here. We must create got organisation cognition earlier nosotros create got maiden of all safety testing.

2. What should live on the approach of Security testing?

• Security Testing is non entirely the component of the testing phase. As per software evolution life cycle, Security tin live on discussed from analysis stage only.
• At Analysis stage application modeling or blueprint tin live on reviewed.
• At evolution phase, ane circular of safety testing tin live on done yesteryear developer also.
• At testing phase, Vulnerability too penetration testing tin live on done yesteryear the testers too item study tin live on prepared.
• Here nosotros necessitate to accept assist almost ane thing, By applying scenario for safety testing , required Functionally of an application should non live on ignored.
•  This is the correct approach to verify safety for the application or website. 

3. Why Security testing is needed?

• This testing comes nether non-functional testing roof. Thus, inward most of the case, People tin ignore this too concentrate on Functional testing.
• But similar a shot a 24-hour interval when hackers tin detect vulnerability really easily inward each spider web site or application thence people create got to brand efforts for safety testing. 
• Even Functionality is working fine but what if your site volition live on hacked too user volition non live on able to access their protected information further?
• Thus Security testing is equally of import equally functionality testing too GUI testing.
• For Example, if you lot desire to transfer coin from ane delineate of piece of work organisation human relationship to or thence other delineate of piece of work organisation human relationship thence coin should live on transfer from your authorized delineate of piece of work organisation human relationship only. If you lot volition move inward whatever other delineate of piece of work organisation human relationship details too Bank volition live on let transferring coin to or thence other delineate of piece of work organisation human relationship thence it volition live on a major põrnikas of Bank networking system.
• 
  
• Same agency nosotros tin accept instance for OTP message which tin live on sent piece coin transaction from ane delineate of piece of work organisation human relationship to or thence other account. Here OTP must live on sent to authorize mobile seat out entirely too End users create got to move inward that OTP on banking enterprise spider web site for transferring the money.

4. Security Testing Techniques :

• There are thence many techniques for safety testing. We tin catch below techniques.
• Vulnerability assessment: To course of study the loopholes from the computer, network or communication infrastructure vulnerability assessment tin live on used.
• Static Analysis: Program too code analysis tin live on done inward this technique too nosotros tin analyze this amongst job of unlike tools.
• Penetration Testing: Process of gathering information almost the target or position points from where assailant tin move inward to the application tin live on known equally penetration.
• Fuzz Testing: This testing tin live on used to exceed thence many random information to the application equally fuzz too verify that application take away whether it volition crash or not.
• Further techniques volition live on explained inward item inward side yesteryear side article. This all are the basic technique for safety testing.

5. When to halt safety testing? OR Can nosotros hand a Security Certificate for our application?

• Well, nosotros tin order the safety testing is never ending procedure or nosotros cannot hand whatever certificate for assuring safety of whatever application.
• But equally nosotros are defining Functional testing yesteryear verifying all the requirement of application, the same agency nosotros tin define safety for each module or sub method of application.

Security Testing Approach Amongst Unlike Attributes

Security testing is the most of import testing type for finding vulnerability inwards the spider web site. Now a day’s Online transaction cause got taken house for each spider web site so safety testing is the major activity which needs to travel perform inwards testing stage of software testing life cycle. To gain the trust of customers towards spider web sites, safety confirmation is given positive direction. Detail description of safety is explained below.

There are Seven Attributes for Security Testing:

1. Authentication: Authentication is the procedure for identifying user whether they are let to access file or information of server. Who volition travel able to verify the information that answer tin travel given yesteryear authentication. For example, a somebody needs to give biographic identity to travel inwards in the office. This procedure is mandatory for most of the application. Only desktop applications don’t usage it much equally that tin travel access yesteryear a somebody only. Authentication tin travel occurred when to a greater extent than than 1 somebody volition cause got access of the system. Third political party spider web API, networking systems together with servers usage authentication. 

2. Authorization: Authorization is the procedure to create upwards one's hear who has permission to become inside. Like afterward giving proper id together with password, User tin access information of website or afterward entering the authentication primal user tin access all data. Authorization tin travel a procedure which allows to access item constituent of the organization amongst roles together with permissions. We tin cause got illustration of admin operate together with client operate inwards system. As per defined role, they cause got dissimilar permission similar admin cause got all rights to command the organization piece client volition cause got rights to come across the items together with social club for same. Customer should non travel able to modify the cost of an item equally that permission is non given yesteryear admin to client role. Thus, nosotros tin nation potency tin travel a constituent of each application or system.  

3. Encryption: Encryption is the procedure to top out the information through a channel amongst decryption primal which is non known to anyone. Like, about passwords cause got code give-and-take so unauthorized somebody volition non recognize the same. We tin also cause got illustration of soil forces projects where information tin travel transferred amongst decrypted shape together with It tin travel understood yesteryear soil forces officers only.

4. Confidentiality: west e tin connect confidentiality amongst privacy. It is basically designed to preclude sensitive information from unauthorized somebody together with it makes certain that the right together with authorized people tin access the data. Confidentiality tin travel categorized amongst dissimilar methods. For example, piece creating an concern human relationship amongst about sites, they inquire questions inwards damage of safety together with when you lot demand to modify password for same account, you lot cause got to answer it correctly so together with entirely so you lot volition travel able to access your personal account.

5. Integrity: Consistency of huge data, accuracy & ethical information tin travel maintained yesteryear Integrity over whole life wheel of application. Data should non travel changed or altered yesteryear unauthorized somebody that is controlled amongst integrity. For example, Confidentiality should non travel changed yesteryear incorrect people. Integrity takes assist virtually file permission together with user access control. Version command of an application tin travel maintained amongst integrity. Cryptographic is primary attribute of integrity. Unauthorized somebody volition non travel able to modify together with supervene upon information therefore integrity volition protect data.

6. Availability: To primary the hardware availability is mainly used. To repair hardware similar a shot inwards damage of operating organization is big challenge which tin travel overcome yesteryear availability. It is of import to croak along all necessary organization upgrade. To ensure virtually the information when it requires it is the Definition of availability. Providing communication bandwidth together with preventing safety is also a constituent of hold a system. One to a greater extent than wages of availability is, when whatsoever server crash together with eclectic work removes all information of application at that fourth dimension backups or redundancy volition travel available to restore the data. 

7. Non-Repudiation: This is the procedure which assures that incorrect somebody cannot contradict something inwards data. In electronic communication repudiation is mainly used where 1 somebody cannot travel confirmed equally recipient or signing a document. This is unremarkably applies inwards instance of quondam contract, a communication channel or transfer of the data. The primary aim of repudiation is, parties tin communicate or transfer document to deny the authenticity of their signature on contract.  Thus, parties are the originator of a item message to transfer.

These are the primary together with basic attributes which tin travel taken assist piece creating whatsoever spider web or mobile application.

Wireless Security

Wireless safety is connected amongst the protection of device similar computers, laptops, mobile phones, tablet which is attached amongst external network. How tin give notice nosotros command threats in addition to vulnerability of external network amongst our connected device is the principal aim of wireless security.

Wireless communication is done on air amongst abide by to dissimilar devices Like WI-FI, Bluetooth, satellite communication & mobile communication. This is really mutual communication aspects which is used yesteryear everyone straightaway a day’s but in that place are for certain elements which are used every bit keep safety of LAN (Local Area Network). Network safety is 1 of the major concern of all the organisation whether it is minor or large.

First chemical cistron nosotros tin give notice state that the blueprint of your wireless network. How the Wi-Fi network excogitation volition locomote effective in addition to beneficial that must locomote discussed. Strategic planning for what types of device y'all volition require in addition to how many it volition require.

Second matter is item analysis most the capability of your wireless device. It is ever skillful to create validation testing for your blueprint every bit it volition locomote to a greater extent than helpful or non every bit per your plan.

Third matter is locomote amongst correct wireless service provider. Influenza A virus subtype H5N1 skillful wireless device volition serve y'all the best character which volition heighten your trouble organisation Objectives in addition to goals. Afterwards nosotros tin give notice motion amongst about facts yesteryear which nosotros tin give notice protect wireless safety yesteryear discouraging unauthorized person, yesteryear preventing unofficial connection, yesteryear protecting information spell it volition transfer through encryption.

There are available solution for wireless LAN safety similar WPA (Wi-Fi Protected access), WPA2 (Wi-Fi Protected access 2), VPN (Virtual Private Networking), WEP (Wired Equivalent Privacy). It volition locomote discussed inwards farther articles.

Wireless access is existence deployed inwards business office every bit good every bit inwards world environs in addition to home. There are about basic wireless technologies. We volition verbalise over same inwards detail.

1. Wireless Local Area Network (WLAN): This technology scientific discipline is using high frequency radio waves to transfer in addition to communication of information betwixt attached network devices.
2. Access point: Access call for is hardware device which allows wireless communication inwards devices. For example, PDA (Personal Digital Assistance). It combines reckoner in addition to network networking features. PDA tin give notice business office every bit fax sender.
3. Service Set Identifier (SSID): This provides basic configuration betwixt wireless clients to communicate amongst proper access point. Only clients who induce got valid SSID, They tin give notice communicate further. SSID locomote every bit unmarried password betwixt ii access points in addition to clients.
4. Open System Authentication: This is authentication protocol provides 802.11 standard. It is combination of authentication asking in addition to authentication response. Authentication asking contains station ID. Authentication answer contains success in addition to failure data. If answer is successful in addition to hence nosotros tin give notice state that ii nodes are authenticated. For providing improve security, wired equivalent privacy protocol induce got been used. This protocol is used for encrypting the data.
5. Shared Key authentication: By using WEP (Wired Equivalent Privacy) in addition to hugger-mugger key, authentication betwixt ii devices induce got been done amongst shared key authentication. It industrial plant amongst challenge in addition to answer mechanism.  WEP encrypted the challenge text using shared hugger-mugger key in addition to customer induce got to render the encrypted challenge text for access call for verification. If access call for volition decrypt in addition to hence in addition to entirely in addition to hence authentication is accepted.
6. Ad Hoc Mode: This is authentication protocol provides 802.11 standard. Ad Hoc Mode contains minimum ii wireless station where no access call for is involved inwards their communication. It is less expensive every bit access call for is non needed hither for communication but nosotros can’t role this topology for large network. Even this authentication procedure is non that much secured every bit it does non induce got access point. 
7. Infrastructure Mode: it is advance from promotion hoc agency in addition to also provides 802.11 standard. Infrastructure Mode contains reveal of wireless station amongst access points. Here access call for is connected amongst larger wired network. This topology is used for edifice large reveal of network amongst to a greater extent than complexity in addition to arbitrary coverage.
8. WI-FI: This is really mutual straightaway a days, Wireless Fidelity (Wi-Fi) is available for home, office, mall, game zone etc. Wi-Fi also operates amongst 802.11 standard. As nosotros induce got seen this criterion is used yesteryear almost all topology hence safety inquiry for same is of import subject. There are many wireless clients are available similar smart sentinel which is connected amongst smart recall amongst Bluetooth. Laptop is 1 of them too.
9. Access Points: This is the fundamental call for for 802.11 criterion implementation. It is connexion call for betwixt wired in addition to wireless device. Here Data tin give notice locomote exchanged via dissimilar wireless device. But these wireless devices must locomote authenticated yesteryear access point. We tin give notice convey instance of router every bit an access point.
10. Wireless Controller in addition to BTS: Wireless controller induce got numbers of access points. It industrial plant every bit a centralized server which induce got IP connectivity for all access points. BTS (Base Transaction Session) is widely used for providing network to all mobile operators. Different types of network companies induce got BTS for proving best coverage of their network.

Web Application Vulnerabilities

Web application safety jeopardy is explained inwards OWASP. This is worldwide community for safety which explained close safety jeopardy to people or organizations. Full cite of OWASP is, The Open Web Application Security Project. OWASP get got define unlike types of vulnerabilities through which unauthorized user tin access information of protected site or application. OWASP get got aim of speeding concerns close the safety of the application. Below are the details of each vulnerabilities.

1. SQL Injection: This technique is rattling common. When information base of operations input in addition to other parts of spider web application is non synchronized good at that fourth dimension unauthorized user tin laid on on same percentage of application in addition to larn within to harm the data. SQL injection but travel past times amongst SQL queries or commands. The stance behind injection is, it makes scheme ignoramus in addition to tried to larn inside.
2. Broken Authentication in addition to Session Management: When functions authentication workflow is non developed properly at that fourth dimension unauthorized somebody tin larn through the protected information. If this volition hand off inwards whatever application in addition to then it allows unauthorized somebody to exploit users password, personal information , protected data, session keys etc. Also he tin practise inaccurate implementation via valid credentials of whatever user.
3. Cross Site Scripting (XSS): When application accepts information from unauthorized user in addition to accepts it every bit credentials this tin telephone recollect cross site scripting. Here incorrect people tin give credentials in addition to it is non validated past times spider web browser. Thus, monitor in addition to command functions are non performed properly which allows assaulter to impairment spider web site past times applying harmful code. Influenza A virus subtype H5N1 successful assaulter tin cope session too. Thus, past times commanding on master website, assaulter tin transfer valid user to unopen to other websites.
4. Insecure Direct Object References: In this vulnerability, unauthorized user tin modify the internal code in addition to implementation of object inwards damage of access command of an application. Internal changes tin travel done inwards database, URL in addition to files. Attacker manipulate the internal information of an application hither if authentication is non done properly. To foreclose this, Developer tin work indirect reference map every bit straight reference map tin travel easily known past times attackers.
5. Security Misconfiguration: While edifice whatever spider web sites or application, if safety implementation is non edifice strongly in addition to then assaulter tin practise unauthorized things amongst weak indicate of application. With work of safety misconfiguration, they volition start endeavour to larn within amongst weak implementation in addition to afterwards they tin access privilege information too. To bound this, Configuration of application must travel done properly. Not a unmarried loop holes tin travel flora past times attackers. Perfect server in addition to environs should travel used to run the application.
6. Sensitive Data Exposure: Sensitive information exposure tin travel implemented when SSL in addition to HTTPS safety controls are non properly developed for whatever website or application. Here information tin travel stolen in addition to leaked amongst sensitive information exposure. If personal information is non secured properly in addition to then it volition travel a big risk. Security must travel keep for encrypted in addition to protected information at carry layer. If developer squad is neglect to configure this inwards application in addition to then at that spot are many weak points inwards website in addition to application it render access to expired privacy.
7. Missing Function Level Access Control: When application get got thus many ways to gives rights to user in addition to incorrect writes get got been provided to incorrect somebody in addition to then he tin easily larn within the application. As all functionality get got been verified every bit per rights, unauthorized somebody tin access all information every bit per given rights. Thus, Permission of rights must travel taken seriously for this variety of application.
8. Cross Site Request Forgery Attacks (CSRF): Here cookies in addition to authentication tin travel managed past times an unauthorized somebody thus right somebody volition forget the HTTPS request. The spider web browser command get got been taken past times incorrect person. Thus, all passed asking get got been verified past times attacker.
9. Using Components amongst Known Vulnerabilities Components: Sometimes nosotros get got stance close the known vulnerabilities inwards existing code, liberties in addition to frame piece of work which get got been delivered from opened upwards source. This variety of already developed spider web sites in addition to application tin travel start priority of attackers every bit they tin easily apply SQL injection in addition to XSS. We tin foreclose this past times maintaining code inwards rattling proper means in addition to changing libraries in addition to files every bit per convenient fourth dimension period.
10. Invalidated Redirects in addition to Forwards: In most of the website, work get got been redirected to other spider web page to access the information but if those pages does non get got valid credentials in addition to then user may redirect on phishing or malware sites in addition to this means unknowingly they volition access the incorrect page. To foreclose this it’s meliorate to non work backward in addition to forrad redirection inwards application in addition to if it is necessary in addition to then user details must non travel redirected to the finish page.

Different Protocols Inwards Wireless Safety & Spider Web Security

We get got discussed nearly WEP (Wired Equivalent Privacy), WPA (Wi-Fi Protected Access) in addition to WPA2 (Wi-Fi Protected Access) inward our terminal article. This all are the protocols or nosotros tin tell measure which get got been used to secure wireless connections betwixt clients in addition to access points. Let’s movement inward details give-and-take for same.

1. WEP (Wired Equivalent Privacy): WEP is render facility of confidentiality inward wireless network. Basic characteristic of WEP is it follows IEEE 802.11 standard. First version of the WEP is launch inward 1999. In WEP, encrypted information volition hold upward protect wireless vulnerability betwixt customer in addition to access points. Key scheduling algorithm in addition to RC4 flow encryption get got been followed here. It agency information volition hold upward passed inward i primal to overall network thence anybody tin crevice it inward few minutes alongside freely available software. Thus, unauthorized action tin hold upward taken house inward minimum amount of time. This is the master copy drawback of WEP thence if high safety is required inward application thence user volition non prefer WEP every bit to a greater extent than secure method is already available. Another affair is, WEP is real hard to configure. But withal It tin hold upward used inward Wireless local expanse network (WLAN). Even End to End encryption get got been done inward WEP thence nosotros tin likewise purpose same inward Virtual individual network (VPN). After Authentication, Privacy get got been provided past times WEP.

2. WPA (Wi-Fi Protected Access): WPA is basically designed to overcome a employment which get got been faced inward WEP. WEP is non giving safety assurance but WPA is developed inward the way that it tin render to a greater extent than safety than WEP. Temporal Key Integrity Protocol (TKIP) is the master copy algorithm which get got been used inward WPA. TKIP wrappers WEP. TKIP wraps extra code inward showtime in addition to at the End, it encapsulate the code in addition to modify the same. TKIP encrypts each information bundle alongside unique encrypted key. Thus, it gives assurance that information volition rest protected past times using TKIP algorithm. WPA is developed inward 2003. If to a greater extent than devices get got been connected through WPA thence its safety assurance volition hold upward degraded thence WPA2 is came to the picture.

3. WPA2 (Wi-Fi Protected Access 2): This is used to secure Wi-Fi. There are only about changes betwixt WPA in addition to WAP2. As nosotros get got seen inward WPA, TKIP (Temporal Key Integrity Protocol) is used every bit algorithm but inward WPA2, CCMP (Counter Cipher Mode alongside Block Chaining Message Authentication Code Protocol) algorithm is used. TKIP is replaced past times CCMP. WPA2 is combination of CCMP in addition to AES (Advance Encrypted standard). Performance of WPA2 is to a greater extent than effective than WPA. WPA2 is developed inward 2006. CCMP get got 128 fleck keys in addition to 48 fleck initialization vector. Counter Cipher way is provided best information privacy inward WPA2. CCMP gives information integrity in addition to authentication. Thus, WPA2 is to a greater extent than effective than its predecessor. Due to this all facility WPA2 needed to a greater extent than mightiness inward compare to WPA in addition to WEP. WPA2 is the strongest encryption technique thence inward most of the society this tin hold upward used.

Now nosotros volition reckon the spider web safety protocols. There are dissimilar form of spider web safety protocols are introduce every bit below.

4. Internet Key Exchange (IKE): In IKE, 2 encrypted keys are passed through dissimilar communication channel alongside purpose of IPsec protocol. Distributing encrypted primal is non an slow chore when IPsec is using clear text algorithm for communicating betwixt 2 channels. Before sending encrypted keys none of the host get got whatever sentiment nearly the same in addition to hither clear text get got been used thence incorrect mortal tin easily position the keys. Thus, Internet Key Exchange is using Earth of fine art primal central algorithm which is used to run across the challenge of safety primal inward distributed embedded system. This protocol industrial plant alongside IPv4 in addition to IPv6.

5. SSL (Secure Socket Layer): For rubber communication betwixt 2 hosts, this protocol is used. It was founded past times Netscape for securing the products. SSL tin hold upward used alongside HTTP in addition to used to secure spider web servers browsers addition all form of cyberspace safety communications. SSL mainly known for secure authentication, privacy, non-repudiation in addition to Integrity for customer in addition to server every bit good every bit for Interfaces of cyberspace applications. SSL is portable in addition to slow to purpose in addition to it is already added inward all browsers.

6. HTTPS (Hyper Text Transfer Protocol): HTTPS is invented due lake of safety inward HTTP. HTTPS innovate SSL (Secure Socket Layer) for communication betwixt the spider web server in addition to browser. HTTPS removes the run a hazard of safety threats. HTTPS integrates embedded spider web servers alongside browsers in addition to dedicated devices in addition to term of retention consumption, functioning in addition to security.

Penetration Testing For Safety Of Application

Penetration attempt out procedure is basically used for finding safety vulnerability from application. There are static in addition to dynamic information are introduce inwards application which needs to live on tested. Penetration volition produce code analysis, finds safety vulnerability similar malicious code every bit good every bit functionalities which may happen due to lake of security. For instance proper encryption algorithm conduct maintain been used or not, Hard coded user cite in addition to password conduct maintain been used or not. This all form of major expanse of application tin toilet live on taken attention inwards penetration test. Penetration testing tin toilet live on done every bit automation in addition to manual. For automate the application, nosotros tin toilet utilisation a tool similar Vera code.

Penetration manual testing tin toilet live on done alongside experts exclusively every bit hither static code analysis, concern logic, design, command menses in addition to application opportunity tin toilet live on defined which provides highly assurance of application. Once whatever vulnerability conduct maintain been founded inwards application yesteryear penetration in addition to thus side yesteryear side footstep would live on the identifying opportunity of the same inwards application. Thus, penetration is totally depends on complexity in addition to size of the application every bit it volition become through all the place of application, all procedure in addition to information transmit conduct maintain been verified in addition to validate, all used environments conduct maintain been checked, all fundamental points in addition to weakness of application tin toilet live on detected. The brain gilded of penetration is, to construct clean all the vulnerability in addition to unauthorized procedure of the application in addition to malicious activity.

Penetration is also known every bit Pen testing. It is against for cyber-attacks. This pen attempt out is widely used for spider web applications. In pen attempt out nosotros tin toilet utilisation an declaration similar spider web application firewall. With this testing nosotros tin toilet also verify API (Application Protocol Interface) in addition to servers.

There are unlike form of testing stage is introduce inwards pen testing. 1. Test Planning 2. Test Scanning 3. Managing Access vulnerability 4. Test Maintaining 5. Test Analysis & configuration.

Let’s speak over ane yesteryear ane inwards detail.

1. Test Planning: This is the rootage footstep of pen testing. In this nosotros volition create upward one's heed the goals in addition to reach of the test. Defining environment, organisation in addition to which method nosotros tin toilet utilisation for testing these all matter is discussed alongside squad or individually. Collect the requirements in addition to domain similar postal service servers tin toilet live on decided inwards this phase.

2. Test Scanning: In this stage nosotros volition create upward one's heed virtually all analysis methods in addition to target to the application that how it volition reply on our attempts.  First analysis nosotros tin toilet produce it, Static Analysis. In this, Code analysis volition live on done in addition to according to the behaviour of the application code estimation tin toilet live on calculated inwards unmarried pass. Second analysis is, Dynamic analysis, inwards this nosotros require to validate the code spell running the application.

3. Managing Access Vulnerability: In this stage, spider web application attacks are taken care. If SQL Injection, cross site scripting this all form of vulnerability is applied on spider web application in addition to thus how to teach over alongside the same in addition to how to protect the data. These all give-and-take in addition to procedure conduct maintain been done inwards this stage. To preclude impairment of the application is the brain motto of this stage. Testers are attempt their marking best to protect the application yesteryear unauthorized people.

4. Test Maintaining: In this stage, Testers require to position the expanse from where vulnerability volition conduct maintain house for long fourth dimension in addition to unauthorized mortal tin toilet conduct maintain information or stole information continuously. This needs to live on position inwards each stage of application evolution for maintenance of the whole project.

5. Test Analysis & Configuration: In this analysis stage all item study virtually the application conduct maintain been designed. Which form of vulnerability is founded, what are the sensitive information needs to live on protected. How much fourth dimension conduct maintain been required yesteryear the pen tester to attempt out the application. This all analysis conduct maintain been done alongside Firewall settings.

Now motion forrad to the Methods of Penetration Testing. Below are the Methods which tin toilet live on used spell doing pen testing.

1. External testing of application:  In this method, Testers are to a greater extent than ofttimes than non pay attending on visible attribute of application. Like fields on spider web page, domain cite servers etc.

2. Internal testing of application: In this method, Testers needs to pay attending on the application code in addition to validate that behind the firewall how unauthorized mortal tin toilet access within information of application.

3. Blind Testing: This testing is done every bit smoke testing of an application. Testers needs to target on the sensitive information in addition to apply whatever vulnerability on application in addition to require to verify that how application reacts.

4. Target Testing: In this testing existent fourth dimension scenarios conduct maintain been generated. For example, Security testers in addition to testers are working together in addition to ane mortal volition transfer vulnerability inwards to the application in addition to ane mortal tried to protect information at same time. Thus, Real fourth dimension scenario volition live on generated in addition to application reaction conduct maintain been captured here.