Basic tools for Security testing

There are tons of tools available in the market for security testing, if you know how to use them. Some of the most common/popular ones are below

Static Analysis Tools:

Commercial/Licensed Tools: Checkmarx, HP Fortify, IBM Appscan Source Code, etc

Freeware Tools: FindBugs, FxCrop, Prefast, etc.

Dynamic Analysis Tools:

Commercial/Licensed Tools: HP WebInspect, IBM Appscan Enterprise Edition, Burp Suite Professional, etc

Freeware Tools: Fiddler, ZAP, Paros, WebScarab, Wikto, Nikto, THCsslcheck etc.

Hoping that sometime in future, I will be able to add some video tutorials.

Application Security

Application Security testing focuses on identifying application and configuration vulnerabilities that could lead to security issues. The goal of the reviews is to identify as many potential security vulnerabilities as possible. Application Security Testing can be performed using both or anyone of the below mentioned approaches/methods:

·         Tool Based Scan/Vulnerability Scan:  In the tool based scan or vulnerability scan a tool is used to perform the security checks on the application.

·         Manual Security Scan/Penetration testing : The penetration testing or manual security scan is a method where the application is exploited manually with the use of proxy tools. Findings flaws in the design and business logic.

Further, there are two ways to perform the Application Security Testing: - Static and Dynamic. Depending on the stage of the application in SDLC cycle, any one way can be used.

·         Static Analysis: Static Analysis also termed as Static application security testing (SAST) can be thought of as testing the application from the inside out – by examining its source code, byte code or application binaries for conditions indicative of a security vulnerability.

·         Dynamic Analysis: Dynamic Analysis also termed as Dynamic application security testing (DAST) can be thought of as testing the application from the outside in – by examining the application in its running state and trying to poke it and prod it in unexpected ways in order to discover security vulnerabilities

Best testing tools in the market

Open Source Tools
​Test Management Tools	​Functional Testing Tools	​Load Testing Tools
Bugzilla Testopia  FitNesse  qaManager  RTH (open source)  Salome-tmf  Squash TM  Test Environment Toolkit  TestLink  Testitool  XQual Studio  Radi-testdir  Data Generator	Selenium  Soapui  Watir (Web Application Testing in Ruby)  WatiN (Web Application Testing in .Net)  Capedit  Canoo WebTest  Solex  Imprimatur  SAMIE  ITP  WET  WebInject	FunkLoad  JMeter  FWPTT load testing  loadUI
Commercial Tools
​​Test Management Tools	​​Functional Testing Tools	​​Load Testing Tools
HP Quality Center/ALM  QA Complete  T-Plan Professional SMARTS  QAS.Test Case Studio  PractiTest  SpiraTest  TestLog ApTest Manager  Zephyr	QuickTest Pro  Rational Robot  Sahi  SoapTest  Test Complete  QA Wizard  Squish  vTest  Internet Macros	HP LoadRunner LoadStorm NeoLoad WebLOAD Professional Forecast ANTS – Advanced .NET Testing System Webserver Stress Tool Load Impact

Test Tool evaluation criteria - a mind map

A mind map for companies and users to select test tools for evaluation.

Tool Evaluation - Mind Map