Table of Contents
INTRO TO SECURITY TESTING
Security testing is an important aspect of software testing focused on identifying and addressing security vulnerabilities in a software application. It aims to ensure that the software is secure from malicious attacks, unauthorized access, and data breaches.
Security testing involves verifying the software’s compliance with security standards, evaluating the security features and mechanisms, and conducting penetration tests to identify weaknesses and vulnerabilities that might be exploited by malicious actors.
The goal of security testing is to identify security risks and offer recommendations for remediation to improve the overall security of the software application. Testers simulate attacks to check existing security mechanisms and look for new vulnerabilities.
SECURITY TESTING-COMMON TEST CASES
TC ID | FEATURE | TEST CASES/STEPS | EXP RESULT |
TC_SECURITY_11 | PASSWORD STORAGE | Objective: To validate how the new password is stored/saved on the database after the user changes the password during the ‘Change Password’ screen Pre-req: Test Steps: | 1. The password should not be stored as plain text 2. The password has to be stored as hashed/encrypted |
TC_SECURITY_12 | PASSWORD STORAGE | Objective: To validate how the new password is stored/saved on the database after the user changes the password during the ‘Forgot Password’ screen | 1. The password should not be stored as plain text 2. The password has to be stored as hashed/encrypted |
TC_SECURITY_13 | APP SESSION | Objective: To validate if the app logsout the user automatically when the user changes the password using ‘Change Password’ feature Pre-req: Test steps: | 1. The ‘User A’ has to be logged out automatically after successfully changing the password 2. The ‘User A’ has to be redirected to login screen 3. The ‘User A’ has to be logged out automatically in all the sessions where the user was earlier logged in |
TC_SECURITY_14 | PASSWORD QUALITY | Objective: To validate if the app logsout the user automatically when the user changes the password using ‘Forgot Password’ feature Pre-req: Test steps: | 1. The ‘User A’ has to be logged out automatically after successfully changing the password 2. The ‘User A’ has to be redirected to login screen 3. The ‘User A’ has to be logged out automatically in all the sessions where the user was earlier logged in |
TC_SECURITY_15 | PASSWORD RESET | Objective: To ensure the app doesn’t reset the password without validating few related information, as per the existing records Pre-req: Test steps: | 1. The end user must be asked to input his/her secret question, followed by secret answer, and similar kind of questions & answers eg. DOB, Mobile # & Email address, as per the application existing records. 2. After the same is validated, the user must be asked to input his new password followed by reconfirm password. 3. This new password must not be emailed to the user, in the interest of not disclosing the password information, accidentally to others. 4. An email about ‘Password change’ has to be sent to the user without revealing the new password information in the email |
TC_SECURITY_16 | PASSWORD LOCKOUT | Objective: To ensure that the app doesn’t allows an attacker to reset or lockout users’ accounts Pre-req: Test steps: | 1. The app should not allow the attacker to reset or lockout users’ accounts 2. CAPTCHA has to be implemented from 2nd wrong attempt onwards |
TC_SECURITY_17 | PASSWORD LOCKOUT | Objective: To ensure that the app/system is safe from Brute Force Attacks Pre-req: Test steps: | 1. The user account has to be locked for sometime or till the administrator resets the password 2. The user has to be notified about the same |
TC_SECURITY_18 | BLANK PASSWORDS | Objective: To ensure passwords can’t be left blank during account registration or sign up or change password or forgot password process Pre-req: Test steps: | 1. Blank or empty password should not be accepted by the app/server/database 2. The app has to display the below toast message: “Password must contain one uppercase letter, one lowercase letter, one number and 8-256 characters” |
TC_SECURITY_19 | PASSWORD STRUCTURE | Objective: To ensure password doesn’t accept special meta characters Pre-req: Test Data: ^ $ \ / ( ) | ? + * [ ] { } , Test steps: | Meta Characters should not be accepted & an appropriate error message has to be displayed. This is required, when performing SQL Injection. |
TC_SECURITY_20 | APP SESSION TIMEOUT | Objective: To ensure the session tokens are valid for a predetermined time, after a recent user request Pre-req: Test steps: | The session has to terminate automatically after observing an idle time of 5-10 min |
TC_SECURITY_21 | CUSTOM ERROR MESSAGES | Objective: To ensure the app doesn’t reveal the technical details of the app failure(s)/crashes Pre-req: Test steps: | 1. Appropriate Custom error messages has to be displayed to the end user without revealing any stack trace, DB failure or technical details 2. Error messages should not reveal any sensitive information |
TC_SECURITY_22 | APPLICATION ERROR MESSAGES | Objective: To ensure that the app does not provide application error messages to an attacker that could be used in an attack Pre-req: Test steps: | 1. The app should not display verbose error messages such as stack trace info or database path error message or query failure message or internal system failure details instead a generic message has to be displayed 2. Error messages should not reveal any sensitive information |
TC_SECURITY_23 | USER ERROR MESSAGES | Objective: To ensure that the application does not present user error messages to an attacker that could be used in an attack Pre-req: Test steps: | 1. The app should not display user error messages such as “User doesn’t exists” or “User correct, Password incorrect”, “Invalid username” or “Invalid password” or “Email address doesn’t exists”. This poses a security-penetration vulnerability 2. The app has to display generic error messages 3. Error messages should not reveal any sensitive information |
USA