Security Testing Basics (Getting started for Beginners)

Learn how security testing, a non-functional software test, identifies vulnerabilities and security loopholes in an application, safeguarding login functionality and information before release.

Explore why security testing matters by reviewing real-world data breaches and hacks, and learn how protecting passwords, records, and biometric data safeguards reputation, trust, and business value.

Explore the future of security testing, covering jobs, demand, skill shortages, unemployment rate, and pay scales. Get practical career advice for freshers to enter and advance in security testing.

Learn how security testing encompasses vulnerability assessment and penetration testing, how each identifies vulnerabilities, and how penetration testing simulates hacker activity with client approval.

Learn the key difference between security testing and hacking, and how security testing identifies security loopholes to protect applications from future hacks.

Avoid testing random applications and always obtain permission to practice security testing, as unauthorized tests can be mistaken for hacking and may land you in jail.

Illustrates manual security testing versus security testing tools, emphasizing that knowledge and applied techniques identify vulnerabilities manually, while tools speed assessments and generate reports, with manual mastery preceding tool use.

Learn the CIA triad—confidentiality, integrity, and availability—and how these high-level objectives guide security testing to protect data, ensure authorized updates, and prevent downtime.

Understand vulnerability, threat, and risk in security testing, with real-world examples showing how a weakness can be exploited and lead to data breach.

Learn the basics of Http methods, including get, post, put, delete, head, options, connect, and trace, and identify which are safe or dangerous for security testing.

Explore HTTP status codes and their role in security testing, covering informational, success, client error, and server error categories with examples 200, 301, 302, 400, 401, 403, 404, and 500.

Understand how cookies store session IDs and track activities. See how session cookies maintain logins and remember cart details, and how stolen cookies let attackers act using your session ID.

Learn how cookies and sessions work in web apps, including how a login creates a server-side session with a session ID stored in a session cookie, which maintains login state.

Explore cryptography basics, including secret communication between two parties, encryption and decryption, and how https secures data with SSL, alongside core techniques: encryption, hashing, and encoding.

Learn symmetric key encryption, a cryptography technique that uses the same key for encryption and decryption to secure data, with AES as the most common example.

Explore asymmetric key encryption and its difference from symmetric encryption, revealing how public and private keys secure data, with examples like RSA, DSA, and ECC.

Examine the basics of security testing by detailing symmetric and asymmetric key sizes, such as AES 128/192/256, Blowfish 448, and RSA up to 4096 bits.

Open any website, click the padlock, and view the certificate to identify the public key. See RSA 2048-bit on amazon.com and ECC 256-bit on google.com as examples.

Explore encoding and decoding basics, including base64 and URL encoding, to ensure data formats are consumable by receivers. Emphasize that encoding achieves format compatibility, not secrecy, with security testing implications.

Explore hashing as a one-way cryptography technique, distinct from encryption and encoding. See how MD5, SHA1, and SHA256 are used, and why salted hashing protects passwords in databases and logins.

Understand why http is stateless and how each request uses a new connection, while session IDs and cookies maintain login state across actions.

Learn how https differs from http by using SSL or TLS certificates, with TLS 1.2 as the modern standard. Explore how certificates secure client–server communication and prevent eavesdropping.

Learn how input validation and output encoding stop untrusted data from reaching the server and being executed in the browser, with practical examples and a focus on cross-site scripting.

Compare client side validation and server side validation, showing how client side checks improve performance while server side validation ensures security, including potential bypass with tools like Burp Suite.

Learn how input validation uses blacklisting and whitelisting, and why whitelisting offers stronger security against malicious payloads in text fields.

Compare SSL and TLS certificates, explain http vs https, and emphasize that SSL is deprecated while TLS remains in use. Favor migration toward TLS 1.3 for improved security and performance.

Compare http and https in security testing basics, showing http's unsecured, unencrypted channel on port 80 versus https's encrypted channel on port 443 with a certificate.

Explore authentication versus authorization in security testing basics, learning how user identity with valid credentials grants login, while permissions govern access to resources.

Learn how payloads, meaning inputs, are used in security testing and how malicious payloads simulate hacker attacks to probe for vulnerabilities.

Describe dynamic application security testing as a type of black box security testing. Perform testing on running applications from their user interface to identify vulnerabilities.

Practice security testing using a demo application you can access with admin/admin credentials, exploring login, account summary, and transfer funds to identify web vulnerabilities.

Explore the security testing process during the SDLC testing phase, covering five phases: information gathering, planning and analysis, vulnerability detection, penetration testing, and reporting, including a threat scenario sheet.

Discover how OWASP, a non profit organization, promotes the top ten vulnerabilities, offers free tools like Zed Attack Proxy, and provides juice shop for hands-on web security testing.

Explore OWASP top ten vulnerabilities, including injection, broken authentication, sensitive data exposure, XML external entities, and broken access control. Learn via practical examples and updated lists every 3–4 years.

Understand injection vulnerabilities from untrusted input processed by a software interpreter, leading to data theft or system compromise. Learn types, especially sql and cross-site scripting, and why input validation matters.

Learn the fundamentals of Structured Query Language (SQL) and core commands such as select, insert, update, and delete to understand and test SQL injection vulnerabilities.

Define attack surface and attack vector in security testing, using a house analogy and a demo app to show how input fields can become attack vectors for code injection.

Explore sql injection vulnerabilities by demonstrating how untrusted sql queries bypass authentication and grant admin access, illustrating sql injection (sqli) concepts for beginner penetration testing.

Explore the anatomy of a sql injection payload and how untrusted input can bypass authentication by manipulating dynamic sql queries in vulnerable applications.

Practice security testing using the second demo application, exploring multiple pages for vulnerabilities such as SQL injections and other flaws, with open testing and a test login.

Learn how to perform SQL injection vulnerability assessment with the single quote payload, identify vulnerable database interactions, and prioritize payloads before using Burp Suite.

Explore the attack surface of SQL injection by examining how add, update, delete, get details, login, and search functionalities interact with the database, and how payloads test vulnerabilities.

Learn how to install and launch Burp Suite Community Edition, including installing Java, downloading Burp Suite, and running a temporary project with Burp defaults for web application security testing.

Learn to use BurpSuite as a proxy to intercept, modify, and forward web requests, with hands on demos in the built in Chromium browser.

Configure BurpSuite as a proxy for Firefox by enabling manual proxy on 127.0.0.1:8082, bind BurpSuite's proxy to the same port, enable intercept, and forward requests.

Configure Burp Suite as a proxy for Chrome by setting the computer proxy to 127.0.0.1 and a port, then enable intercept in Burp Suite.

Configure burp suite as a proxy for Internet Explorer and enable intercept. Set proxy to 127.0.0.1 and a port, then forward requests to load pages and remove settings when finished.

Learn how to install webgoat, a web application for practicing security testing, including verifying java version, downloading the latest release, running the jar, and accessing localhost:8080/webgoat.

Learn to bypass client side validations using Burp Suite by intercepting, modifying form data, and testing server side validations.

Demonstrate how Burpsuite expands the attack surface by intercepting login requests, modifying username, password, and the login button parameter to reveal three attack vectors.