A Comprehensive Web Application Security Testing Checklist

• Collect Information
• Planning
• Performance
• Report
• Fixing
• Confirmation
• FAQ

Step 1: Collect Information

The basic step of our application security testing checklist is to ask questions. This will ensure which apps, codes, and network systems need to be tested. Go the extra mile and inform yourself about the testing process you will use, and especially what are the expectations.

Identify extremely uncertain areas of the application

This area refers to where users modify content. This location requires verification, on both input and output codes. Such an example can be, an app that allows its users to insert a large amount of data. Especially if done through an HTML editor, the app is at high risk of attacks if the prevention mechanism isn’t implemented.

Build company logic and information flow

This refers to areas that need manual testing, mostly focused on escalation or sensitive data exposure systems. The organization logic is related to information flow, which is a special and rare course of an application. This function tends to be overlooked by automated analysis, so it’s important we mention it.

A QA tester must secure:

• The sincerity of the assignment
• Regular users can not skip steps
• End users don’t have authorization to privileged activities

Understand the permissions and role structure

In case of access locked or multiple team member access, such a step is important for authorization purposes. Also, try to test the bypass authorization setup, by skipping the login page or making the app think the user is already authorized. Also, check if it’s possible to access administrative functions while being logged as a regular user.

Step 2: Planning

When planning your application security testing, document your strategy first. Pick the right testers, explain to them what they’ll be working on, and the testing tasks’ deadline. This will save you time and resources and will assure you a good security testing strategy.

Organize the vulnerabilities for your application

Make a list of the tools you need, such as a web vulnerability scanner. If you plan to take things further and test authentication, an HTTP proxy will be needed. You can use a source code analysis if you plan to go into depth with your security testing.

The following application security testing checklist can cover:

• Gathering management sessions
• Brute force
• Elevated access to protected resources
• Password security

Assign roles to team members

If you plan to do the security testing with a team, you should split the responsibilities. One team can be in charge of functionality, while the other team can test vulnerabilities. It’s important to pick the right QA testers for this operation. It’s essential to have prepared professionals, ready to take action and dig into the app security with comprehensive results.

Implement automatic tests

Put together a manual check that will contain additional tasks the team will need to perform manually. Once the automatic testing is completed, assign a team member to scan and configure the results. Although technology is a great asset, a human follow-up will only do better!

Establish the deadline

This is the point when your team will finish the testing and document the vulnerabilities found. On this step of the application security testing checklist, it’s time for you to write the conclusion report. The results should help you have a clear view of how secure your app is and where it is compared to expectations.

Set up internal and external calls

It’s up to you how often you coordinate with your team. For a successful secure app, we suggest you schedule calls two times a week. As communication is key, these calls should include the QA testers and the project or client manager, to determine the team situation and pass on relevant details to members.

Document test examples

This can only exist on your application security testing checklist if the client demands it. The documentation should contain test cases that represent interest to your client and have had a certain impact on the results.

Perform automated or manual crawling

If needed by the agreement, this step offers details or adjustments needed to the testing scope.

Step 3: Performance

The biggest part of the application security testing checklist is the execution. Once you have the plan strategy and the team ready to go, this is the moment you conduct the tests and track down vulnerabilities.

Automated tests and results

You should pay attention to the automation tools you select. This way, testers will adjust their skills to both company logic and information flow, which requires manual analysis. Testing automatically is slightly different, depending on the organization.

Manual testing

Manual testing is focused on the company logic and information flow specific to the application. It is usually overlooked by automatic testing. Manual testing may look like this:

1. A QA tester identifies a link entered by an admin that is somewhat different from their end
2. They “run” as an admin and attempt to modify the URL
3. Based on the results, if a vulnerability is found it’s best to be documented. After this, the tester can continue to navigate to related pages and check if the issue is ongoing.

At this stage of the application security testing, the majority of tools send requests to a page to see if the response is different. When HTTP 500 errors are delivered, it means that a vulnerability exists somewhere. Now is the tester’s capacity to review the error and determine if indeed there is a vulnerability.

Document vulnerabilities discovered

Sometimes, clients or even the upper management may request the output of the security tests performed. They want to see the conclusions even if no vulnerabilities were identified, therefore be ready for such report as well.

Step 4: Report

Next on our application security testing checklist is the reporting stage. This is an action taken after the testing is done. The reports on the results should be thoroughly documented and then reported for your client or management, as follows:

Formalize results

The first step in reporting is putting together the description of the testing, affected URLs, team member roles, evidence, reproduce steps, impact, and fixing.

Review technical reports

This part assures the accuracy and consistency of the report’s technical writing. If needed, review the results with the team and make appropriate adjustments.

Step 5: Fixing

This step addresses the vulnerabilities during the application security testing.

Address the support guidelines

The application’s owner’s responsibility is to charge a web developer with detailed remediation requests. It’s necessary to implement fixes in the affected code. A simple black box test might not be enough and issues could still exist.

Step 6: Confirmation

The final step of the application security testing checklist we prepared for you is verification. This step is usually done at the end of the testing procedure. It’s important to reinforce that the vulnerabilities found are fixed and they can’t be tricked.

Review

Take one more look at the specific previous issues identifies. Make sure they have been completely fixed and have no potential vulnerability.

Prevention

Assure these fixes can’t be vulnerable again by transformed attempts. To do that, execute filtering for XSS, attacks with different roles, and redirection to different URL links.