Category:Test

4

• 4.2.5 Revue des commentaires et metadonnees des pages web pour recherche de fuite d'information (OTG-INFO-005)
• 4.3.4 Revue des fichiers anciens, non references, ou de sauvegarde pour recherche d'informations sensibles (OTG-CONFIG-004)
• 4.3.4 Revue des fichiers obsolètes, de sauvegarde, non references pour recherche d'informations sensibles (OTG-CONFIG-004)
• 4.3.4 Revue des fichiers obsolètes, de sauvegarde, non référencés pour recherche d'informations sensibles (OTG-CONFIG-004)
• 4.3.4 Revue des fichiers pour recherche d'informations sensibles (OTG-CONFIG-004)
• 4.3.6 Test des Methodes HTTP (OTG-CONFIG-006)
• 4.3.7 Testing for Database credentials/connection strings available (OTG-CONFIG-007)
• 4.5.8 Test de Questions-Reponses Faibles (OTG-AUTHN-008)
• 4.7 Test de management de sessions
• 4.7.1 Tester le système de management des sessions (OTG-SESS-001)
• 4.7.2 Tester les attributs des cookies (OTG-SESS-002)
• 4.7.3 Tester les fixations de session (OTG-SESS-003)
• 4.7.4 Tester les variables de session exposées (OTG-SESS-004)
• 4.7.5 Tester les Cross Site Request Forgeries (OTG-SESS-005)
• 4.7.5 Tester les CSRF (OTG-SESS-005)
• 4.7.6 Tester les fonctionnalités de déconnexion (OTG-SESS-006)
• 4.7.7 Tester l'expiration de session (OTG-SESS-007)
• 4.7.8 Tester la confusion de session (OTG-SESS-008)
• 4.8 Tester la validation des entrées
• 4.8.1 Test de Reflected Cross-Site Scripting (OTG-INPVAL-001)
• 4.8.10 Tester les injections XPath (OTG-INPVAL-010)
• 4.8.11 Injections IMAP SMTP (OTG-INPVAL-011)
• 4.8.12 Tester les injections de code (OTG-INPVAL-012)
• 4.8.12.1 Tester l'inclusion de fichiers locaux
• 4.8.12.2 Tester l'inclusion de fichiers distants
• 4.8.13 Tester les injections de commandes (OTG-INPVAL-013)
• 4.8.14 Tester les débordements de tampons (OTG-INPVAL-014)
• 4.8.14.1 Tester les débordements de tas
• 4.8.14.2 Tester les débordements de pile
• 4.8.14.3 Tester les format string
• 4.8.15 Tester les incubated vulnerabilities (OTG-INPVAL-015)
• 4.8.16 Tester l'HTTP Splitting Smuggling (OTG-INPVAL-016)
• 4.8.2 Test de Stored Cross-Site Scripting (OTG-INPVAL-002)
• 4.8.3 Test d'HTTP Verb Tampering (OTG-INPVAL-003)
• 4.8.4 Test d'HTTP Parameter pollution (OTG-INPVAL-004)
• 4.8.5 Test d'Injection SQL (OTG-INPVAL-005)
• 4.8.5.1 Tester Oracle
• 4.8.5.3 Tester SQL Server
• 4.8.5.5 Tester MS Access
• 4.8.5.6 Tester les injections NoSQL
• 4.8.6 Tester les injections LDAP (OTG-INPVAL-006)
• 4.8.7 Tester les injections ORM (OTG-INPVAL-007)
• 4.8.8 Tester les injections XML (OTG-INPVAL-008)
• 4.8.9 Tester les injections SSI (OTG-INPVAL-009)

A

• Appendix A: Testing Tools

C

• Client Side Testing
• Client Side Testing (New!)
• Client-Side Testing
• Conduct search engine discovery/reconnaissance for information leakage (OTG-INFO-001)

D

• Data Encryption (New!)

E

• Enumerate Applications on Webserver (OTG-INFO-004)
• Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)

F

• Fingerprint Web Application (OTG-INFO-009)
• Fingerprint Web Application Framework (OTG-INFO-008)
• Fingerprint Web Server (OTG-INFO-002)
• Flash Testing

I

• Identify application entry points (OTG-INFO-006)
• Identify application exit/handover points (OTG-INFO-007)

M

• Map Application Architecture (OTG-INFO-010)
• Map execution paths through application (OTG-INFO-007)

O

• O-Saft
• O-Saft/Documentation
• OWASP Guide de Test v4-Annexe B-Conseils de Lecture
• OWASP Risk Rating Methodology
• OWASP Testing Guide Appendix B: Suggested Reading
• OWASP Testing Guide Appendix C: Fuzz Vectors
• OWASP Testing Guide Appendix D: Encoded Injection

O cont.

• Template:OWASP Testing Guide v2
• Template:OWASP Testing Guide v3
• Template:OWASP Testing Guide v4

R

• Reporting
• Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
• Review webpage comments and metadata for information leakage (OTG-INFO-005)
• Review Webserver Metafiles for Information Leakage (OTG-INFO-003)

S

• Scoping a Web Service Test (OWASP-WS-001)
• Software Quality Assurance

T

• Template Paragraph Testing AoC
• Template Paragraph Testing v3
• Test Account Provisioning Process (OTG-IDENT-003)
• Test Application Platform Configuration (OTG-CONFIG-002)
• Test Client Side SQL Injection
• Test Content Security Policy (OTG-CONFIG-008)
• Test Cross Origin Resource Sharing (OTG-CLIENT-007)
• Test defenses against application mis-use (OTG-BUSLOGIC-007)
• Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
• Test for Process Timing (OTG-BUSLOGIC-004)
• Test HTTP Methods (OTG-CONFIG-006)
• Test HTTP Strict Transport Security (OTG-CONFIG-007)
• Test Local Storage (OTG-CLIENT-012)
• Test Network/Infrastructure Configuration (OTG-CONFIG-001)
• Test Permissions of Guest/Training Accounts (OTG-IDENT-006)
• Test RIA cross domain policy (OTG-CONFIG-008)
• Test Role Definitions (OTG-IDENT-001)
• Test Session Timeout (OTG-SESS-007)
• Test Upload of Malicious Files (OTG-BUSLOGIC-009)
• Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)
• Test User Registration Process (OTG-IDENT-002)
• Test Web Messaging (OTG-CLIENT-011)
• Testing Checklist
• Testing Directory traversal/file include (OTG-AUTHZ-001)
• Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)
• Testing for AJAX (OWASP-AJ-002)
• Testing for AJAX Vulnerabilities (OWASP-AJ-001)
• Testing for AJAX: introduction
• Testing for authentication
• Testing for Authorization
• Testing for Browser cache weakness (OTG-AUTHN-006)
• Testing for Brute Force (OWASP-AT-004)
• Testing for Buffer Overflow (OTG-INPVAL-014)
• Testing for business logic
• Testing for Bypassing Authentication Schema (OTG-AUTHN-004)
• Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)
• Testing for Captcha (OWASP-AT-008)
• Testing for Captcha (OWASP-AT-012)
• Testing for Clickjacking (OTG-CLIENT-009)
• Testing for Client Side Resource Manipulation (OTG-CLIENT-006)
• Testing for Client Side URL Redirect (OTG-CLIENT-004)
• Testing for Code Injection (OTG-INPVAL-012)
• Testing for Command Injection (OTG-INPVAL-013)
• Testing for configuration management
• Testing for cookies attributes (OTG-SESS-002)
• Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
• Testing for Cross site flashing (OTG-CLIENT-008)
• Testing for Cross site scripting
• Testing for CSRF (OTG-SESS-005)
• Testing for CSS Injection (OTG-CLIENT-005)
• Testing for DB Listener (OWASP-CM-002)
• Testing for default credentials (OTG-AUTHN-002)
• Testing for Default or Guessable User Account (OWASP-AT-003)
• Testing for Denial of Service
• Testing for DOM-based Cross site scripting (OTG-CLIENT-001)
• Testing for DoS Buffer Overflows (OWASP-DS-003)
• Testing for DoS Failure to Release Resources (OWASP-DS-007)
• Testing for DoS Locking Customer Accounts (OWASP-DS-002)

T cont.

• Testing for DoS User Specified Object Allocation (OWASP-DS-004)
• Testing for Error Code (OTG-ERR-001)
• Testing for Error Handling
• Testing for Exposed Session Variables (OTG-SESS-004)
• Testing for failure to restrict access to authenticated resource(OWASP-AT-010)
• Testing for Failure to Restrict access to authorized resource (OWASP-AZ-005)
• Testing for Format String
• Testing for Heap Overflow
• Testing for HTML Injection (OTG-CLIENT-003)
• Testing for HTTP Parameter pollution (OTG-INPVAL-004)
• Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016)
• Testing for HTTP Verb Tampering (OTG-INPVAL-003)
• Testing for IMAP/SMTP Injection (OTG-INPVAL-011)
• Testing for Incubated Vulnerability (OTG-INPVAL-015)
• Testing for Input Validation
• Testing for Insecure Direct Object References (OTG-AUTHZ-004)
• Testing for Insecure encryption usage (OWASP-EN-001)
• Testing for JavaScript Execution (OTG-CLIENT-002)
• Testing for LDAP Injection (OTG-INPVAL-006)
• Testing for Local File Inclusion
• Testing for Logout and Browser Cache Management (OWASP-AT-007)
• Testing for logout functionality (OTG-SESS-006)
• Testing for misconfiguration
• Testing for MS Access
• Testing for Naughty SOAP Attachments (OWASP-WS-006)
• Testing for NoSQL injection
• Testing for Oracle
• Testing for ORM Injection (OTG-INPVAL-007)
• Testing for Padding Oracle (OTG-CRYPST-002)
• Testing for Privilege escalation (OTG-AUTHZ-003)
• Testing for Race Conditions (OWASP-AT-010)
• Testing for Reflected Cross site scripting (OTG-INPVAL-001)
• Testing for Remote File Inclusion
• Testing for Sensitive information sent via unencrypted channels (OTG-CRYPST-003)
• Testing for Session Fixation (OTG-SESS-003)
• Testing for Session Management
• Testing for Session Management Schema (OTG-SESS-001)
• Testing for Session puzzling (OTG-SESS-008)
• Testing for Session token not restricted properly (OWASP-SM-006)
• Testing for SQL Injection (OTG-INPVAL-005)
• Testing for SQL Server
• Testing for SQL Wildcard Attacks (OWASP-DS-001)
• Testing for SSI Injection (OTG-INPVAL-009)
• Testing for SSL-TLS (OWASP-CM-001)
• Testing for Stack Overflow
• Testing for Stack Traces (OTG-ERR-002)
• Testing for Stored Cross site scripting (OTG-INPVAL-002)
• Testing for Storing too Much Data in Session (OWASP-DS-008)
• Testing for Unvalidated Redirects and Forwards (OWASP-DV-004)
• Testing for User Enumeration and Guessable User Account (OWASP-AT-002)
• Testing for User Input as a Loop Counter (OWASP-DS-005)
• Testing for Vulnerable Remember Password (OTG-AUTHN-005)
• Testing for Vulnerable Remember Password and Pwd Reset (OWASP-AT-006)
• Testing for weak Cryptography
• Testing for Weak lock out mechanism (OTG-AUTHN-003)
• Testing for Weak or unenforced username policy (OTG-IDENT-005)
• Testing for weak password change or reset functionalities (OTG-AUTHN-009)
• Testing for Weak password policy (OTG-AUTHN-007)
• Testing for Weak security question/answer (OTG-AUTHN-008)
• Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection (OTG-CRYPST-001)
• Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)
• Testing for Web Application Fingerprint (OWASP-IG-004)
• Testing for Web Server Fingerprint (OWASP-IG-010)
• Testing for Web Services
• Testing for Writing User Provided Data to Disk (OWASP-DS-006)
• Testing for WS HTTP GET parameters/REST attacks (OWASP-WS-005)