SOFTWARE TESTING LIFECYCLE

Software Testing Life Cycle (STLC) is a process used to test software and
ensure that quality standards are met. Tests are carried out systematically over
several phases. During product development, phases of the STLC may be
performed multiple times until a product is deemed suitable for release.
The main goal of the STLC is to identify and document any defects or issues in
the software application as early as possible in the development process. This
allows for issues to be addressed and resolved before the software is released to
the public.
PHASES OF STLC

1. Requirement Analysis:
Requirement Analysis is the first step of the Software Testing Life Cycle
(STLC). In this phase quality assurance team understands the
 requirements like what is to be tested. If anything is missing or not
understandable then the quality assurance team meets with the
stakeholders to better understand the detailed knowledge of requirements.

ACTIVITIES:
 Reviewing the software requirements document (SRD)
 Interviewing stakeholders
 dentifying any missing or incomplete requirements
 Identifying any potential risks

2. Test Planning:
Test Planning is the most efficient phase of the software testing life cycle
where all testing plans are defined. In this phase manager of the testing,
team calculates the estimated effort and cost for the testing work. This
phase gets started once the requirement-gathering phase is completed.

ACTIVITIES:
 Identifying the testing objectives and scope
 Developing a test strategy
 Identifying the testing environment and resources needed
 Identifying the test cases that will be executed
 Estimating the time and cost required for testing

3. Test Case Development:

The test case development phase gets started once the test planning phase
is completed. In this phase testing team notes down the detailed test
cases. The testing team also prepares the required test data for the testing.
When the test cases are prepared then they are reviewed by the quality
assurance team.

ACTIVITIES:
 Identifying the test cases that will be developed
 Writing test cases that are clear, concise, and easy to
understand
 Creating test data and test scenarios that will be used in the
test cases
 Identifying the expected results for each test case

4. Test Environment Setup:

 Test environment setup is a vital part of the STLC. Basically, the test
environment decides the conditions on which software is tested. This is
independent activity and can be started along with test case development.
In this process, the testing team is not involved. either the developer or
the customer creates the testing environment.

5. Test Execution:
After the test case development and test environment setup test execution
phase gets started. In this phase testing team starts executing test cases
based on prepared test cases in the earlier step.
ACTIVITIES:
 Test Execution
 Defect Logging
 Test data preparation
 Test environment setup
 Test execution
 Test Result Analysis
 Test Reporting

6. Test Closure:
Test closure is the final stage of the Software Testing Life Cycle (STLC)
where all testing-related activities are completed and documented. The
main objective of the test closure stage is to ensure that all testing-related
activities have been completed and that the software is ready for release.

ACTIVITIES:
 Test Summary Report
 Defect Tracking
 Test environment clean-up
 Test closure report
 Feedback and Improvement

CATEGORIES OF TESTING

1. Manual Testing
2. Automation Testing
1. Manual testing is the most hands-on type of testing and is employed by
every team at some point. Of course, in today’s fast-paced software
development lifecycle, manual testing is tough to scale.

TYPES OF MANUAL TESTING

1 Black box Testing

Checking the external behaviour of the system
Black box testing involves testing a system with no prior
knowledge of its internal workings. A tester provides an input, and
observes the output generated by the system under test.
Techniques:
1. Equivalence Testing ( 18>=age | age<=56)

Equivalence partitioning is a technique of software testing in

which input data divided into partitions of valid and invalid values,
and it is mandatory that all partitions must exhibit the same behaviour.

2. Boundary value Analysis (18 to 56 || LB - 18 HB – 56 check

boundary values & random)
Boundary Value Technique is used to test boundary values,
boundary values are those that contain the upper and lower limit of a
variable. It tests, while entering boundary value whether the software
is producing correct output or not.
3. Decision Table Technique ( both T = T )

Decision Table Technique is a systematic approach where

various input combinations and their respective system behavior are
captured in a tabular form.

4. State Transition technique

State Transition Technique is used to capture the behavior of

the software application when different input values are given to the
same function.

5. Cause and effect technique

 Cause-Effect Technique underlines the relationship between
a given result and all the factors affecting the result. It is based on a
collection of requirements.

Advantages of Black Box Testing:

 The tester does not need to have more functional knowledge or

programming skills to implement the Black Box Testing.
 It is efficient for implementing the tests in the larger system.
 Tests are executed from the user’s or client’s point of view.
 Code access is not required.

Disadvantages of Black Box Testing:

 There is a possibility of repeating the same tests while

implementing the testing process.
 Without clear functional specifications, test cases are difficult to
implement.
 It is difficult to execute the test cases because of complex inputs at
different stages of testing.
 It does not reveal the errors in the control structure.
 Working with a large sample space of inputs can be exhaustive and
consumes a lot of time.

2 White Box Testing

White box testing is a form of application testing that

provides the tester with complete knowledge of the application being
tested, including access to source code and design documents. This in-
depth visibility makes it possible for white box testing to identify issues
that are invisible to grey and black box testing.
Techniques:
Statements Coverage
In this technique, the aim is to traverse all statements at least once.
Hence, each line of code is tested.

Branch Coverage
 In this technique, test cases are designed so that each branch from
all decision points is traversed at least once. In a flowchart, all edges must
be traversed at least once.
Path coverage
Path coverage tests all the paths of the program. This is a
comprehensive technique which ensures that all the paths of the program
are traversed at least once. Path Coverage is even more powerful than
Branch coverage. This technique is useful for testing the complex
programs.

Cyclomatic complexity V(G)

Complexity is a software metric that given the quantitative measure of

logical complexity of the program.
The Cyclomatic complexity defines the number of independent paths in
the basis set of the program that provides the upper bound for the number
of tests that must be conducted to ensure that all the statements have been
executed atleast once.

Method 1: Total number of regions in the flow graph is a Cyclomatic

complexity.
Method 2: The Cyclomatic complexity, V (G) for a flow graph G can be
defined as
V (G) = E - N + 2
Where: E is total number of edges in the flow graph.
N is the total number of nodes in the flow graph.
Method 3: The Cyclomatic complexity V (G) for a flow graph G can be
defined as
V (G) = P + 1
Where: P is the total number of predicate nodes contained in the flow G.

ADVANTAGES
 As internal functionality is considered, all the possible conditions
are considered and test cases are generated. Hence all the
functionalities are being tested.
 It minutely verifies whether the program can be successfully
executed with other parts of the application.
 It identifies error in the hidden code and thus makes debugging
process.
  It removes extra lines of code which are not required in the
program thereby optimizing the program and increases the
efficiency.
 As the internal coding of the application is considered while
preparing test cases, it becomes very easy to identify the input and
the expected output data.
 It helps in evaluating all the loops and paths.
DISADVANTAGES

 As the internal code of the application has to be considered while

preparing the test cases, skilled testers are required who have
knowledge of programming also. Hence the cost of the resources is
high.
 It is not possible for the tester to look into every bit of the code and
identify the hidden errors. This may result in failure of the
application.
 Sometimes a change in the code may be required and thus all the
scenarios may need to be tested again.
 Test cases are a waste if changes in the implementation code are
done frequently.
 If the application is large then complete testing through white box
techniques is not feasible.
Black Box Testing White Box Testing
It is a way of software testing in which the It is a way of testing the software in which the
internal structure or the program or the code is tester has knowledge about the internal
hidden and nothing is known about it. structure or the code or the program of the
software.
Implementation of code is not needed for black Code implementation is necessary for white box
box testing. testing.
It is mostly done by software testers. It is mostly done by software developers.
No knowledge of implementation is needed. Knowledge of implementation is required.
It can be referred to as outer or external It is the inner or the internal software testing.
software testing.
It is a functional test of the software. It is a structural test of the software.
This testing can be initiated based on the This type of testing of software is started after a
requirement specifications document. detail design document.
No knowledge of programming is required. It is mandatory to have knowledge of
programming.
It is applicable to the higher levels of testing of It is generally applicable to the lower levels of
software. software testing.
It is also called closed testing. It is also called as clear box testing.
It is least time consuming. It is most time consuming.
It is not suitable or preferred for algorithm It is suitable for algorithm testing.
testing.
Can be done by trial-and-error ways and Data domains along with inner or internal
methods. boundaries can be better tested.
Example: Search something on Google by using Example: By input to check and verify loops
keywords

3 Grey Box Testing

Grey Box Testing is a software testing technique which is a

combination of Black Box Testing technique and White Box Testing
technique. In Black Box Testing technique, tester is unknown to the
internal structure of the item being tested and in White Box Testing the
internal structure is known to tester. The internal structure is partially
known in Grey Box Testing. This includes access to internal data
structures and algorithms for purpose of designing the test cases.

Techniques:
1 Matrix Testing
Matrix testing is a technique that examines all variables in an
application. In this technique, technical and business risks are defined
by the developers and a list of all application variables are provided.
Matrix technique states all the used variables in a program.
This technique helps to identify and remove the variables which are
not being used in the program and in turn, helps to increase the speed
of the software.
2 Orthogonal Array Testing
Orthogonal array testing is a technique you can use when your
application has only a few inputs that are too complex or large for
extensive testing. This technique enables you to perform test case
optimization, where the quality and number of tests performed balance
test coverage with effort. This technique is systematic and uses
statistics to test pair-based interactions.
3 Regression Testing
Regression testing is performed when any change is done in
the software or any defect is fixed. It is done to ensure that a new change
or fix done has not impacted any existing functionality of the software.
4 Pattern Testing
Pattern testing is applicable to such type of software that is
developed by following the same pattern of previous software. In these
type of software possibility to occur the same type of defects. Pattern
testing determines reasons of the failure so they can be fixed in the next
software.
ADVANTAGES:
 Clear testing goals are established, making it easier for
testers and developers
 Testing accounts for a user perspective, improving the
overall quality of products
 Testers do not need to have a programming expertise
 It can provide the benefits of both black and white box
testing
 It can eliminate conflicts between developers and testers
 It is cheaper than integration testing
DISADVANTAGES:
 It can be difficult to associate defects with root causes in
distributed systems
 Code path traversals are limited due to restricted access to
internal application structure
 Test cases can be difficult to design
2. Automated testing uses test scripts and specialized tools to automate the
process of software testing. Automated testing is the implementation of
an automation tool to execute test cases. This is well-suited for projects
that are large or require testing to be repeated multiple times. It also could
be applied to projects that already have been through an initial manual
testing process.

LEVELS OF TESING (CISA)

1. Component or Unit Testing

2. Integration Testing
3. System Testing
4. Acceptance Testing

1. UNIT TESTING
Unit testing is a software testing process for testing specific units,
components, or software elements. This is the most basic type of testing,
and the goal for this level of testing is to validate that each unit of code
performs how it should and is free of bugs, errors, and glitches.

2. INTEGRATION TESTING
Integration testing, which is when different software components and
modules are combined and tested as a group to make sure everything is
ready for the next level. Since a standard software project will likely
consist of various modules, coded by multiple programmers, the goal is to
test to expose potential defects or bugs between the various modules.
Sometimes, this phase is referred to as I & T (integration and testing),
thread testing, or string testing.

3. SYSTEM TESTING
System testing checks for a system’s compliance in accordance with the
necessary given requirements. System testing inspects components like
performance, load, reliability, and security with the goal of evaluating the
end-to-end system specifications.

4. ACCEPTANCE TESTING
Acceptance testing is a quality assurance (QA) process that determines to
what degree an application meets end users' approval. Depending on the
 organization, acceptance testing might take the form of beta testing,
application testing, field testing or end-user testing.

Alpha Testing
 Alpha testing is performed by testers who are usually internal
employees of the organization.
 Alpha testing is performed at the developer’s site.
 Alpha testing ensures the quality of the product before
forwarding to beta testing.
Beta Testing
 Beta testing is performed by clients who are not part of the
organization.
 Beta testing is performed at the end-user of the product.
 Beta testing also concentrates on the quality of the product but
collects users input on the product and ensures that the product
is ready for real time users.

BUG LIFE CYCLE

Bug Life Cycle in software testing is the specific set of states that defect or bug
goes through in its entire life. The purpose of Bug life cycle is to easily
coordinate and communicate current status of defect which changes to various
assignees and make the defect fixing process systematic and efficient.

1. New: When a new defect is logged and posted for the first time. It is
assigned a status as NEW.
2. Assigned: Once the bug is posted by the tester, the lead of the tester
approves the bug and assigns the bug to the developer team
3. Fixed: When a developer makes a necessary code change and verifies the
change, he or she can make bug status as “Fixed.”
4. Pending retest: Once the defect is fixed the developer gives a particular
code for retesting the code to the tester. Since the software testing
remains pending from the testers end, the status assigned is “pending
retest.”
5. Retest: Tester does the retesting of the code at this stage to check whether
the defect is fixed by the developer or not and changes the status to “Re-
test.”
 6. Verified: The tester re-tests the bug after it got fixed by the developer. If
there is no bug detected in the software, then the bug is fixed and the
status assigned is “verified.”
7. Reopen: If the bug persists even after the developer has fixed the bug, the
tester changes the status to “reopened”. Once again the bug goes through
the life cycle.
8. Closed: If the bug is no longer exists then tester assigns the status
“Closed.”
9. Duplicate: If the defect is repeated twice or the defect corresponds to the
same concept of the bug, the status is changed to “duplicate.”
10.Rejected: If the developer feels the defect is not a genuine defect then it
changes the defect to “rejected.”
11.Deferred: If the present bug is not of a prime priority and if it is expected
to get fixed in the next release, then status “Deferred” is assigned to such
bugs
12.Not a bug: If it does not affect the functionality of the application then
the status assigned to a bug is “Not a bug”.

Bug Life Cycle :

1. Tester finds the defect
2. Status assigned to defect- New
3. A defect is forwarded to Project Manager for analyze
4. Project Manager decides whether a defect is valid
5. Here the defect is not valid- a status is given “Rejected.”
6. So, project manager assigns a status rejected. If the defect is not rejected
then the next step is to check whether it is in scope. Suppose we have
another function- email functionality for the same application, and you
find a problem with that. But it is not a part of the current release when
such defects are assigned as a postponed or deferred status.
7. Next, the manager verifies whether a similar defect was raised earlier. If
yes defect is assigned a status duplicate.
8. If no the defect is assigned to the developer who starts fixing the code.
During this stage, the defect is assigned a status in- progress.
9. Once the code is fixed. A defect is assigned a status fixed
10.Next, the tester will re-test the code. In case, the Test Case passes the
defect is closed. If the test cases fail again, the defect is re-opened and
assigned to the developer.
11.Consider a situation where during the 1st release of Flight Reservation a
defect was found in Fax order that was fixed and assigned a status closed.
During the second upgrade release the same defect again re-surfaced. In
such cases, a closed defect will be re-opened.
 SEVEN TESTING PRINCIPLES

1. Testing shows the presence of defects

2. Exhaustive Testing is not possible
3. Early Testing
4. Defect Clustering
5. Pesticide Paradox
6. Testing is context-dependent
7. Absence of errors fallacy

Testing shows the presence of defects:

The goal of software testing is to make the software fail. Software
testing reduces the presence of defects. Software testing talks about the
presence of defects and doesn’t talk about the absence of defects. Software
testing can ensure that defects are present but it can not prove that software
is defect-free. Even multiple testing can never ensure that software is
100% bug-free. Testing can reduce the number of defects but not remove
all defects.
Exhaustive testing is not possible:
It is the process of testing the functionality of the software in all
possible inputs (valid or invalid) and pre-conditions is known as
exhaustive testing. Exhaustive testing is impossible means the software
can never test at every test case. It can test only some test cases and
assume that the software is correct and it will produce the correct output in
every test case. If the software will test every test case then it will take
more cost, effort, etc., which is impractical.
Early Testing:
To find the defect in the software, early test activity shall be started.
The defect detected in the early phases of SDLC will be very less
expensive. For better performance of software, software testing will start
at the initial phase i.e. testing will perform at the requirement analysis
phase.
Defect clustering:
In a project, a small number of modules can contain most of the
defects. Pareto Principle to software testing state that 80% of software
defect comes from 20% of modules.

Pesticide paradox:
Repeating the same test cases, again and again, will not find new
bugs. So it is necessary to review
the test cases and add or update test
cases to find new bugs.

Testing is context- dependent:

The testing approach depends
on the context of the software
developed. Different types of
software need to perform different types of testing. For example, The
testing of the e-commerce site is different from the testing of the Android
application.
Absence of errors fallacy:
If a built software is 99% bug-free but it does not follow the user
requirement then it is unusable. It is not only necessary that software is
99% bug-free but it is also mandatory to fulfil all the customer
requirements.

BUG
A bug means that the
software product or the
application is not
working as per the
adhered requirements set.
When we have any type of
logical error, it causes
our code to break, which
results in a bug.
DEFECT
A Defect is a deviation between the actual and expected output
A defect refers to a situation when the application is not working as per the
requirement and the actual and expected result of the application or
software are not in sync with each other.
ERROR
An Error is a mistake made in the code due to which compilation or
execution fails.
Error is a situation that happens when the Development team or the
developer fails to understand a requirement definition and hence that
misunderstanding gets translated into buggy code.
FAULT
It is a condition that causes the software to fail to perform its required
function. Sometimes due to certain factors such as Lack of resources or
not following proper steps Fault occurs in software which means that the
logic was not incorporated to handle the errors in the application.
FAILURE
Failure is the accumulation of several defects that ultimately lead to
Software failure and results in the loss of information in critical modules
thereby making the system unresponsive.

TESTING TYPES
Penetration Testing
Penetration testing (or pen testing) is a security exercise where a cyber-
security expert attempts to find and exploit vulnerabilities in a computer
system. The purpose of this simulated attack is to identify any weak spots
in a system’s defenses which attackers could take advantage of
Types
Open-box pen test - In an open-box test, the hacker will be provided with
some information ahead of time regarding the target company’s security
info.
Closed-box pen test - Also known as a ‘single-blind’ test, this is one
where the hacker is given no background information besides the name of
the target company.
Covert pen test - Also known as a ‘double-blind’ pen test, this is a
situation where almost no one in the company is aware that the pen test is
happening, including the IT and security professionals who will be
responding to the attack.
External pen test - In an external test, the ethical hacker goes up against
the company’s external-facing technology, such as their website and
external network servers. This can mean conducting the attack from a
remote location or carrying out the test from a truck or van parked nearby.
Internal pen test - In an internal test, the ethical hacker performs the test
from the company’s internal network. This kind of test is useful in
determining how much damage a disgruntled employee can cause from
behind the company’s firewall.

Pilot Testing:
 Testing that involves the users just before actual release to ensure
that users become familiar with the release contents and ultimately accept
it. Typically involves many users, is conducted over a short period of time
and is tightly controlled.

Eg: Google offers the Android Beta Program to Nexus users in order
for them to test the Android operating system.

FUNCTIONAL TESTING
It is used to verify the functionality of the software application,
whether the function is working according to the requirement
specification. In functional testing, each function tested by giving the
value, determining the output, and verifying the actual output with the
expected value.

1. Smoke testing
 Smoke testing includes only the basic (feature) functionality
of the system. Smoke testing is known as "Build Verification
Testing." Smoke testing aims to ensure that the most
important function work.
 In the smoke testing, we only focus on the positive flow of the
application and enter only valid data, not the invalid data. In
smoke testing, we verify every build is testable or not.
 For example, Smoke testing verifies that the application
launches successfully will check that GUI is responsive.

2. Sanity Testing:
Sanity testing involves the entire high-level business scenario
is working correctly. Sanity testing is done to check the
functionality/bugs fixed. Sanity testing is little advance than
smoke testing.

For example, login is working fine; all the buttons are working
correctly; after clicking on the button navigation of the page is
done or not.

3. Retesting:
Retesting is a type of testing performed to check the test cases
that were unsuccessful in the final execution are successfully
pass after the defects fixed. Usually, tester assigns the bug
when they find it while testing the product or its component.
The bug allocated to a developer, and he fixes it. After fixing,
 the bug is assigned to a tester for its verification. This testing is
known as retesting.

4. Database Testing:
Database testing is a type of testing which checks the schema,
tables, triggers, etc. of the database under test. Database
testing may involve creating complex queries to load/stress
test the database and check its responsiveness. It checks the
data integrity and consistency.

Example: let us consider a banking application whereby a user

makes a transaction. Now from database testing following,
things are important.

5. Ad-hoc testing:
Ad-hoc testing is an informal testing type whose aim is to
break the system. This type of software testing is unplanned
activity. It does not follow any test design to create the test
cases. Ad-hoc testing is done randomly on any part of the
application; it does not support any structured way of testing.

6. Static Testing:
Static testing is a software testing technique by which we can
check the defects in software without actually executing it.
Static testing is done to avoid errors in the early stage of the
development as it is easier to find failure in the early stages.
Static testing used to detect the mistakes that may not found in
dynamic testing.
 Types of Performance Testing
1. Stress Testing
Stress testing involves testing an application under extreme
workloads to see how it handles high traffic or data processing. The
objective is to identify the breaking point of an application.

Example – For an application with an anticipated load of 1000

users we will run the test with 1200 users and check if the
application is robust enough to not crash.
Tools : LoadTracer, JMeter, Blazemeter

2. Load Testing
Load Testing that determines the performance of a system,
software product, or software application under real-life based load
conditions. Basically, load testing determines the behavior of the
application when multiple users use it at the same time. It is the
response of the system measured under varying load conditions.

Example – For a newly developed application with an

anticipated load of around 1000 concurrent users. We will create a
load test script and configure it with 1000 virtual users and run it for
say 1-hour duration. After the load test completion, we can analyze
the test result to determine how the application will behave at the
expected peak load.
Tools : LoadNinja, Apache JMeter, LoadRunner, NeoLoad
3. Spike Testing
Spike Testing in which a software application is tested with
extreme increments and decrements in traffic load. The main
purpose of spike testing is to evaluate the behaviour of the software
application under sudden increment or decrement in user load and
determine recovery time after a spike of user load.

Example – For an e-commerce application running an advertisement campaign, the number

of users can increase suddenly in a very short duration.
Tools: Apache JMeter, LoadRunner
4. Volume Testing
 The volume testing is performed by feeding the application
with a high volume of data. The application can be tested with a
large amount of data inserted in the database or by providing a large
file to the application for processing. Using volume testing, we can
identify the bottleneck in the application with a high volume of data.

Example – For a newly developed e-commerce application, we can

perform volume testing by inserting millions of rows in the database
and then carry out the performance test execution.
Tools: HammerDB, DbFit, JdbcSlim, NoSQLMap
 5. Endurance testing
Endurance testing is also known as ‘Soak Testing’. It is done
to determine if the system can sustain the continuous expected
load for a long duration. Issues like memory leakage are found
with endurance testing.

Example - For an application like Income tax filing, the

application is used continuously for a very long duration by
different users. In this type of application, memory
management is very critical. For an application like these, we
can run the test for 24 hours to 2 days duration and monitor the
memory utilization during the whole test execution.

Tools: LoadStrom, LoadUI, OpenSTA

SECURITY TESTING

Security Testing uncovers vulnerabilities of the system and

determines that the data and resources of the system are protected
from possible intruders. It ensures that the software system and
application are free from any threats or risks that can cause a loss.

Types of Security Testing:

1. Vulnerability Scanning:
Vulnerability scanning is performed with the help of automated
software to scan a system to detect the known vulnerability
patterns.
Tools: Netsparker, OpenVAS

2. Security Scanning:
 Security scanning is the identification of network and system
weaknesses. Later on it provides solutions for reducing these
defects or risks. Security scanning can be carried out in both
manual and automated ways.
Tools: Nmap, Nessus

3. Penetration Testing:
Penetration testing is the simulation of the attack from a
malicious hacker. It includes an analysis of a particular system to
examine for potential vulnerabilities from a malicious hacker that
attempts to hack the system.
Tools: Astra’s Pentest, Metasploit

4. Risk Assessment:
In risk assessment testing security risks observed in the
organization are analyzed. Risks are classified into three
categories i.e., low, medium and high. This testing endorses
controls and measures to minimize the risk.
Tools: Risk Matrix, Decision Tree, Failure modes and effect
analysis (FMEA)
5. Security Auditing:
Security auditing is an internal inspection of applications and
operating systems for security defects. An audit can also be
carried out via line-by-line checking of code.
Tools: Metasploit, Wireshark

6. Ethical Hacking:
Ethical hacking is different from malicious hacking. The purpose
of ethical hacking is to expose security flaws in the
organization’s system and to improve system security.
Tools: Nmap, BurpSuite, Nessus

7. Posture Assessment:
It combines security scanning, ethical hacking and risk
assessments to provide an overall security posture of an
organization.
 8. Application security testing:
Application security testing is a type of testing that focuses on
identifying vulnerabilities in the application itself. It includes
testing the application’s code, configuration, and dependencies to
identify any potential vulnerabilities.

9. Network security testing:

Network security testing is a type of testing that focuses on
identifying vulnerabilities in the network infrastructure. It
includes testing firewalls, routers, and other network devices to
identify potential vulnerabilities.

10. Social engineering testing:

Social engineering testing is a type of testing that simulates
phishing, baiting, and other types of social engineering attacks to
identify vulnerabilities in the system’s human element.

11.Tools such as Nessus, OpenVAS, and Metasploit can be used to

automate and simplify the process of security testing. It’s
important to ensure that security testing is done regularly and that
any vulnerabilities or threats identified during testing are fixed
immediately to protect the system from potential attacks.
organization.

CONCEPTS OF SECURITY TESTING

1. Confidentiality – Information should be accessible to only those
with authorized access.
2. Integrity – A measure intended to allow the receiver to determine
that the information which it is providing is correct.
3. Authentication – Establish the identity of the user.
4. Authorization – The user should receive a service or perform an
action for which he has permission.
5. Availability – Information and communication services should be
ready at any time, as needed.
6. Non-repudiation – Prevent later denial that an action happened
Key Terms of Security Testing

1. Vulnerability
This is the weakness of the web application. The cause of such “weakness”
can be due to the bugs in the application, an injection (SQL/ script code),
or the presence of viruses.
2. URL Manipulation
Changing some information in the URL may sometimes lead to unintended
behavior by the server and this termed URL Manipulation.
3. SQL injection
This is the process of inserting SQL statements through the web
application user interface into some query that is then executed by the
server.
4. XSS (Cross-Site Scripting)
When a user inserts HTML/client-side script in the user interface of a web
application, this insertion is visible to other users and it is termed as XSS.