Hi friends

I am currently doing with one banking project so it is very important to have the security testing.but i know to test only with the basic as

1.username and password security
2.clicking anywhere in the page to get the source code
3.Check by putting the login link and checking

like these if you have undergone any of different security testing ?

otherwise we have any testing tool to undergo mainly for security testing?

can any one help me to know as urgent as possible?

Thanks and regards
Saravanan

i just gave reply to the below written thread regarding this...

can you please go and check...

http://www.geekinterview.com/talk/72...testcases.html (Login page Testcases)

Dear Amish

I need to know in detail i got some clearance but i need more

canyou guide me to get more souce

regards
Saravanan

few more testing can be ...

Authentication
* Disallow the user from directly accessing a page requiring the user to be logged in. If you are able to access a page requiring authentication and are currently not logged in, file a security ticket of severity 2-3 depending on the page.

Login
* If the username or password is incorrect do not display a message such as 'Your Username is Incorrect'. Instead ensure that a generic message stating 'Invalid Credentials' is displayed so as not to leak information about existing user accounts. If either the username or password is specifically mentioned file as a severity 3 issue.

Email Confirmation
* When emailing the order confirmation do not leak sensitive information such as the full credit card number, social security number, full name and address, or other similar sensitive information. If the card number or social security referenced in the email displays more than the last 4 digits (Unless otherwise defined) file a severity 2 issue.

Password Reset
* Ensure that if the password is reset that the temporary password expires after a reasonable amount of time as defined by the product manager (default is 48 hours). After 48 hours the temporary password will expire and will need to be regenerated.

i know few thinks like:

1. Secession Time out:
when a customer opens his A/c after that system is idel for long time, when the customer try to access it then the system should prompt for User id and password.

2. firewall testing
3. Cookies testing