There are many challenges that web application security scanners face that are widely known within the industry however may not be so obvious to someone evaluating a product.

2. Challenges Faced by Testers
while Performing
Security Testing

3. .
With the increase in web technologies, several software applications can be accessed anywhere
and anytime with the use of internet. But due to this the security comes into role as nobody
want to be hacked. There is a vast difference between codes that run on a PC as compared to
web applications that run inside a browser. So, security testing holds immense importance for
web based applications.
This has led to rise in demand for software testers. If I talk about software testers having the
proficiency in this area, web application security has proven to be a challenging task. There are
various challenges that these testers face on daily basis, we will discuss in this article. But first
we should know how security is related to software testing.
Security testing has now become an integral part of enterprise testing strategy not only
because of the awareness of various ways an application can be compromised but also
because of the inability of latest technologies to dodge the attackers as demonstrated by recent
security incidents and breaches

4. Security Testing is a method to make sure whether a system
protects data and maintains functionality as predictable.
Security testing covers a larger test space as compared to
functional testing.
While testing security features, you can try automating most
of the part that is possible and work smartly with the rest.
How is Security
Related to Your Testing?

5. Automation of regression test suites to achieve lower
testing costs and faster time to market.
Performance Tsting
1. High-Priority Vulnerability
Most vulnerability is high-priority While doing functional
testing it is probable to make trade-offs in resources and
coverage. As part of the planning stage, the test analyst
can narrow the scope of testing by concentrating on those
parts of the application that are most acute from a
business point of view, plus those that are most frequently
used. The scenario is just vice-versa in the case of security
testing. Here, even a non-critical issue can cause similar
damage as one on the application’s login page.

6. 2. Test Hidden Parts of The Application
A functional tester is mainly concerned with testing what
is exposed by a web apps interface. Moreover, he may
have to work on the test cases of the application’s
backend interfaces. A Performance Tester has to make
sure about the load level of the application when it is in
the deployment phase. In all these scenarios the test
cases are defined by the application only.
But in security testing this is not the scenario and the
security tester have to defined test cases against various
unspecified security attacks.
• An SQL injection attack through UI controls (e.g. textboxes,
radio-buttons, drop-downs, etc.)
• A hidden POST parameter
• A GET parameter
• A cookie value

7. 3. Lack of cloud testing security standards
No universally-approved method of cloud security
testing currently exists. It all depends on client
requirements and supplier offerings.
Some service providers select to emphasis on
features of cloud services for their testing process
that other providers wouldn’t consider to be as
necessary.
In reality, there’s a wide range of methods and
procedures for cloud testing. As such, there should
also be a hope involving the influences of quality of
service and the pricing models.

8. Revie of entire Testing organization including Processes, Peple
and Tools & Technologies.
Tst disory Services
It is difficult for testers to write tools that automate the task of testing web application security than for testing
application functionality. Some tasks are at first glance not difficult:
• Confirm that the application rejects potentially malicious characters in the input (e.g. various SQL meta-characters that
could be used for carrying out SQL injection)
• Confirm that the application executes html encoding or url encoding of special input characters that it echoes out.
Difficulty in Automating Security Testing