#Ddos testing with siege tool software#
#Ddos testing with siege tool code#

Can a poorly trained support technician give harmful access to a user’s account?.

What type of attacks would two-factor authentication prevent?.

Your system is your code, but your system is not ONLY your code.

Are your database IDs guessable? Are they sequential?.

Is there a time delta between a request with an invalid username and a request with an invalid password?.

Can you brute force the username or password field in any way?.

Using Selenium, you can test for a number of major flaws, including SQL injections, cross-site scripting attacks, and session hijacking. Selenium has become the default for testing web applications. System-level abuses cases are a bit trickier, but with enough thought, you can avoid a number of scary scenarios and build protections into your automated testing suite. The system view is how most of the bad people will access an application-interfacing with it as a user or as a scripted farce of a user. But developers can do a few things now to get the process started. It’s impossible to define thorough abuse cases entirely within development. Sure, the bulk of this burden falls to your security and product management teams. To prevent embarrassing business failures. To prepare your codebases for use cases that compromise sensitive information. You need to think like an attacker at the unit, system, and infrastructure levels. What you need, then, are the opposite of use cases: abuse cases. And you want to do this while minimizing the impact on legitimate users.

But you also need to put the most resistance between bad people and the data/access they want. Use cases create a path of least resistance for users to get what they want. There are no protections in place to help developers anticipate what a malicious user might do with a feature. Unfortunately, the security world hasn’t evolved in the same ways. In a perfect world, it prevents unnecessary and redundant work. Developers build the application to those specs.

#Ddos testing with siege tool code#

Product managers draft use cases to ensure the code they write meets their business objectives.

#Ddos testing with siege tool software#

Use cases have become common practice in agile software development to help developers deliver code that meets intended feature requests. Writing abuse cases is an exercise in “thinking like the enemy.” It’s a great way to help secure your software and systems and stay ahead of attacks.