# The Most Common Web Application Security Testing Questions

**URL:** <https://club.ministryoftesting.com/t/the-most-common-web-application-security-testing-questions/12902>\
**Category:** Uncategorized\
**Created:** [29 January 2018 12:46 UTC](https://club.ministryoftesting.com/t/the-most-common-web-application-security-testing-questions/12902 "2018-01-29T12:46:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![heather\_reid](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/heather_reid/32/29_2.png) [@heather\_reid](https://club.ministryoftesting.com/u/heather_reid)\
**Post date:** [29 January 2018 12:46 UTC](https://club.ministryoftesting.com/t/the-most-common-web-application-security-testing-questions/12902/1 "2018-01-29T12:46:29Z")

</div>

Hey @danielbilling, we’ve run your workshop at a few TestBash events now. The demand is always high!

I’m wondering what are the top three questions you see asked at the workshops? Without giving too much away about your workshop [“Web Application Security: A Hands-on Testing Challenge”](https://dojo.ministryoftesting.com/events/testbash-brighton-2018), how do you answer these?

---

<div class="post-metadata">

**Author:** ![danielbilling](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/danielbilling/32/8976_2.png) [@danielbilling](https://club.ministryoftesting.com/u/danielbilling)\
**Post date:** [29 January 2018 13:08 UTC](https://club.ministryoftesting.com/t/the-most-common-web-application-security-testing-questions/12902/2 "2018-01-29T13:08:32Z")

</div>

Hi @heather_reid

The questions I normally get are usually centred around the techniques of security testing. Things like “How does SQL Injection work?”, or “How do you find security issues in an API?”, or “What is Cross Site Scripting?” As you don’t want me to spoil the workshop, I’ll say this.

We answer the questions through practising those techniques. We explore the major vulnerabilities (the new OWASP Top 10 was released last year), we look at how social engineering can be used to discover useful information, and we attempt to breach a vulnerable website using those very techniques.

I think the best way of understanding the implications of security issues in software is simply to practice finding those kinds of problems. By doing that, it allows you to understand the impact of vulnerabilities, and how potentially serious security issues are. We will be looking at how to breach user credentials, modify application and user data, and even undermine an entire application to effect a denial of service. All good fun.