What is your "generic" web application testing plan ?

Question

Like, testing for :

• invalid inputs (strings containing "'"s)
• giving random id's in url parameters to access "unauthorized" pages
• prevent sql injection
• ...

Answer 1

I would recommend reading this brilliant book to learn more about the test plans.

In particular a test plan is much more than a list of techniques like you mentioned (these should most likely go into the details for the security testing)

It should at least contain:

• The answers to the main questions:
  • why bother (what is gained by testing)
  • who cares (who are we working for)
  • how much (..testing will be done)

You would not go wrong providing also:

• Platforms
• Methods (positive testing, load testing etc)
• Functionality you're planning to test
• Acceptance criteria

And there is plenty more things to talk about in the plan.

Answer 2

If you want to make a list, you can add "Trying simple javascripts within a textarea field to see if the site saves and executes them"

Answer 3

Test responses for: For integers - strings, null, values more than those allowed, negative, zero.. For strings - strings of lengths longer than that allowed

For invalid values, you can check if the response being returned is informative enough.

Test to see that your application logs these errors. If it doesn't you won't be able to identify and debug problems easily when they occur in production.

Also fuzz testing is a must for web applications.

Answer 4

this is what i use

Quality Test Plan

its very simple, straight-forward. covers many common web flaws (e.g. broken links, etc)

you might think its too basic, but im always surprised how many bugs it reveals

--LM