Work2Code - Secure Coding and Exploratory Testing.

TESTING SMARTER WITH SANTHOSH TUPPAD (INTERVIEW BY HEXAWISE)

This interview with Santhosh Tuppad is part of Hexawise's series of “Testing Smarter with…” interviews. Their goal with these interviews is to highlight insights and experiences as told by many of the software testing field’s leading thinkers.

Santhosh Tuppad fell in love with computers when he was 12 and since then his love for computers has increased exponentially. He founded his first startup in 2010 and was part of growing the company to nearly 80 people.

THE UGLY SIDE OF A FANCY SOFTWARE

Today, we may be highly proud of the internet society because of great applications that have been developed to make things easier for humans in terms of accessibility of services which includes healthcare, e-commerce, banking, insurance, social media and whatnot. However, there is a darker side to all of this fancy thing that we have.

What type of information on a company/ site/ person may be helpful in preparing an attack?

During my childhood days, I was a great liar and a thief who used to break-in and bypass school infrastructure and grocery shops through social engineering skills. Well, I never practiced these skills, but somehow they were ingrained deeply in my brain I guess. I never knew it was called “Social Engineering” in the first place.

So, any information is brilliant if I know how to use it and connect it to my purpose or an attack. Here is a quick list of certain information that I can think of,

Local Risks that matter. Are you mitigating them or avoiding these?

Take backup [ Regular ]

Run scheduled full scan on your local environment

Use WiFi with WPA encryption

Use secure FTP to transfer files from your computer to server

Maintain audit logs on your hosting environment

Check your .htaccess files to see if it was modified by a hacker to have a redirect

Check your plugins

Check your users [ Maybe it was some other user who has admin access. Is it only you who is admin? If it’s only you, was the password leaked or cracked? ]

Use scanners like WP Scan http://wpscan.org/ and http://sucuri.net/

Use the GOTMLS scan and run the scanner → Get off the maliciously loaded scripts

Full backups

Partial backups

Who is a black hat hacker exactly? What does he/she do?