Company Setup, Sanity Tetsing on Company
Admin Flow, Employee Flow
Admin flow record for ZAP active Scan

HTML report Review

Login Page, Forgot Pwd Page testing

Azure Testing for SSM

Azure US Testing

Testing for employee SSM

Testing on Azure for Employee Pages & Authorization failures

Tried Interception on Change Passoword, Welcome Page, Demographics page

Demographics Page

Worked on Enroll Now page interceptions for cost and coverage.

Enroll Now page testing

JIRA Updates

Test Plan for Stage/Production Security Testing -
Employee Pages

• Login Page
• Static Pages

Stage Environment
Testing for Employee SSM -
Upload document Page
Employee Beneficiary Page
Enroll Now Pages

Testing on Stage for Forgot Password Page
and Static pages

Testing for Onboard Tour Page URLs

Test Plan, Authentication Test

Internal Discussion with Rakesh
Test Plan Update
Discussion with Anirudha J for Task understanding
Internal discussion for Access Rights on company

Security team discussion. Knowledge sharing

Tested below points on production with different user logins.

Error Handling & Logging
Access Control

Tested below points on production with different user logins.

Error Handling & Logging
Access Control

Discussion with Anirudha
Malicious input handling test

Security Test Access Control, Input Validations

Data Protection

Security team discussion. Knowledge sharing
Tested below points on production with different user logins.
Communication

Security team discussion. Knowledge sharing
Tested below points on production with different user logins.
HTTP

Security team discussion. Knowledge sharing
Tested below points on production with different user logins.
Business Logic

Employee Flow Verification through ZAP

Internal Discussion with Anirudha for ZAP flow verification
Security Test Execution

Fuzzing, Spider & Active Scan

Recorded different scenarios with OWASP ZAP and found vulnerabilities which are reported in the "JIRA ID: WT-12154 Security alerts reported during ZAP Spidering of the production application with partner login"

Also, attached the ZAP reports to the JIRA ID: WT-12154

Security test Scan
Issues & Reports
Internal Discusison

Recorded different scenarios with OWASP ZAP and found vulnerabilities which are reported in the "JIRA ID: WT-12154 Security alerts reported during ZAP Spidering of the production application with partner login"

Also, attached the ZAP reports to the JIRA ID: WT-12154

Discussionw with santosh for ZAP issues

Recorded different scenarios with OWASP ZAP and found vulnerabilities which are reported in the "JIRA ID: WT-12154 Security alerts reported during ZAP Spidering of the production application with partner login"

Also, attached the ZAP reports to the JIRA ID: WT-12154

Internal Discussions iwth Santosh and Anirudha

Test Plan for Security- Azure

Internal Discussion with Santosh, Samir
Internal Discussion Anirudha
Project Plan Updates

Tested 'Login Page', 'Change Password', 'Localization Pages' pages for below security test checkpoints on pre-production environment.

Access Control
Malicious Input Handling
Session Management
Authentication

Reported defect related to login page vulnerability in the JIRA ID, NF-5482: [Security] Login page : Server Error with stack trace displayed on login page.

Tested 'Partner Dashboard', 'Configure Dashboard' pages for below security test checkpoints on pre-production environment.

Access Control
Malicious Input Handling
Session Management
Authentication

Tested 'User Access Policies' pages for below security test checkpoints on pre-production environment.

Access Control
Malicious Input Handling
Session Management
Authentication

Tested 'Add Company', 'Search company' pages for below security test checkpoints on pre-production environment.

Access Control
Malicious Input Handling
Session Management
Authentication

Tested 'Change Employee Password', 'Change Employee Status', 'User Credentials Settings' pages for below security test checkpoints on pre-production environment.

Access Control
Malicious Input Handling
Session Management
Authentication

Security Testing 4h

Security Testing 5h

Security Test
Internal Discussions
ZAP Scan

1. Discussion regarding the security testing for the mobile Application
2. Review the mobile security testing points shared by Prasad

PreProd Security testing

Review the mobile security testing points shared by Prasad

Employee Level Testing

Employee level test

Web App Security Test

Web App Security Test

Web App Security Testing

1. Discussion with the mobile team regarding the APK installation
2. Started Security testing on the Android mobile

1. Self Serve Mode Security Testing

Mobile Security Testing

Testing for Mobile Security

Mobile Secutity Testing for Android and Ios

Mobile Secutity Testing

Mobile Security Testing

Debugging the issues encountered during the testing of Mobile Security testing.

Debugging the issues encountered during mobile Security Testing

Mobile Security testing on Android device.

Mobile Security Testing on Mobile Device.

Mobile Security Testing on Android device.

IPad Security testing

IOS Security Test
Build verification and Discusion with Rohan

Internal Discussion and Security test for ipad

Security Testing for IOS

Security TEst for remaining part of IOS app
Internal Discusison with Shailesh and Mobile Team QA

Mobile Security Testing on Android Device

Test Status meeting with Samir, Vijayendra and Santosh
Discussion with Vijayendra and Pratap
ZAP run and Analysis for findings to be shared on Reports

Mobile Security testing on Android device

Web Remediation Plan Verification for Benchmarking of Security on Preprod environment

Security Testing on Android Device.

Remediation Sheet test scenarios Verification
Internal Discussions

1. Manual Execution of Security Testing Scenarios on Mobile application Android device
2. Preparing the Security testing report for Manual execution

1. ZAP Scenario Record and scheduling active scan
2. Created two employees on the PreProd environment to record the scenario

Mobile Team - ZAP Scenario reocrd, Active Scan,

1. ZAP Scenario Record and scheduling active scan
2. Created two employees on the PreProd environment to record the scenario

1. Analysis of security test execution report
2. Understanding of ZAP tool.

ZAP Report for IOS
Discussion and Verification with Shailesh

1. Exploring the ZAP tool for Web Security testing

1. Exploring the ZAP tool for Web Security testing

Security PPTs and Reports documentation
OLD Issue closure

Security PPTs updates for Presentation
Test Report Document
PenTest Tools Read