Ontario College of Teachers

Scheduled system maintenance of Members area and online registration platforms

December 31 2023

Our online self-serve application platform will be offline for maintenance from 8:00 p.m. on Sunday, December 31st, 2023 until 9:00 a.m. on Tuesday, January 2nd, 2024. We apologize for any inconvenience this may cause.

Maintenance de la section réservée aux membres et de la plateforme d’inscription en ligne

Le 31 décembre 2023

Notre plateforme d’options libre-service sera mise hors ligne pour maintenance à compter de 20 h, le dimanche 31 décembre 2023 jusqu’à 9 h, le mardi 2 janvier 2024. Nous nous excusons de tout inconvénient que cela pourrait occasionner.

🔒 QA Security Testing Sandbox

QA / PenTest Suite

1. HTTP & Network Links Network / SSL

Test for Mixed Content warnings, HTTP-to-HTTPS redirect enforcement (HSTS), reverse tabnabbing, and open redirects.

Insecure HTTP Link:
⚠️ http://example.com/test-insecure

Tabnabbing Test (target="_blank" without noopener):
🔗 External link (No rel="noopener noreferrer")

Open Redirect Parameter Test:
🔀 Simulate ?redirect=http://example.com

Protocol-Relative Link:
🌐 //example.com/test-relative

2. File Download Functions MIME / Downloads

Test Content-Disposition headers, download MIME sniffing, executable blocking, and browser download protection.

Direct File Download Link:
📥 Download test-download.txt

Dynamic / Client-Side File Generator:

File Name with Extension:

MIME Type:

File Content:

Data URI Download:
💾 Download Sample via Data URI

3. Input Validation & XSS XSS / Injection

Test Reflected & DOM Cross-Site Scripting (XSS) and verify input sanitation / WAF rule sets.

Presets:

Test Input Payload:

DOM Render Mode:

Safe (textContent) Unsafe (innerHTML)

Rendered Output Box:

Output will appear here...

4. Form Submission & CSRF CSRF / POST

Test Cross-Site Request Forgery (CSRF) protections, POST body handling, and SameSite cookie policies.

5. File Upload Inspection Upload / MIME

Inspect file extensions, MIME-type spoofing, and file size limits before uploading to server endpoints.

Select File to Inspect:

File Inspection Metadata:

Select a file above to inspect its properties.

* Test with dangerous extensions (e.g. .exe, .svg, .html, .jsp) to verify WAF and boundary filters.

6. iFrame & Clickjacking Frames / CSP

Test whether this page or external targets can be embedded inside an <iframe> (verifying X-Frame-Options and frame-ancestors).

Frame Source URL:

If blank or blocked by browser, X-Frame-Options or CSP frame-ancestors is active.