52Security Testing (OWASP, ZAP, Burp)

52.1 OWASP Top 10 (2021)

52.2 Common attack vectors — test recipes

XSS (Cross-Site Scripting)

// Try storing malicious payload, then reading
const payload = `<script>window.__xss=true</script>`;
await request.post('/api/comments', { data: { text: payload } });

await page.goto('/comments');
const xssFired = await page.evaluate(() => (window as any).__xss);
expect(xssFired).toBeFalsy();   // payload should be escaped, not executed

SQL Injection

// Login form trick
POST /login {"email": "x' OR 1=1 --", "password": "anything"}

// Expected: 401, not 200 (server uses parameterised queries → no match)

CSRF

Cross-Site Request Forgery: an attacker's page submits a request using the user's logged-in cookies.

• Mitigations: SameSite cookies, CSRF token, double-submit cookie pattern.
• Test: from a different origin, try POSTing without the CSRF token — expect 403.

IDOR (Insecure Direct Object Reference)

// Log in as user A, try to access user B's resource
const r = await request.get('/api/orders/12345', { headers: { Cookie: cookieA } });
expect(r.status()).toBe(403);   // not 200 with B's data

SSRF

POST /api/fetch {"url": "http://169.254.169.254/latest/meta-data/"}
# expected: rejected (cloud metadata endpoint)
POST /api/fetch {"url": "http://localhost:6379/"}
# expected: rejected (internal Redis)

Open Redirect

GET /redirect?to=https://evil.com
# expected: rejected or warning, not silent redirect

52.3 ZAP (OWASP Zed Attack Proxy)

Open-source security scanner. Acts as a proxy: spider the app, then run active scans (auth bypass, XSS, SQLi).

# Baseline scan — passive only (safe to run in CI)
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://staging.acme.com

# Full active scan — never against prod
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://staging.acme.com

Integrate into CI: baseline scan on every PR; full scan nightly. Fail build on high-severity findings.

52.4 Burp Suite

Commercial (free Community edition) intercepting proxy. Used heavily by pentesters. Features: HTTP history, Repeater (resend modified requests), Intruder (fuzz parameters), Decoder, Sequencer (test session tokens for randomness).

Workflow: configure browser to use Burp as proxy, click around the app, watch traffic. Send interesting requests to Repeater to mutate and replay.

52.5 Other tools

52.6 Authentication tests

• Brute force: hit /login with 100 wrong passwords — expect 429 after N
• Weak password accepted: try "password" — expect rejection
• Session fixation: pre-set cookie via JS, log in, ensure server issues a NEW session id
• Token leakage: log in, check tokens not appearing in URL/Referer/server logs
• Insecure direct password storage: register, dump DB, ensure password is hashed (bcrypt/argon2), not plain or MD5

52.7 Security headers (cheap wins)

test('security headers present', async ({ request }) => {
  const r = await request.get('/');
  const h = r.headers();
  expect(h['content-security-policy']).toBeDefined();
  expect(h['strict-transport-security']).toContain('max-age');
  expect(h['x-content-type-options']).toBe('nosniff');
});

52.8 SDET role in security

• Own the cheap, automatable checks: headers, auth flows, basic injection fuzzing, dependency scans in CI.
• Partner with dedicated AppSec / pentest teams for deep audits, threat modelling.
• Bug-bounty triage often lands on SDETs — reproduce, file, verify fix.