OWASP Top 10 awareness in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Injection Attacks

Which of the following best describes an Injection attack as listed in the OWASP Top 10?

A An attacker exploits weak passwords to gain unauthorized access to user accounts.

B An attacker intercepts data between two systems to steal sensitive information during transmission.

C An attacker floods a server with excessive requests to make it unavailable to legitimate users.

D An attacker sends malicious code to a program, tricking it into executing unintended commands or accessing data without proper authorization.

💡 Hint

Think about how attackers might trick a program into doing something it shouldn't by sending unexpected input.

Injection attacks happen when untrusted data is sent to an interpreter as part of a command or query, causing the interpreter to execute unintended commands or access data.

❓ Predict Output

intermediate

Result of Unsafe SQL Query Construction

Consider this Python code snippet that constructs an SQL query unsafely:

user_input = "' OR '1'='1'"
query = f"SELECT * FROM users WHERE username = '{user_input}'"
print(query)

What is the printed output?

Testing Fundamentals

user_input = "' OR '1'='1'"
query = f"SELECT * FROM users WHERE username = '{user_input}'"
print(query)

A SELECT * FROM users WHERE username = '' OR '1'='1'

B SELECT * FROM users WHERE username = 'user_input'

C SELECT * FROM users WHERE username = '' OR 1=1

D SyntaxError due to incorrect string formatting

💡 Hint

Look carefully at how the user input is inserted into the query string.

The user input includes SQL code that closes the string and adds an OR condition that is always true, which can lead to unauthorized data access.

❓ assertion

advanced

Testing for Broken Authentication

You want to write a test to check if a web application properly locks an account after 5 failed login attempts to prevent Broken Authentication.

Which assertion best verifies this behavior?

A assert response.status_code == 500 and 'server error' in response.text

B assert response.status_code == 403 and 'account locked' in response.text

C assert response.status_code == 200 and 'login failed' in response.text

D assert response.status_code == 404 and 'not found' in response.text

💡 Hint

Think about what status code and message indicate the account is locked.

A 403 Forbidden status with a message about account lockout confirms the application blocks access after too many failed attempts, preventing broken authentication.

🔧 Debug

advanced

Identifying Security Misconfiguration

Given this test code snippet checking HTTP headers for security:

response = client.get('/login')
assert 'X-Frame-Options' in response.headers
assert response.headers['X-Frame-Options'] == 'DENY'
assert 'Content-Security-Policy' in response.headers
assert response.headers['Content-Security-Policy'] == "default-src 'self'"
assert 'Server' not in response.headers

Which assertion will fail if the server reveals its software version in the headers?

Testing Fundamentals

response = client.get('/login')
assert 'X-Frame-Options' in response.headers
assert response.headers['X-Frame-Options'] == 'DENY'
assert 'Content-Security-Policy' in response.headers
assert response.headers['Content-Security-Policy'] == "default-src 'self'"
assert 'Server' not in response.headers

A assert response.headers['Content-Security-Policy'] == "default-src 'self'"

B assert 'X-Frame-Options' in response.headers

C assert 'Server' not in response.headers

D assert response.headers['X-Frame-Options'] == 'DENY'

💡 Hint

Check which header reveals server information.

The 'Server' header reveals software version and should be hidden to avoid security misconfiguration. If present, the assertion fails.

❓ framework

expert

Automating OWASP Top 10 Security Tests

You want to automate tests for OWASP Top 10 vulnerabilities using a testing framework. Which approach best ensures coverage of Cross-Site Scripting (XSS) vulnerabilities?

A Injecting script tags in input fields and asserting the output page escapes or sanitizes them to prevent script execution.

B Sending SQL commands in input fields and checking for database errors in responses.

C Flooding the login endpoint with requests to test rate limiting.

D Checking if the server returns detailed error messages on invalid URLs.

💡 Hint

Think about how XSS attacks work and how to detect them in tests.

XSS attacks inject malicious scripts into web pages. Testing involves inputting scripts and verifying the application properly escapes or sanitizes them to prevent execution.

Practice

1. What is the main purpose of the OWASP Top 10 list in software testing?

easy

A. To rank the fastest web browsers

B. To highlight the most common security risks in web applications

C. To provide a checklist for UI design improvements

D. To list all programming languages used in web development

Solution

1. Step 1: Understand OWASP Top 10's focus

   OWASP Top 10 is a list of the most common security risks in web apps.

2. Step 2: Match purpose with options

   Only To highlight the most common security risks in web applications correctly states it highlights common security risks.

3. Final Answer:

   To highlight the most common security risks in web applications -> Option B

4. Quick Check:

   OWASP Top 10 = Common security risks [OK]

Hint: OWASP = security risks list for web apps [OK]

Common Mistakes:

• Confusing OWASP with UI or browser topics
• Thinking it lists programming languages
• Assuming it ranks performance

2. Which of the following is a correct example of an OWASP Top 10 risk?

easy

A. Cross-Site Scripting (XSS)

B. Slow page loading

C. Incorrect font size

D. Missing alt text on images

Solution

1. Step 1: Identify OWASP Top 10 risks

   OWASP Top 10 includes risks like Cross-Site Scripting (XSS), SQL Injection, etc.

2. Step 2: Compare options to known risks

   Only Cross-Site Scripting (XSS) is a recognized OWASP Top 10 risk; others are unrelated to security risks.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option A

4. Quick Check:

   XSS is a common OWASP risk [OK]

Hint: Pick known security risks like XSS, SQLi, not UI issues [OK]

Common Mistakes:

• Choosing UI or performance issues as security risks
• Confusing accessibility issues with security risks
• Not recognizing common OWASP terms

3. Consider this code snippet for input validation in a web app:

if (userInput.includes('<script>')) {
  rejectInput();
} else {
  acceptInput();
}

Which OWASP risk is this code trying to prevent?

medium

A. Broken Authentication

B. Security Misconfiguration

C. Cross-Site Scripting (XSS)

D. Sensitive Data Exposure

Solution

1. Step 1: Analyze code purpose

   The code checks if user input contains '<script>' tags and rejects it.

2. Step 2: Link to OWASP risks

   Rejecting script tags prevents Cross-Site Scripting (XSS), where attackers inject scripts.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option C

4. Quick Check:

   Blocking scripts = Prevent XSS [OK]

Hint: Script tags in input? Think XSS risk [OK]

Common Mistakes:

• Confusing input validation with authentication issues
• Ignoring script injection as a security risk
• Choosing unrelated OWASP risks

4. A tester finds that a web app allows users to upload files without checking file type. Which OWASP risk does this represent, and what is the best fix?

medium

A. Cross-Site Request Forgery; use CSRF tokens

B. Insecure Deserialization; encrypt files

C. Broken Access Control; add user login

D. Unrestricted File Upload; validate file types before upload

Solution

1. Step 1: Identify the risk from file upload issue

   Allowing uploads without validation is Unrestricted File Upload risk.

2. Step 2: Determine best fix

   Validating file types before upload prevents malicious files from being accepted.

3. Final Answer:

   Unrestricted File Upload; validate file types before upload -> Option D

4. Quick Check:

   File upload risk = Validate file types [OK]

Hint: File upload without checks? Think Unrestricted File Upload [OK]

Common Mistakes:

• Confusing file upload with access control
• Suggesting encryption instead of validation
• Mixing unrelated OWASP risks

5. A web app stores passwords in plain text and does not limit login attempts. Which two OWASP Top 10 risks does this violate, and what combined testing approach should be used?

hard

A. Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection

B. Security Misconfiguration and Cross-Site Scripting; test server setup and input fields

C. Insecure Deserialization and XML External Entities; test data parsing

D. Cross-Site Request Forgery and Broken Access Control; test session tokens and permissions

Solution

1. Step 1: Identify risks from password storage and login attempts

   Storing passwords in plain text is Sensitive Data Exposure; no login limits is Broken Authentication.

2. Step 2: Determine testing approach

   Test password storage security and brute force attack protections to cover both risks.

3. Final Answer:

   Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection -> Option A

4. Quick Check:

   Plain text + no limits = Sensitive Data + Broken Auth [OK]

Hint: Plain passwords + no limits = Sensitive Data + Broken Auth [OK]

Common Mistakes:

• Mixing unrelated OWASP risks
• Ignoring combined risks in one scenario
• Confusing testing focus areas