OWASP Top 10 awareness in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Injection Attacks

Which of the following best describes an Injection attack as listed in the OWASP Top 10?

A An attacker exploits weak passwords to gain unauthorized access to user accounts.

B An attacker intercepts data between two systems to steal sensitive information during transmission.

C An attacker floods a server with excessive requests to make it unavailable to legitimate users.

D An attacker sends malicious code to a program, tricking it into executing unintended commands or accessing data without proper authorization.

💡 Hint

Think about how attackers might trick a program into doing something it shouldn't by sending unexpected input.

Injection attacks happen when untrusted data is sent to an interpreter as part of a command or query, causing the interpreter to execute unintended commands or access data.

❓ Predict Output

intermediate

Result of Unsafe SQL Query Construction

Consider this Python code snippet that constructs an SQL query unsafely:

user_input = "' OR '1'='1'"
query = f"SELECT * FROM users WHERE username = '{user_input}'"
print(query)

What is the printed output?

Testing Fundamentals

user_input = "' OR '1'='1'"
query = f"SELECT * FROM users WHERE username = '{user_input}'"
print(query)

A SELECT * FROM users WHERE username = '' OR '1'='1'

B SELECT * FROM users WHERE username = 'user_input'

C SELECT * FROM users WHERE username = '' OR 1=1

D SyntaxError due to incorrect string formatting

💡 Hint

Look carefully at how the user input is inserted into the query string.

The user input includes SQL code that closes the string and adds an OR condition that is always true, which can lead to unauthorized data access.

❓ assertion

advanced

Testing for Broken Authentication

You want to write a test to check if a web application properly locks an account after 5 failed login attempts to prevent Broken Authentication.

Which assertion best verifies this behavior?

A assert response.status_code == 500 and 'server error' in response.text

B assert response.status_code == 403 and 'account locked' in response.text

C assert response.status_code == 200 and 'login failed' in response.text

D assert response.status_code == 404 and 'not found' in response.text

💡 Hint

Think about what status code and message indicate the account is locked.

A 403 Forbidden status with a message about account lockout confirms the application blocks access after too many failed attempts, preventing broken authentication.

🔧 Debug

advanced

Identifying Security Misconfiguration

Given this test code snippet checking HTTP headers for security:

response = client.get('/login')
assert 'X-Frame-Options' in response.headers
assert response.headers['X-Frame-Options'] == 'DENY'
assert 'Content-Security-Policy' in response.headers
assert response.headers['Content-Security-Policy'] == "default-src 'self'"
assert 'Server' not in response.headers

Which assertion will fail if the server reveals its software version in the headers?

Testing Fundamentals

response = client.get('/login')
assert 'X-Frame-Options' in response.headers
assert response.headers['X-Frame-Options'] == 'DENY'
assert 'Content-Security-Policy' in response.headers
assert response.headers['Content-Security-Policy'] == "default-src 'self'"
assert 'Server' not in response.headers

A assert response.headers['Content-Security-Policy'] == "default-src 'self'"

B assert 'X-Frame-Options' in response.headers

C assert 'Server' not in response.headers

D assert response.headers['X-Frame-Options'] == 'DENY'

💡 Hint

Check which header reveals server information.

The 'Server' header reveals software version and should be hidden to avoid security misconfiguration. If present, the assertion fails.

❓ framework

expert

Automating OWASP Top 10 Security Tests

You want to automate tests for OWASP Top 10 vulnerabilities using a testing framework. Which approach best ensures coverage of Cross-Site Scripting (XSS) vulnerabilities?

A Injecting script tags in input fields and asserting the output page escapes or sanitizes them to prevent script execution.

B Sending SQL commands in input fields and checking for database errors in responses.

C Flooding the login endpoint with requests to test rate limiting.

D Checking if the server returns detailed error messages on invalid URLs.

💡 Hint

Think about how XSS attacks work and how to detect them in tests.

XSS attacks inject malicious scripts into web pages. Testing involves inputting scripts and verifying the application properly escapes or sanitizes them to prevent execution.