OWASP Top 10 awareness in Testing Fundamentals - Framework Patterns

Framework Mode - OWASP Top 10 awareness

Folder Structure for OWASP Top 10 Awareness Testing

  owasp-top10-testing/
  ├── tests/
  │   ├── injection_tests/
  │   │   └── test_sql_injection.py
  │   ├── broken_authentication_tests/
  │   │   └── test_authentication.py
  │   ├── xss_tests/
  │   │   └── test_xss.py
  │   ├── security_misconfiguration_tests/
  │   │   └── test_security_headers.py
  │   ├── sensitive_data_tests/
  │   │   └── test_data_encryption.py
  │   └── ...
  ├── pages/
  │   └── login_page.py
  ├── utils/
  │   ├── security_helpers.py
  │   └── test_data_generator.py
  ├── config/
  │   ├── environments.yaml
  │   └── credentials.yaml
  ├── reports/
  ├── conftest.py
  └── README.md
  

Test Framework Layers for OWASP Top 10 Awareness

• Test Cases Layer: Contains tests targeting each OWASP Top 10 risk, e.g., SQL Injection, XSS, Broken Authentication.
• Page Objects Layer: Encapsulates web page elements and actions, e.g., login forms, input fields, to reuse in security tests.
• Utilities Layer: Helper functions for security payloads, encoding, encryption, and test data generation.
• Configuration Layer: Manages environment URLs, credentials, and test settings for different deployment stages.
• Reporting Layer: Collects and formats test results, highlighting security vulnerabilities found.

Configuration Patterns

Use environments.yaml to define URLs and settings for dev, staging, and production.

Store sensitive credentials securely in credentials.yaml or environment variables, never hard-coded.

Allow selecting target environment and browser via command-line options or config files.

Example snippet from environments.yaml:

  dev:
    base_url: "https://dev.example.com"
    api_key: "dev-api-key"
  staging:
    base_url: "https://staging.example.com"
    api_key: "staging-api-key"
  

Test Reporting and CI/CD Integration

• Generate detailed HTML or XML reports showing which OWASP risks were tested and their pass/fail status.
• Integrate with CI/CD pipelines (e.g., Jenkins, GitHub Actions) to run security tests automatically on code changes.
• Fail builds if critical OWASP vulnerabilities are detected to prevent unsafe releases.
• Send notifications (email, Slack) with test summaries for quick awareness.

Best Practices for OWASP Top 10 Testing Framework

1. Modular Tests: Write separate tests for each OWASP risk to isolate issues clearly.
2. Reusable Security Payloads: Store common attack strings and scripts in utility files for consistency.
3. Environment Safety: Run destructive tests only in safe environments to avoid harming production data.
4. Clear Reporting: Provide actionable reports that explain vulnerabilities in simple terms for developers and testers.
5. Continuous Testing: Automate OWASP tests in CI/CD to catch security issues early and often.

Self Check Question

Where in this folder structure would you add a new test for Cross-Site Scripting (XSS) vulnerabilities?

Key Result

Organize OWASP Top 10 security tests into clear layers with modular tests, reusable utilities, and automated reporting integrated into CI/CD.

Practice

1. What is the main purpose of the OWASP Top 10 list in software testing?

easy

A. To rank the fastest web browsers

B. To highlight the most common security risks in web applications

C. To provide a checklist for UI design improvements

D. To list all programming languages used in web development

Solution

1. Step 1: Understand OWASP Top 10's focus

   OWASP Top 10 is a list of the most common security risks in web apps.

2. Step 2: Match purpose with options

   Only To highlight the most common security risks in web applications correctly states it highlights common security risks.

3. Final Answer:

   To highlight the most common security risks in web applications -> Option B

4. Quick Check:

   OWASP Top 10 = Common security risks [OK]

Hint: OWASP = security risks list for web apps [OK]

Common Mistakes:

• Confusing OWASP with UI or browser topics
• Thinking it lists programming languages
• Assuming it ranks performance

2. Which of the following is a correct example of an OWASP Top 10 risk?

easy

A. Cross-Site Scripting (XSS)

B. Slow page loading

C. Incorrect font size

D. Missing alt text on images

Solution

1. Step 1: Identify OWASP Top 10 risks

   OWASP Top 10 includes risks like Cross-Site Scripting (XSS), SQL Injection, etc.

2. Step 2: Compare options to known risks

   Only Cross-Site Scripting (XSS) is a recognized OWASP Top 10 risk; others are unrelated to security risks.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option A

4. Quick Check:

   XSS is a common OWASP risk [OK]

Hint: Pick known security risks like XSS, SQLi, not UI issues [OK]

Common Mistakes:

• Choosing UI or performance issues as security risks
• Confusing accessibility issues with security risks
• Not recognizing common OWASP terms

3. Consider this code snippet for input validation in a web app:

if (userInput.includes('<script>')) {
  rejectInput();
} else {
  acceptInput();
}

Which OWASP risk is this code trying to prevent?

medium

A. Broken Authentication

B. Security Misconfiguration

C. Cross-Site Scripting (XSS)

D. Sensitive Data Exposure

Solution

1. Step 1: Analyze code purpose

   The code checks if user input contains '<script>' tags and rejects it.

2. Step 2: Link to OWASP risks

   Rejecting script tags prevents Cross-Site Scripting (XSS), where attackers inject scripts.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option C

4. Quick Check:

   Blocking scripts = Prevent XSS [OK]

Hint: Script tags in input? Think XSS risk [OK]

Common Mistakes:

• Confusing input validation with authentication issues
• Ignoring script injection as a security risk
• Choosing unrelated OWASP risks

4. A tester finds that a web app allows users to upload files without checking file type. Which OWASP risk does this represent, and what is the best fix?

medium

A. Cross-Site Request Forgery; use CSRF tokens

B. Insecure Deserialization; encrypt files

C. Broken Access Control; add user login

D. Unrestricted File Upload; validate file types before upload

Solution

1. Step 1: Identify the risk from file upload issue

   Allowing uploads without validation is Unrestricted File Upload risk.

2. Step 2: Determine best fix

   Validating file types before upload prevents malicious files from being accepted.

3. Final Answer:

   Unrestricted File Upload; validate file types before upload -> Option D

4. Quick Check:

   File upload risk = Validate file types [OK]

Hint: File upload without checks? Think Unrestricted File Upload [OK]

Common Mistakes:

• Confusing file upload with access control
• Suggesting encryption instead of validation
• Mixing unrelated OWASP risks

5. A web app stores passwords in plain text and does not limit login attempts. Which two OWASP Top 10 risks does this violate, and what combined testing approach should be used?

hard

A. Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection

B. Security Misconfiguration and Cross-Site Scripting; test server setup and input fields

C. Insecure Deserialization and XML External Entities; test data parsing

D. Cross-Site Request Forgery and Broken Access Control; test session tokens and permissions

Solution

1. Step 1: Identify risks from password storage and login attempts

   Storing passwords in plain text is Sensitive Data Exposure; no login limits is Broken Authentication.

2. Step 2: Determine testing approach

   Test password storage security and brute force attack protections to cover both risks.

3. Final Answer:

   Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection -> Option A

4. Quick Check:

   Plain text + no limits = Sensitive Data + Broken Auth [OK]

Hint: Plain passwords + no limits = Sensitive Data + Broken Auth [OK]

Common Mistakes:

• Mixing unrelated OWASP risks
• Ignoring combined risks in one scenario
• Confusing testing focus areas