OWASP Top 10 awareness in Testing Fundamentals - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the OWASP Top 10 risk related to broken authentication.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for broken authentication

Drag options to blanks, or click blank then click option'

AA5-Security Misconfiguration

BA1-Injection

CA3-Sensitive Data Exposure

DA2-Broken Authentication

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing injection with authentication issues.

Choosing risks unrelated to user login.

The OWASP Top 10 risk related to broken authentication is A2-Broken Authentication.

2fill in blank

medium

Complete the code to select the OWASP Top 10 risk that involves attackers injecting malicious code.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for code injection attacks

Drag options to blanks, or click blank then click option'

AA1-Injection

BA4-Insecure Design

CA7-Identification and Authentication Failures

DA9-Using Components with Known Vulnerabilities

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing injection with design flaws.

Choosing risks related to authentication instead.

The OWASP Top 10 risk for code injection attacks is A1-Injection.

3fill in blank

hard

Fix the error in the code to correctly assign the OWASP Top 10 risk for sensitive data exposure.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for sensitive data exposure

Drag options to blanks, or click blank then click option'

AA3-Sensitive Data Exposure

BA8-Insecure Deserialization

CA6-Vulnerable and Outdated Components

DA10-Insufficient Logging & Monitoring

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing outdated components risk instead.

Confusing with insecure deserialization.

The correct OWASP Top 10 risk for sensitive data exposure is A3-Sensitive Data Exposure.

4fill in blank

hard

Fill both blanks to complete the code that creates a dictionary mapping OWASP risk codes to their descriptions.

Testing Fundamentals

owasp_risks = {"[1]": "Injection", "[2]": "Broken Authentication"}

Drag options to blanks, or click blank then click option'

AA1-Injection

BA2-Broken Authentication

CA3-Sensitive Data Exposure

DA4-Insecure Design

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping the codes for Injection and Broken Authentication.

Using risk codes unrelated to the descriptions.

The dictionary keys for Injection and Broken Authentication are A1-Injection and A2-Broken Authentication respectively.

5fill in blank

hard

Fill all three blanks to complete the code that filters OWASP risks starting with 'A' and having a number less than 5.

Testing Fundamentals

filtered_risks = {risk: desc for risk, desc in risks.items() if risk[1] [2] and int(risk[1]) [3] 5}

Drag options to blanks, or click blank then click option'

A.startswith('A')

B<

C<=

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '<=' instead of '==' for exact match.

Using '==' instead of '<' for numeric comparison.

The code checks if the risk starts with 'A' (using .startswith('A')), then verifies the second character equals '1' (using ==), and finally checks if the integer value of the second character is less than 5 (using <).

Note: The second blank is best as '==' to check exact match, and the third blank is '<' to check less than 5.

Practice

1. What is the main purpose of the OWASP Top 10 list in software testing?

easy

A. To rank the fastest web browsers

B. To highlight the most common security risks in web applications

C. To provide a checklist for UI design improvements

D. To list all programming languages used in web development

Solution

1. Step 1: Understand OWASP Top 10's focus

   OWASP Top 10 is a list of the most common security risks in web apps.

2. Step 2: Match purpose with options

   Only To highlight the most common security risks in web applications correctly states it highlights common security risks.

3. Final Answer:

   To highlight the most common security risks in web applications -> Option B

4. Quick Check:

   OWASP Top 10 = Common security risks [OK]

Hint: OWASP = security risks list for web apps [OK]

Common Mistakes:

• Confusing OWASP with UI or browser topics
• Thinking it lists programming languages
• Assuming it ranks performance

2. Which of the following is a correct example of an OWASP Top 10 risk?

easy

A. Cross-Site Scripting (XSS)

B. Slow page loading

C. Incorrect font size

D. Missing alt text on images

Solution

1. Step 1: Identify OWASP Top 10 risks

   OWASP Top 10 includes risks like Cross-Site Scripting (XSS), SQL Injection, etc.

2. Step 2: Compare options to known risks

   Only Cross-Site Scripting (XSS) is a recognized OWASP Top 10 risk; others are unrelated to security risks.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option A

4. Quick Check:

   XSS is a common OWASP risk [OK]

Hint: Pick known security risks like XSS, SQLi, not UI issues [OK]

Common Mistakes:

• Choosing UI or performance issues as security risks
• Confusing accessibility issues with security risks
• Not recognizing common OWASP terms

3. Consider this code snippet for input validation in a web app:

if (userInput.includes('<script>')) {
  rejectInput();
} else {
  acceptInput();
}

Which OWASP risk is this code trying to prevent?

medium

A. Broken Authentication

B. Security Misconfiguration

C. Cross-Site Scripting (XSS)

D. Sensitive Data Exposure

Solution

1. Step 1: Analyze code purpose

   The code checks if user input contains '<script>' tags and rejects it.

2. Step 2: Link to OWASP risks

   Rejecting script tags prevents Cross-Site Scripting (XSS), where attackers inject scripts.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option C

4. Quick Check:

   Blocking scripts = Prevent XSS [OK]

Hint: Script tags in input? Think XSS risk [OK]

Common Mistakes:

• Confusing input validation with authentication issues
• Ignoring script injection as a security risk
• Choosing unrelated OWASP risks

4. A tester finds that a web app allows users to upload files without checking file type. Which OWASP risk does this represent, and what is the best fix?

medium

A. Cross-Site Request Forgery; use CSRF tokens

B. Insecure Deserialization; encrypt files

C. Broken Access Control; add user login

D. Unrestricted File Upload; validate file types before upload

Solution

1. Step 1: Identify the risk from file upload issue

   Allowing uploads without validation is Unrestricted File Upload risk.

2. Step 2: Determine best fix

   Validating file types before upload prevents malicious files from being accepted.

3. Final Answer:

   Unrestricted File Upload; validate file types before upload -> Option D

4. Quick Check:

   File upload risk = Validate file types [OK]

Hint: File upload without checks? Think Unrestricted File Upload [OK]

Common Mistakes:

• Confusing file upload with access control
• Suggesting encryption instead of validation
• Mixing unrelated OWASP risks

5. A web app stores passwords in plain text and does not limit login attempts. Which two OWASP Top 10 risks does this violate, and what combined testing approach should be used?

hard

A. Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection

B. Security Misconfiguration and Cross-Site Scripting; test server setup and input fields

C. Insecure Deserialization and XML External Entities; test data parsing

D. Cross-Site Request Forgery and Broken Access Control; test session tokens and permissions

Solution

1. Step 1: Identify risks from password storage and login attempts

   Storing passwords in plain text is Sensitive Data Exposure; no login limits is Broken Authentication.

2. Step 2: Determine testing approach

   Test password storage security and brute force attack protections to cover both risks.

3. Final Answer:

   Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection -> Option A

4. Quick Check:

   Plain text + no limits = Sensitive Data + Broken Auth [OK]

Hint: Plain passwords + no limits = Sensitive Data + Broken Auth [OK]

Common Mistakes:

• Mixing unrelated OWASP risks
• Ignoring combined risks in one scenario
• Confusing testing focus areas