OWASP Top 10 awareness in Testing Fundamentals - Test Execution Trace

Test Overview

This test checks if the web application properly handles input validation to prevent Injection attacks, one of the OWASP Top 10 security risks. It verifies that malicious input is rejected and an error message is shown.

Test Code - Selenium with unittest

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest

class TestInjectionPrevention(unittest.TestCase):
    def setUp(self):
        self.driver = webdriver.Chrome()
        self.driver.get('https://example.com/login')

    def test_sql_injection_rejection(self):
        driver = self.driver
        # Wait for username field
        WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, 'username')))
        username_input = driver.find_element(By.ID, 'username')
        password_input = driver.find_element(By.ID, 'password')
        submit_button = driver.find_element(By.ID, 'submit')

        # Enter SQL injection attempt
        username_input.send_keys("' OR '1'='1'")
        password_input.send_keys('password')
        submit_button.click()

        # Wait for error message
        error_element = WebDriverWait(driver, 10).until(
            EC.presence_of_element_located((By.ID, 'error-message'))
        )

        # Verify error message text
        self.assertIn('Invalid username or password', error_element.text)

    def tearDown(self):
        self.driver.quit()

if __name__ == '__main__':
    unittest.main()

Execution Trace - 8 Steps

Step	Action	System State	Assertion	Result
1	Test starts and Chrome browser opens	Browser is open at https://example.com/login page with username and password fields visible	—	PASS
2	Wait until username input field is present	Username input field is visible and ready for input	Presence of element with ID 'username'	PASS
3	Find username, password input fields and submit button	All required input elements are located on the page	—	PASS
4	Enter SQL injection string "' OR '1'='1'" into username field and 'password' into password field	Input fields contain the test data	—	PASS
5	Click the submit button to attempt login	Form submitted, page processes input	—	PASS
6	Wait for error message element with ID 'error-message' to appear	Error message is displayed on the page	Presence of element with ID 'error-message'	PASS
7	Check that error message text contains 'Invalid username or password'	Error message text is visible and readable	Error message text includes expected rejection message	PASS
8	Test ends and browser closes	Browser is closed, test resources cleaned up	—	PASS

Failure Scenario

Failing Condition: The application does not reject the SQL injection input and allows login or shows no error message

Execution Trace Quiz - 3 Questions

What does the test verify after submitting the SQL injection input?

A That the user is logged in successfully

B That an error message saying 'Invalid username or password' appears

C That the page reloads without any message

D That the password field is cleared

Key Result

Always test for OWASP Top 10 risks like Injection by simulating malicious inputs and verifying the application properly rejects them with clear error messages.

Practice

1. What is the main purpose of the OWASP Top 10 list in software testing?

easy

A. To rank the fastest web browsers

B. To highlight the most common security risks in web applications

C. To provide a checklist for UI design improvements

D. To list all programming languages used in web development

Solution

1. Step 1: Understand OWASP Top 10's focus

   OWASP Top 10 is a list of the most common security risks in web apps.

2. Step 2: Match purpose with options

   Only To highlight the most common security risks in web applications correctly states it highlights common security risks.

3. Final Answer:

   To highlight the most common security risks in web applications -> Option B

4. Quick Check:

   OWASP Top 10 = Common security risks [OK]

Hint: OWASP = security risks list for web apps [OK]

Common Mistakes:

• Confusing OWASP with UI or browser topics
• Thinking it lists programming languages
• Assuming it ranks performance

2. Which of the following is a correct example of an OWASP Top 10 risk?

easy

A. Cross-Site Scripting (XSS)

B. Slow page loading

C. Incorrect font size

D. Missing alt text on images

Solution

1. Step 1: Identify OWASP Top 10 risks

   OWASP Top 10 includes risks like Cross-Site Scripting (XSS), SQL Injection, etc.

2. Step 2: Compare options to known risks

   Only Cross-Site Scripting (XSS) is a recognized OWASP Top 10 risk; others are unrelated to security risks.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option A

4. Quick Check:

   XSS is a common OWASP risk [OK]

Hint: Pick known security risks like XSS, SQLi, not UI issues [OK]

Common Mistakes:

• Choosing UI or performance issues as security risks
• Confusing accessibility issues with security risks
• Not recognizing common OWASP terms

3. Consider this code snippet for input validation in a web app:

if (userInput.includes('<script>')) {
  rejectInput();
} else {
  acceptInput();
}

Which OWASP risk is this code trying to prevent?

medium

A. Broken Authentication

B. Security Misconfiguration

C. Cross-Site Scripting (XSS)

D. Sensitive Data Exposure

Solution

1. Step 1: Analyze code purpose

   The code checks if user input contains '<script>' tags and rejects it.

2. Step 2: Link to OWASP risks

   Rejecting script tags prevents Cross-Site Scripting (XSS), where attackers inject scripts.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option C

4. Quick Check:

   Blocking scripts = Prevent XSS [OK]

Hint: Script tags in input? Think XSS risk [OK]

Common Mistakes:

• Confusing input validation with authentication issues
• Ignoring script injection as a security risk
• Choosing unrelated OWASP risks

4. A tester finds that a web app allows users to upload files without checking file type. Which OWASP risk does this represent, and what is the best fix?

medium

A. Cross-Site Request Forgery; use CSRF tokens

B. Insecure Deserialization; encrypt files

C. Broken Access Control; add user login

D. Unrestricted File Upload; validate file types before upload

Solution

1. Step 1: Identify the risk from file upload issue

   Allowing uploads without validation is Unrestricted File Upload risk.

2. Step 2: Determine best fix

   Validating file types before upload prevents malicious files from being accepted.

3. Final Answer:

   Unrestricted File Upload; validate file types before upload -> Option D

4. Quick Check:

   File upload risk = Validate file types [OK]

Hint: File upload without checks? Think Unrestricted File Upload [OK]

Common Mistakes:

• Confusing file upload with access control
• Suggesting encryption instead of validation
• Mixing unrelated OWASP risks

5. A web app stores passwords in plain text and does not limit login attempts. Which two OWASP Top 10 risks does this violate, and what combined testing approach should be used?

hard

A. Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection

B. Security Misconfiguration and Cross-Site Scripting; test server setup and input fields

C. Insecure Deserialization and XML External Entities; test data parsing

D. Cross-Site Request Forgery and Broken Access Control; test session tokens and permissions

Solution

1. Step 1: Identify risks from password storage and login attempts

   Storing passwords in plain text is Sensitive Data Exposure; no login limits is Broken Authentication.

2. Step 2: Determine testing approach

   Test password storage security and brute force attack protections to cover both risks.

3. Final Answer:

   Sensitive Data Exposure and Broken Authentication; test password storage and brute force protection -> Option A

4. Quick Check:

   Plain text + no limits = Sensitive Data + Broken Auth [OK]

Hint: Plain passwords + no limits = Sensitive Data + Broken Auth [OK]

Common Mistakes:

• Mixing unrelated OWASP risks
• Ignoring combined risks in one scenario
• Confusing testing focus areas