Safety threats noticed by QA Engineers – cybersecurity testing based mostly on TSH tasks

QA specialists are on the frontlines of cybersecurity. Now we have the chance to work in numerous branches of software program tasks, like community safety, internet, and cell purposes, API – you title it. In all places QA engineers discover themselves, they’ve a possibility to enhance their tasks and determine safety threats.  On this article, I’m going to point out you my strategy to a mission with cybersecurity testing necessities – and the way I handled them technically with the assistance of OWASP.

In the event you’re a QA doing vulnerability assessments and are coping with delicate information tasks, I hope to point out you one thing new that can assist you along with your mission. This is a vital side of QA work – as a result of high quality is about safety, and QAs who’re capable of talk with each builders and purchasers are in quickly rising demand. 

I see that issues are altering and builders are reporting a necessity for good QA engineers. Not simply people who find themselves going to “click-through” a mission and verify for small errors or do computerized safety testing, however be energetic contributors in product design and growth.

QA – the newly appreciated cybersecurity testing warriors

As a QA engineer at The Software program Home, I’ve had the chance to work with an enormous overseas company that implements options for his or her authorities. Authorities web sites, it doesn’t matter what nation they’re in, deal with an unbelievable quantity of delicate info and private information – this made me assume much more about end-user safety

And we’re not solely speaking concerning the US, Canada, or EU laws containing provisions on the safety of the move and processing of non-public information just like the Common Knowledge Safety Regulation (GDPR), which is the harshest legislation on the earth proper now. 

Misplaced in translation – the 1st step in safety is attending to know the consumer

When working with worldwide purchasers, it’s important to consider each the authorized facets and work tradition of elements of the world just like the Center East, Africa, Australia, or in our case, West Asia. 

As I discovered, you must undoubtedly begin by getting aware of your finish consumer’s work atmosphere and situations. What might sound irrelevant to us and is one thing that we are able to’t foresee as a result of we don’t even give it some thought may really be a delicate information leak hiding in plain sight. 

For instance, after speaking to the Product Proprietor and having a chat, I realized that a number of folks in numerous positions and with totally different safety entry might use the identical laptop station. 

This illustrates why a proactive strategy needs to be taken by the QA to get to know all the info – each onerous and tender. That’s important with a purpose to discover out about all of the threats that the entire staff may miss in any other case. 

What are you able to be taught from OWASP? 

My information about threats to internet purposes is predicated primarily on the rankings of the worldwide non-profit basis OWASP (The Open Net Software Safety Undertaking®). 

OWASP is a non-profit group based in 2001. They produce instruments, documentation, analysis, articles, and methodologies that every one need to do with internet utility safety. Additionally they manage conferences and workshops on business requirements. OWASP tasks are supported by the OWASP Basis. In the event you’re not aware of their work, you’re behind! 

OWASP’s analysis, carried out on the premise of danger evaluation lately, allowed for the presentation and specification of strategies. These had been the event of instruments, and remedial actions in reference to making certain the safety of IT programs. Additionally, the operation of enterprises implementing web purposes to enhance enterprise processes. 

Conducting case research, the OWASP group has been creating rankings of the commonest internet utility threats since 2003, known as OWASP Prime 10. The primary one was created in 2003 and, like every subsequent one, it contained the ten commonest threats. 

Updates ensuing from the altering habits of internet utility customers, in addition to the development of safety breach instruments, passed off in 2004, 2007, 2010, 2013, 2017, and 2021. 

It’s value analyzing the dynamics and tendencies of the final twenty years. It’s simple to note that new threats have been added, however the positions of these beforehand listed have additionally modified in subsequent rankings. Beneath is a desk I made containing all vulnerabilities from experiences ready over 18 years and the positions assigned to them within the rating (from A1 – the commonest to A10 – the least frequent).

Identify 2003 2004 2007 2010 2013 2017 2021
Invalid Parameters / Inputs A1 A1
Damaged Entry Management A2 A2 A5 A1
Damaged Authenticathion and Session Administration A3 A3 A7 A3 A2 A2
Cross Website Scripting <XSS, CSS> A4 A4 A1 A2 A3 A7
Buffer Overflow A5 A5
Injection A6 A6 A2 A1 A1 A1 A3
Error Dealing with Issues A7
Insecure Use of Cryptography A8
Distant Administration Flaws A9
Net and Software Server Misconfiguration A10
Improper Error Dealing with A7
Insecure Storage A8
Software Denial of Service A9
Insecure Configuration Administration A10
Malicious File Execution A3
Insecure Direct Object Reference A4 A4 A4
Cross Website Request Forgery <CSRF, XSRF> A5 A5 A8
Data Leakage and Improper Error Dealing with A6
Insecure Cryptographic Storage A8
Insecure Communications A9 A9
Failure to Prohibit URL Entry A10 A8
Safety Misconfiguration A6 A5 A6 A5
Insecure Direct Object References A7
Unvalidated Redirects and Forwards A10 A10
Delicate Knowledge Publicity A6 A3
Lacking Operate Stage Entry Management A7
Utilizing Parts with Recognized Vulnerabilities A8 A9
XML Exterior Entities A4
Insecure Deserialization A8
Inadequate Logging & Monitoring A10
Cryptographic Failures A2
Insecure Design A4
Weak and Outdated Parts A6
Identification and Authentication Failures A7
Software program and Knowledge Integrity Failures A8
Safety Logging and Monitoring Failures A9
Server-Aspect Request Forgery SSRF A10

Personal research based mostly on A. Sołtysik-Piorunkiewicz, M. Krysiak, “The Cyber Threats Evaluation for Net Purposes Safety in Trade 4.0, Springer 10.1007 / 978-3-030-40417-8_8, 2020, p. 134

It’s also value being attentive to the 7 most steadily recurring internet utility threats (occurring 3 or extra instances). 

You’ll discover that Injections are listed in every of the rankings. The following ones on the checklist are

  • Damaged Authentication,
  • Session Administration, 
  • and Cross-Website Scripting (XSS, CSS)

which seem in experiences from 2003-2017. 

Different widespread threats are Safety Misconfiguration (famous between 2010-2021) and Damaged Entry Management (which had been famous in 2003 and 2004 to be returned in 2017 and 2021 experiences), and Insecure Direct Object Reference and Cross-Website Request Forgery (CSRF, XSRF), as proven within the determine beneath.

Original research on OWASP

Personal analysis,  A. Sołtysik-Piorunkieicz, M. Krysiak, “Up to date threats to Web utility safety within the gentle of OWASP analysis”, Wydawnictwo Politechniki Częstochowskiej, 2022, p. 267

Along with my colleague Adam Gola we attempt to create an evaluation of modifications to grasp the newest tendencies and threats, each time the OWASP Prime 10 rankings are up to date. 

After all, I like to recommend his article: on the Prime 10 Vulnerabilities on the variations within the newest experiences (2017 and 2021). It’s value commenting on the shortage of compliance within the title of the report. 

Adam used 2020 within the title as a result of the primary model of OWASP Prime 10 was launched on the finish of 2020, however the last model was out there in early 2021. Try The OWASP 2021 research. An image of the newest modifications is on the display screen beneath.

The 2022 OWASP Prime 10 report gained’t be out there till late 2022 or early in 2023.

comparison ow owasp 2017 and owasp 2021 research

However sufficient of idea! Let’s see some actual work and easily present how to make sure high quality based mostly on a few of the issues talked about within the OWASP Prime 10 2021. 

After all, all of the examples are based mostly on my present mission, subsequently not all standards might be examined and described. One standards is a  A10 Server Aspect Request Forgery (SSRF), which may be simply examined. You want a part that may be a discipline to which the person is to supply the URL to an exterior useful resource, in order that the applying will obtain and show the output.

Simply attempt to enter the deal with resulting in a file on the native disk, utilizing e.g. file: /// and many others / passwd, which clearly signifies that the applying means that you can obtain any information from the disk. 

Because of this on this article I centered on:

  • A1 Damaged Entry Contol, 
  • A3 Injection, 
  • A4 Insecure Design, 
  • A7 Identification and 
  • Authentication Failures, and 
  • A9 Safety Logging and Monitoring Failures.

1. OWASP Prime 10: 2021 A1 Damaged Entry Contol

Following the “OWASP Prime 10: 2021” rating, Damaged Entry Contol is the commonest risk. 

This vulnerability permits for unauthorized entry to information, e.g. by manipulating parameters within the URL deal with. For instance, having a request with id = 10, the person will change the worth from 10 to 11 within the URL deal with and the applying information with the quantity id = 11

This makes any person capable of entry your info. It is a pretty easy factor to identify, and intensely essential from a safety viewpoint. Many individuals are knowledgable sufficient that as a substitute of clicking on the hyperlink in an utility, they substitute ID values ​​in URLs and, by inadvertent (and generally even deliberate) motion, might acquire unauthorized entry to information.

A really comparable case is logging from person A’s account after which logging into person B’s account. I occurred to be on the tab with my firm particulars, logged out, and logged into one other person to carry out one other take a look at. 

At this level, it turned out that the URL is just not cleared after logging out and the brand new person was capable of see person A’s firm information. 

The preliminary repair was to load the web page with clean fields (all values ​​had been changed with “-“), however in my view, it’s not the perfect methodology as person B noticed person A’s firm quantity within the URL. One other repair was cleansing the URL in order that the subsequent person wouldn’t be capable to see any information from the earlier person. Because of this, every logged-in person instantly after logging in goes to the service’s Dashboard.

I had the same scenario after I switched from a person with larger privileges to a person with decrease privileges. 

A person with larger privileges might view all purposes (submitted by different customers) and edit them. I previewed the X utility and logged right into a low-privilege person. It turned out that I might see the main points of X’s request. 

I regarded on the checklist of requests submitted by this person and it turned out that he had by no means submitted one. That is one other unacceptable scenario the place a given person has an opportunity to see one other person’s delicate information (with out even interfering with the URL). 

And identical to within the earlier state of affairs, for unauthorized customers, the builders first modified the values ​​into “-“, and solely within the subsequent patch they cleaned the whole URL deal with in order that it was not even doable to suspect the applying quantity. 

This case is essential as a result of the consumer confirmed that there are corporations in which there’s just one laptop and it’s utilized by totally different staff (with totally different ranges of authorization).

2. OWASP Prime 10: 2021 A3 Injection

Third on the OWASP Prime 10 checklist is Injection. It’s a class centered on numerous kinds of injections, resembling SQL injection, PHP Injection, and many others. 

Since final 12 months, it has been mixed with the Cross-Website Scripting (XSS) class, which was distinctive till 2017.

Cross-Website Scripting (XSS) assaults by themselves may be divided into three classes:

  • Mirrored XSS, 
  • Saved <Persistant> XSS,
  • and DOM-based XSS.

I’m going to concentrate on the primary two for testing. Every of them may be examined in a reasonably easy method:

  • Mirrored XSS – happens when a part of the HTTP request is mirrored within the output (e.g. when sending a hyperlink). Out of curiosity, I attempted to parse a URL request from: https://establishment-location-management-api.qiwa.information/api/laborer?perPage=100&web page=1to: https://establishment-location-management-api.qiwa.information/api/laborer?perPage=<script>alert(XSS)</script>
  • To show a pop-up window with the textual content “XSS” (this is among the flagship methods to detect this vulnerability). After all, the safety on the web site mechanically modified the request to:https://establishment-location-management-api.qiwa.information/api/laborer?perPage=10&web page=NaN

Checking in DevTools, the GET methodology received the standing 422 – Unprocessable entity, because it anticipated to obtain an integer worth, not a string. The web page then reloaded the proper information.

3 a reflected xss

3 b reflected XSS

3c reflected XSS

  • Saved (Persistent) XSS – happens when the XSS code is saved within the database, e.g. as a weblog remark. Equally to the primary case, I needed to make use of the <script> alert (XSS) </script> phrase when including an outline to the shape I’m filling out.

4 a stored XSSThis fashion, I realized that the React framework makes positive that characters are encoded, and the applying doesn’t ship requests containing “malicious” code, however solely reads it as a remark.

4b stored xss screenshot

  • It’s equally essential to verify if there is no such thing as a chance of injections throughout logging (eg SQL Injection). This vulnerability might result in unauthorized entry to the database, ensuing within the studying of knowledge, i.e. logins and passwords, bypassing the authentication mechanism, code execution, and many others.
  • Flagship examples are variations on the straightforward SQL question language code:
  1. utilizing the next code within the password discipline: ‘OR’ 1 ‘=’ 1, which theoretically means that you can log into the system with out a password, because the situation (1 = 1) is at all times met.


5 a SQLi

  1. utilizing the code within the login discipline: admin ‘) – which theoretically means that you can log in because the admin person, as a result of “-” is the start of the remark, so the password won’t be checked within the database.

5 b SQLi

After all, that’s not the case after the primary try and with precisely such a fraction of the code, we will discover an SQLi vulnerability

To start with, the administrator’s title doesn’t need to be admin, however administrator, or it should be a collection of numbers or a very totally different title. It’s value making an attempt totally different variations, and the examples proven above are meant to current the approach in order that it will be comprehensible even for an individual who doesn’t write SQL scripts.

To start with, the administrator’s title doesn’t need to be admin, however administrator, or it should be a collection of numbers or a very totally different title. It’s value making an attempt totally different variations, and the examples proven above are meant to current the approach in order that it will be comprehensible even for an individual who doesn’t write SQL scripts.

3. OWASP Prime 10:2021 A4 Insecure Design

The A4 Insecure Design class is the debut of the present report. It’s a broad class that focuses on the dangers related to the design and architectural flaws. It’s presupposed to make you conscious of doable dangers within the mission on the design stage and doesn’t confer with the implementation itself.

An instance can be the file add operate. A very powerful factor is to verify that solely information with the allowed extension can really be added. For instance, when deciding on information, the person ought to solely be capable to choose these with a selected extension (on this case .png, .jpeg, .jpg, and .pdf), the remaining shouldn’t be doable so as to add.

After all, the person can manually change the file explorer to permit including any file extension (simply within the format choice, set the worth to “All Recordsdata”).

6 b insecure design
A superb apply is that regardless of including a forbidden file, it doesn’t save anyplace (in our mission on the UI facet, it appears to be like as if the person didn’t choose any file). Because of this, it’s not doable to add a malicious .exe file, and many others.

6 a insecure design

After all, it occurs {that a} file, though it has a very good extension (e.g. .png), is definitely an .exe file. Such information may be procured by opening the file, e.g. in a pocket book, and altering it to a forbidden extension.

6 c insecure design


That is what an try at opening the file in Paint appears to be like like:

Paint cannot read this file

On macOS, at first look, the file’s icon doesn’t elevate any doubts, however after making an attempt to open it, we’ll get the data that it might be a broken or unseen file.

Frame 144.png could not be opened

Curiously, Slack instantly acknowledges that it’s not a picture and signifies that it’s a binary.

Slack message recognizing binary

After making an attempt to add such a file, our utility shows a message about an unlawful extension, and the file itself is just not saved anyplace.
6 g insecure design

4. OWASP Prime 10:2021 A7 Identification and Authentication Failures

One other vulnerability is A7 Identification and Authentication Failures, in regards to the login and error dealing with facets of the applying.

It’s recognized that logging in to your utility is a key component of many flows, so we are able to simply confirm {that a} CAPTCHA won’t seem after getting into an incorrect login or password a number of instances. It is a nice safety methodology from a buyer’s viewpoint, nevertheless it’s not good both.

7 indent authorization failures

After all, a greater methodology of securing towards a brute pressure assault is to implement throttling, which limits the frequency of accepted connections. Checking it manually, sadly, is just not an choice, as a result of sending, for instance, 2 requests in 1 second is inconceivable to carry out. You’ll be able to attempt to do it by sending requests from the API, however on this article, I centered on the facets of handbook testing.

As well as, it is crucial that after getting into a incorrect password, the person doesn’t obtain a message that they entered it incorrectly, as a result of, for an unauthorized particular person, will probably be a transparent sign that such a person already exists within the database. The attacker will now be capable to concentrate on this specific login. 

The identical goes for restoring passwords. A greater message is to point that the password or login is inaccurate, thus the attacker is just not positive of any of the values.

When restoring the password, it’s value checking whether or not the person has been logged out of all periods (as a failure to take action might trigger an unauthorized particular person related to one of many periods to make the same transfer and substitute the password with one other one). Further safety could also be a message that an e-mail with a password change has been despatched. If such an e-mail deal with doesn’t exist within the database, the reset e-mail won’t ever be despatched.

One other downside with resetting passwords and creating accounts is imposing on the person the situations that the password should meet, i.e.

  • higher case letters, 
  • decrease case letters, 
  • numbers, and 
  • particular characters.

7 b reset password

This normal is presently being deserted. After all, the person ought to have a password longer than 1 character (a minimal of 12 and a most of 127 characters is an efficient apply). Current analysis reveals that utilizing a passphrase, not essentially with particular characters, is way safer than utilizing one or two phrases with a number of particular characters and numbers (eg Adm! N1). It’s also a very good apply to permit for the usage of areas, emoticons, and diacritics in a password. Specialists additionally extremely suggest the usage of password managers.

5. OWASP Prime 10: 2021 A9 Safety Logging and Monitoring Failures

The final one I’ve for you is A9 Safety Logging and Monitoring Failures, which considerations information saved in logs and error dealing with.

I truthfully admit that this risk is just not verifiable by each QA. This isn’t because of an absence of our expertise, however because of an absence of entry to logs. In my present mission, virtually every of us has the chance to see logs, so it’s value being attentive to what information is saved there. Generally the applying doesn’t log delicate information outlined in accordance with native laws or privateness coverage, delicate information, together with session IDs, passwords, hash strings, or API tokens.

And above all, whether or not the applying returns error messages that comprise delicate information may help attackers. This contains session IDs, software program/platform variations, and private info. Within the case of error messages from our purposes, there is no such thing as a query of displaying redundant information. We attempt to deal with all errors in every of the web sites in the same method.

8 a logging and monitoring

After all, we’re not saints; not each case has been predicted and designed a lot upfront. Every time we attempt to keep the usual to point out the person as little technical particulars as doable, as within the image beneath.

logging and monitoring OWASP example

It’s also value remembering that when displaying an error, when “one thing goes incorrect”, the person has the choice to return to the earlier step or reload the web page.

8 c logging and monitoring error user

It isn’t strictly associated to security, however to good practices and making certain the standard of our product!

Keep in mind that we QA should not solely liable for the looks and clicking by means of the exams. It’s way more critical than that. High quality assurance ought to be essential to us, not solely by means of seamlessly crossing the road to UX and efficiency but in addition by means of internet safety facets.

There are totally different requirements on the Web, relying on the consumer’s location. I attempt to concentrate on the outcomes of the OWASP group and their OWASP Prime 10 Net Software Safety Dangers experiences on internet purposes. It’s essential that you just too keep knowledgeable concerning the modifications. Think about watching any upcoming OWASP world occasions – get into it!

It’s value mentioning that in 2016 a report was developed: 

OWASP Cellular Prime 10, which may be discovered right here: 

And 2019 for API safety: 

OWASP API Safety Undertaking, which may be discovered right here:

The group itself has many instruments, not just for pentesters, but in addition for QAs, builders, and designers to create probably the most safe purposes doable. I hope that with this text, I inspired you to concentrate to safety of their mission, and my examples will show to be worthwhile ideas!

Sort out your mission from each security angle!

We love our QA, and we hope you’ll too!


Leave a Reply

    Your Cart
    Your cart is emptyReturn to Shop