Security Testing

Security Testing identifies vulnerabilities and weaknesses in software. Its goal is to prevent attacks, protect data, and ensure the confidentiality, integrity, and availability of systems.

In a Nutshell

• Security Testing finds vulnerabilities.
• It encompasses SAST, DAST, SCA, Pentests, and manual reviews.
• OWASP Top 10 covers common vulnerability categories.
• Security tests should be integrated into your pipeline.

Types of Security Tests

SAST (Static Application Security Testing)

SAST analyzes source code without running the application. It searches for known patterns like SQL injection, weak cryptographic implementations, or hardcoded secrets. The advantage is early detection during development, before code even executes. SAST typically runs in your IDE or on every commit. The downside is false positives and an inability to catch runtime issues.

DAST (Dynamic Application Security Testing)

DAST tests a running application from an external perspective. It simulates attacks as an outside attacker would, examining HTTP requests, sessions, forms, and APIs. DAST finds misconfigurations and runtime problems that SAST can’t see. It’s often deployed against staging or test environments. The limitation is that it arrives late in the cycle and can’t pinpoint the exact line of code responsible.

SCA (Software Composition Analysis)

SCA examines bundled libraries, frameworks, and container images for known vulnerabilities. Modern software consists largely of third-party code, making SCA essential. It compares dependencies against databases like NVD or OSV. SCA runs on every pull request and can block critical CVEs. It protects against supply-chain attacks and outdated components.

Pentest (Penetration Testing)

A pentest is a targeted, simulated attack carried out by experienced security professionals. It combines automated tools with manual techniques and creative problem-solving. Pentests uncover complex vulnerabilities that automated scanners miss. They’re often performed before major releases or when compliance demands it. Pentests are time-intensive and costly, but they deliver realistic results.

Fuzzing

Fuzzing feeds your application unexpected, random, or malformed inputs. The goal is to trigger crashes, memory errors, or unexpected behavior. Fuzzing is common for network protocols, file parsers, and APIs. It can automatically discover vulnerabilities that would otherwise require targeted attack attempts.

Security Review

A security review is a manual examination of architecture, code, or processes by experienced developers or security experts. It complements automated testing by catching design flaws, logical gaps, and process weaknesses. Reviews are especially valuable for critical areas like authentication, authorization, or payment processing.

OWASP Top 10

1. Injection

Injection attacks occur when untrusted data is passed as a command or query to an interpreter. SQL injection is the most famous variant, but command injection, LDAP injection, and NoSQL injection are widespread. Defense relies on parameterized queries, input validation, and proper escaping. Injection has long been the most dangerous vulnerability in web applications.

2. Broken Authentication

Broken Authentication encompasses flaws in login, session management, and password recovery. Common examples include weak password policies, missing rate limiting, insecure session tokens, and absent multi-factor authentication. Attackers can hijack accounts or impersonate other users. Mitigation involves strong password policies, MFA, secure session handling, and brute-force protection.

3. Sensitive Data Exposure

This category covers insufficient protection of sensitive data such as passwords, credit card numbers, or health records. Data often travels unencrypted, is stored with weak hashing, or sits unprotected in cache. Defenses include TLS, strong encryption, secure hashing, and data minimization.

4. XML External Entities (XXE)

XXE attacks exploit insecure XML parsers that load external entities. Attackers can read files, perform server-side request forgery, or launch denial-of-service attacks. The best defense is disabling external DTDs and preferring simpler formats like JSON.

5. Broken Access Control

Broken Access Control happens when users can access actions or data they shouldn’t. Examples include direct object references, missing authorization checks, and manipulated URLs. Defense requires centralized, server-side access control that validates every request without trusting the client.

6. Security Misconfiguration

Security Misconfiguration is the most common vulnerability. It includes default credentials, unnecessary features, open ports, missing security headers, outdated software, and overly permissive CORS configurations. Regular hardening, automation, and checklists prevent these errors.

7. Cross-Site Scripting (XSS)

XSS allows injection of client-side script code into web pages. Reflected XSS, Stored XSS, and DOM-Based XSS are the three main types. Attackers can steal cookies, take over sessions, or launch phishing attacks. Defenses include output encoding, Content Security Policy, HttpOnly cookies, and input validation.

8. Insecure Deserialization

Insecure Deserialization occurs when untrusted data is deserialized. Attackers can manipulate objects to achieve remote code execution, privilege escalation, or data tampering. Mitigation involves secure data formats, signing serialized data, or avoiding deserialization of untrusted input.

9. Using Components with Known Vulnerabilities

Modern applications rely on dozens of libraries and frameworks. Outdated or vulnerable components are a common attack vector. SCA, regular updates, dependency management, and minimal dependencies reduce risk. This category closely overlaps with supply-chain security.

10. Insufficient Logging and Monitoring

Without proper logging and monitoring, attacks go undetected for long periods. Missing logs, weak alerts, or no incident response lets attackers operate freely. Essential practices include centralized logging, meaningful events, anomaly alerts, and regular review.

Key Tools

OWASP ZAP

OWASP ZAP is a free, open-source web application security scanner. It acts as a proxy between your browser and application, automating many common attacks. ZAP is ideal for DAST and frequently runs in staging or development environments. It’s a solid entry point for automated web security testing.

SonarQube

SonarQube is a platform for static code analysis. Beyond code quality, it provides security rules for SAST. It detects SQL injection, XSS, hardcoded secrets, and many other issues directly in your source code. SonarQube integrates well into CI/CD pipelines and supports a wide range of programming languages.

Snyk

Snyk specializes in SCA, container security, and Infrastructure-as-Code scanning. It identifies vulnerable dependencies, recommends updates, and can automatically create pull requests. Snyk is particularly useful in modern cloud-native projects that rely on numerous libraries and containers.

Burp Suite

Burp Suite is a professional penetration testing platform. It offers a proxy, scanner, repeater, intruder, and many other tools for manual and semi-automated testing. Burp Suite is the de facto standard for web penetration testers and enables in-depth analysis that automated tools cannot deliver.

Nmap

Nmap is a network scanner that discovers open ports, services, and operating systems. It’s commonly used in the reconnaissance phase of penetration tests. Nmap helps you understand a server’s attack surface and identify unnecessarily exposed services.

Additional Tools

• Trivy: Scanner for containers and repositories.
• Bandit: SAST for Python.
• Semgrep: Lightweight static analysis supporting many languages.
• Dependency-Check: OWASP tool for checking dependencies.

Practical Example

The following pipeline demonstrates how different security testing types can be meaningfully integrated into the software lifecycle. This example is chosen because modern security cannot rely on a single test: each type uncovers different vulnerabilities at different stages. The order is deliberate—early, fast tests run frequently while expensive, manual tests are reserved for important milestones.

Pipeline Integration:
1. SAST on every commit
2. SCA on every pull request
3. DAST against staging
4. Pentest before every major release
5. Security monitoring in production

Why this order?

• SAST on every commit: Early feedback, low cost, direct integration into the development workflow.
• SCA on every pull request: Dependencies change constantly, so every integration is checked.
• DAST against staging: The application must be running, so DAST applies only at the staging phase.
• Pentest before major releases: Manual and expensive, but essential for complex logical vulnerabilities.
• Security monitoring in production: Even after release, attacks and anomalies must be detected.

This combination follows the Shift Left principle: security issues are caught as early as possible and as late as necessary.

Benefits and Drawbacks

Benefits	Drawbacks
Early detection of vulnerabilities	False positives from automated tools
Reduction of security risks	Pentests are expensive and time-consuming
Fulfillment of compliance requirements	Security testing cannot replace secure design
Protection of data and users	Ongoing maintenance of rules required
Improved reputation and trust	Test environments must mirror production
Cost savings through early bug detection	Specialized expertise required

Key Takeaways for Exams

• Security Testing: Umbrella term for all tests that identify security gaps and vulnerabilities.
• SAST: Static analysis of source code early in the cycle; identifies code patterns without runtime execution.
• DAST: Dynamic analysis of running applications from an external perspective; finds configuration errors.
• SCA: Analysis of dependencies for known vulnerabilities and license risks.
• Pentest: Simulated attack by experts; uncovers complex logical vulnerabilities.
• Fuzzing: Testing with unexpected inputs to find crashes and weaknesses.
• Security Review: Manual examination of architecture, code, and processes.
• OWASP Top 10: The ten most critical web security risks, frequently tested in exams.
• Key Tools: OWASP ZAP, SonarQube, Snyk, Burp Suite, Nmap.
• Shift Left Security: Integrate security checks as early as possible in the pipeline.
• Defense in Depth: Multiple security layers instead of a single measure.
• Compliance: Security testing is often a prerequisite for standards and regulations.
• False Positives: Automated tools can produce false alarms requiring manual review.
• Supply Chain Security: Protection against vulnerable or malicious dependencies.

Key Sources

1. https://owasp.org/www-project-top-ten/
2. https://owasp.org/www-project-zap/
3. https://en.wikipedia.org/wiki/Security_testing

Continue Your Software Testing Learning Path

All Software Testing articles are now complete. Return to the first article: Software Testing Fundamentals: Unit, Integration, E2E Tests, TDD, BDD.