Skip to content

README.md

Latest commit

 

History

History
134 lines (95 loc) · 2.85 KB

README.md

File metadata and controls

134 lines (95 loc) · 2.85 KB
Raw

Security Testing Suite

Comprehensive security testing suite for the Scavenger platform using OWASP ZAP and custom security tests.

Overview

This directory contains security tests covering:

  • SQL Injection vulnerabilities
  • XSS (Cross-Site Scripting) vulnerabilities
  • CSRF (Cross-Site Request Forgery) vulnerabilities
  • Authentication/Authorization flaws
  • Rate limiting enforcement
  • API security
  • Input validation

Setup

Base environment setup (Node.js, Docker, running services) is in the canonical guide:

➡️ Developer Onboarding Guide

Additional tools for this suite only:

  • OWASP ZAP — optional, for automated scanning
  • curl or Postman — for manual API probing
npm install

Running Tests

Unit Security Tests

npm test

Integration Security Tests

npm run test:integration

Full Security Suite

npm run test:security

Test Coverage

1. SQL Injection Tests (3 tests)

  • Test parameterized queries
  • Test input sanitization
  • Test prepared statements

2. XSS Vulnerability Tests (3 tests)

  • Test HTML encoding
  • Test JavaScript context escaping
  • Test attribute encoding

3. CSRF Protection Tests (2 tests)

  • Test CSRF token validation
  • Test SameSite cookie attributes

4. Authentication/Authorization Tests (4 tests)

  • Test JWT token validation
  • Test role-based access control
  • Test session management
  • Test password policies

5. Rate Limiting Tests (3 tests)

  • Test request rate limits
  • Test IP-based throttling
  • Test user-based throttling

6. API Security Tests (3 tests)

  • Test HTTPS enforcement
  • Test API key validation
  • Test CORS policies

7. Input Validation Tests (2 tests)

  • Test boundary conditions
  • Test malformed input handling

OWASP ZAP Integration

Automated Scanning

npm run scan:zap

This runs OWASP ZAP in headless mode against the application.

Manual Testing

  1. Start OWASP ZAP
  2. Configure proxy to localhost:8080
  3. Navigate through the application
  4. Run active scan
  5. Review findings

Security Test Results

Test results are generated in:

  • ./reports/security-tests.json - Detailed test results
  • ./reports/zap-report.html - OWASP ZAP scan report
  • ./reports/coverage.json - Security coverage metrics

CI/CD Integration

Security tests run automatically on:

  • Pull requests
  • Commits to main branch
  • Scheduled daily scans

See .github/workflows/security.yml for CI configuration.

Remediation

For each security finding:

  1. Document the vulnerability
  2. Implement fix
  3. Add regression test
  4. Verify fix with security test
  5. Update documentation

References