Skip to main content Home Creators pramoddutta qaskills owasp-security-testing
owasp-security-testing Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication, and authorization testing.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/PramodDutta/qaskills --skill owasp-security-testingThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Use when publishing SEO blog articles to qaskills.sh, e.g. "publish today's articles", "daily SEO batch", "write 10 articles from keyword research", "add a blog post", or any request that creates files under packages/web/src/app/blog/posts.
secure-test-data-engineer Generate test data from the schemas you already have. Read OpenAPI, JSON Schema, SQL DDL, or TypeScript models and produce deterministic factories, boundary and negative cases, relational datasets with valid foreign keys, cleanup scripts, and PII-safe synthetic data. Production records never leave the machine.
Analyze a git diff, map affected risks, select the tests that matter, detect coverage gaps on changed lines, run configurable quality gates, and produce a go/no-go release report with cited evidence. Recommends only; never merges or deploys.
Related occupations SOC
Based on SOC occupation classification
name OWASP Security Testing description Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication, and authorization testing. version 1.0.0 author thetestingacademy license MIT tags ["owasp","security","zap","penetration-testing","vulnerability","web-security"] testingTypes ["security"] frameworks [] languages ["typescript","python"] domains ["web","api"] agents ["claude-code","cursor","github-copilot","windsurf","codex","aider","continue","cline","zed","bolt"]
OWASP Security Testing Skill
You are an expert security tester specializing in OWASP methodologies and web application security. When the user asks you to write, review, or plan security tests, follow these detailed instructions.
Core Principles
Defense in depth -- Test every layer: input validation, authentication, authorization, encryption.OWASP Top 10 coverage -- Systematically verify protection against the most common vulnerabilities.Automated + manual -- Automated scans catch low-hanging fruit; manual testing catches logic flaws.Least privilege -- Test that every endpoint enforces minimum required permissions.Secure defaults -- Verify that default configurations are secure out of the box.
OWASP Top 10 (2021) Testing Checklist
A01: Broken Access Control
Test that users cannot access resources or perform actions beyond their permissions.
import { test, expect } from '@playwright/test' ;
test.describe ('Access Control Tests' , () => {
test ('regular user cannot access admin endpoints' , async ({ request }) => {
const loginRes = await request.post ('/api/auth/login' , {
data : { email : 'user@example.com' , password : 'UserPass123!' },
});
const { token } = await loginRes.json ();
const adminRes = await request.get ('/api/admin/users' , {
headers : { Authorization : `Bearer ${token} `
expect
status
toBe
403
test
'user cannot access other users data via IDOR'
async
const
await
post
'/api/auth/login'
data
email
'user1@example.com'
password
'UserPass123!'
const
await
json
const
await
get
'/api/users/other-user-id'
headers
Authorization
`Bearer ${token} `
expect
status
toBe
403
test
'user cannot elevate privileges via API'
async
const
await
post
'/api/auth/login'
data
email
'user@example.com'
password
'UserPass123!'
const
await
json
const
await
patch
'/api/users/me'
headers
Authorization
`Bearer ${token} `
data
role
'admin'
if
status
200
const
await
json
expect
role
not
toBe
'admin'
test
'cannot bypass authorization by manipulating request path'
async
const
'/api/admin/users'
'/api/Admin/users'
'/api/ADMIN/users'
'/api/admin/./users'
'/api/admin/../admin/users'
'/api/admin%2Fusers'
for
const
of
const
await
get
expect
status
not
toBe
200
A02: Cryptographic Failures test.describe ('Cryptographic Tests' , () => {
test ('API uses HTTPS only' , async ({ request }) => {
const response = await request.get ('/' , {
headers : { Accept : 'text/html' },
});
const url = response.url ();
expect (url).toMatch (/^https:\/\// );
});
test ('sensitive data is not in URL parameters' , async ({ page }) => {
await page.goto ('/login' );
await page.getByLabel ('Email' ).fill ('user@example.com' );
await page.getByLabel ('Password' ).fill ('SecurePass123!' );
await page.getByRole ('button' , { name : 'Sign in' }).click ();
const url = page.url ();
expect (url).not .toContain ('password' );
expect (url).not .toContain ('SecurePass123' );
});
test ('passwords are not returned in API responses' , async ({ request }) => {
const loginRes = await request.post ('/api/auth/login' , {
data : { email : 'user@example.com' , password : 'UserPass123!' },
});
const body = await loginRes.json ();
const bodyStr = JSON .stringify (body);
expect (bodyStr).not .toContain ('UserPass123!' );
expect (body.user ?.password ).toBeUndefined ();
expect (body.user ?.passwordHash ).toBeUndefined ();
});
test ('cookies have Secure flag' , async ({ page }) => {
await page.goto ('/' );
const cookies = await page.context ().cookies ();
for (const cookie of cookies) {
if (cookie.name .includes ('session' ) || cookie.name .includes ('token' )) {
expect (cookie.secure ).toBe (true );
}
}
});
});
A03: Injection test.describe ('Injection Tests' , () => {
const sqlInjectionPayloads = [
"' OR '1'='1" ,
"'; DROP TABLE users; --" ,
"1' UNION SELECT null, username, password FROM users --" ,
"admin'--" ,
"1; UPDATE users SET role='admin' WHERE email='attacker@evil.com'" ,
];
const xssPayloads = [
'<script>alert("XSS")</script>' ,
'<img src=x onerror=alert("XSS")>' ,
'"><script>alert("XSS")</script>' ,
"javascript:alert('XSS')" ,
'<svg onload=alert("XSS")>' ,
'{{constructor.constructor("return this")()}}' ,
];
for (const payload of sqlInjectionPayloads) {
test (`SQL injection: ${payload.substring(0 , 30 )} ...` , async ({ request }) => {
const response = await request.get ('/api/users/search' , {
params : { q : payload },
});
expect (response.status ()).not .toBe (500 );
const body = await response.text ();
expect (body).not .toContain ('SQL syntax' );
expect (body).not .toContain ('mysql_' );
expect (body).not .toContain ('ORA-' );
expect (body).not .toContain ('PostgreSQL' );
});
}
for (const payload of xssPayloads) {
test (`XSS: ${payload.substring(0 , 30 )} ...` , async ({ request }) => {
await request.post ('/api/comments' , {
data : { content : payload, postId : 'test-post' },
});
const response = await request.get ('/api/comments?postId=test-post' );
const body = await response.text ();
expect (body).not .toContain ('<script>' );
expect (body).not .toContain ('onerror=' );
expect (body).not .toContain ('javascript:' );
});
}
test ('NoSQL injection protection' , async ({ request }) => {
const response = await request.post ('/api/auth/login' , {
data : {
email : { $gt : '' },
password : { $gt : '' },
},
});
expect (response.status ()).not .toBe (200 );
});
test ('Command injection protection' , async ({ request }) => {
const payloads = [
'; ls -la' ,
'| cat /etc/passwd' ,
'`whoami`' ,
'$(cat /etc/passwd)' ,
];
for (const payload of payloads) {
const response = await request.get ('/api/ping' , {
params : { host : `example.com${payload} ` },
});
const body = await response.text ();
expect (body).not .toContain ('root:' );
expect (body).not .toContain ('/bin/bash' );
}
});
});
A04: Insecure Design test.describe ('Insecure Design Tests' , () => {
test ('rate limiting on login endpoint' , async ({ request }) => {
const attempts = [];
for (let i = 0 ; i < 20 ; i++) {
attempts.push (
request.post ('/api/auth/login' , {
data : { email : 'user@example.com' , password : `wrong${i} ` },
})
);
}
const responses = await Promise .all (attempts);
const rateLimited = responses.some ((r ) => r.status () === 429 );
expect (rateLimited).toBe (true );
});
test ('account lockout after failed attempts' , async ({ request }) => {
for (let i = 0 ; i < 10 ; i++) {
await request.post ('/api/auth/login' , {
data : { email : 'locktest@example.com' , password : `wrong${i} ` },
});
}
const response = await request.post ('/api/auth/login' , {
data : { email : 'locktest@example.com' , password : 'CorrectPass123!' },
});
expect (response.status ()).toBe (423 );
});
});
A05: Security Misconfiguration test.describe ('Security Headers' , () => {
test ('should have required security headers' , async ({ request }) => {
const response = await request.get ('/' );
const headers = response.headers ();
expect (headers['content-security-policy' ]).toBeDefined ();
expect (headers['x-content-type-options' ]).toBe ('nosniff' );
expect (headers['x-frame-options' ]).toMatch (/DENY|SAMEORIGIN/ );
expect (headers['strict-transport-security' ]).toBeDefined ();
expect (headers['strict-transport-security' ]).toContain ('max-age=' );
expect (headers['referrer-policy' ]).toBeDefined ();
expect (headers['permissions-policy' ]).toBeDefined ();
});
test ('should not expose server information' , async ({ request }) => {
const response = await request.get ('/' );
const headers = response.headers ();
expect (headers['server' ]).not .toContain ('Apache' );
expect (headers['server' ]).not .toContain ('nginx' );
expect (headers['x-powered-by' ]).toBeUndefined ();
expect (headers['x-aspnet-version' ]).toBeUndefined ();
});
test ('CORS should be restrictive' , async ({ request }) => {
const response = await request.get ('/api/users' , {
headers : { Origin : 'https://evil.com' },
});
const corsHeader = response.headers ()['access-control-allow-origin' ];
expect (corsHeader).not .toBe ('*' );
if (corsHeader) {
expect (corsHeader).not .toContain ('evil.com' );
}
});
test ('directory listing is disabled' , async ({ request }) => {
const response = await request.get ('/static/' );
const body = await response.text ();
expect (body).not .toContain ('Index of' );
expect (body).not .toContain ('Directory listing' );
});
test ('debug endpoints are not exposed' , async ({ request }) => {
const debugPaths = [
'/debug' ,
'/actuator' ,
'/actuator/env' ,
'/_debug' ,
'/api/debug' ,
'/phpinfo.php' ,
'/.env' ,
'/wp-admin' ,
'/graphql' ,
];
for (const path of debugPaths) {
const response = await request.get (path);
expect ([401 , 403 , 404 ]).toContain (response.status ());
}
});
});
ZAP Integration with Python import subprocess
import json
import time
from zapv2 import ZAPv2
class ZapSecurityScanner :
def __init__ (self, target_url: str , zap_api_key: str = '' ):
self .target = target_url
self .zap = ZAPv2(apikey=zap_api_key, proxies={
'http' : 'http://127.0.0.1:8080' ,
'https' : 'http://127.0.0.1:8080' ,
})
def spider_scan (self, max_duration: int = 60 ):
"""Crawl the application to discover endpoints."""
scan_id = self .zap.spider.scan(self .target)
timeout = time.time() + max_duration
while int (self .zap.spider.status(scan_id)) < 100 :
if time.time() > timeout:
self .zap.spider.stop(scan_id)
break
time.sleep(2 )
return self .zap.spider.results(scan_id)
def active_scan (self, max_duration: int = 300 ):
"""Run active security scan."""
scan_id = self .zap.ascan.scan(self .target)
timeout = time.time() + max_duration
while int (self .zap.ascan.status(scan_id)) < 100 :
if time.time() > timeout:
self .zap.ascan.stop(scan_id)
break
time.sleep(5 )
return scan_id
def get_alerts (self, risk_level: str = 'High' ):
"""Get security alerts filtered by risk level."""
alerts = self .zap.core.alerts()
risk_map = {'Informational' : 0 , 'Low' : 1 , 'Medium' : 2 , 'High' : 3 }
min_risk = risk_map.get(risk_level, 0 )
return [
a for a in alerts
if risk_map.get(a['risk' ], 0 ) >= min_risk
]
def generate_report (self, output_path: str = 'security-report.html' ):
"""Generate HTML security report."""
report = self .zap.core.htmlreport()
with open (output_path, 'w' ) as f:
f.write(report)
return output_path
Security Test Data Patterns
Common Attack Payloads export const SECURITY_PAYLOADS = {
sqlInjection : [
"' OR '1'='1" ,
"1' UNION SELECT null--" ,
"'; EXEC xp_cmdshell('dir')--" ,
"1' AND SLEEP(5)--" ,
],
xss : [
'<script>alert(1)</script>' ,
'<img src=x onerror=alert(1)>' ,
'"><svg/onload=alert(1)>' ,
"'-alert(1)-'" ,
],
pathTraversal : [
'../../../etc/passwd' ,
'..\\..\\..\\windows\\system32\\config\\sam' ,
'....//....//etc/passwd' ,
'%2e%2e%2f%2e%2e%2fetc%2fpasswd' ,
],
headerInjection : [
'value\r\nInjected-Header: malicious' ,
'value%0d%0aInjected: header' ,
],
xxe : [
'<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' ,
],
};
Best Practices
Test in isolated environments -- Never run security tests against production.Get written authorization -- Always have explicit permission before security testing.Start with passive scanning -- Spider and passive scan before active scanning.Test all input vectors -- Headers, query params, body, cookies, file uploads.Verify fixes -- After remediation, re-test to confirm the vulnerability is resolved.Document everything -- Record steps to reproduce every finding.Classify severity -- Use CVSS or a similar framework for consistent risk rating.Test authentication flows -- Password reset, session management, MFA bypass.Check error handling -- Error messages should not leak stack traces or internal info.Automate regression -- Add security tests to CI/CD to prevent regressions.
Anti-Patterns to Avoid
Testing only the happy path -- Security bugs live in edge cases.Skipping authorization tests -- Access control bugs are the #1 OWASP risk.Only using automated scanners -- Scanners miss business logic vulnerabilities.Testing in production -- Active scanning can cause outages or data corruption.Ignoring client-side security -- CSP, CORS, and cookie flags matter.Assuming HTTPS is enough -- Encryption does not prevent injection or access control flaws.Not testing file uploads -- Uploaded files can contain malware or be used for path traversal.Trusting client-side validation -- All validation must also occur server-side.Not testing rate limiting -- Brute force and credential stuffing are common attacks.Reporting without proof -- Always include evidence and reproduction steps. 