application-security-pentesting

name	application-security-pentesting
metadata	{"category":"Cybersecurity and Penetration Testing"}
description	Production Application Security (AppSec) standards, OWASP Top 10 vulnerability remediation, SAST/DAST pipeline integration, secure code review, threat modeling, and defensive security posture.
compatibility	OWASP ZAP, Burp Suite, Semgrep, SonarQube, Python / Node.js / Go

Application Security & Penetration Testing Remediation

Overview

This skill provides standards and methodological frameworks for Application Security (AppSec) engineering, threat modeling, vulnerability assessment, and remediation of OWASP Top 10 vulnerabilities. It covers secure code review, static and dynamic analysis (SAST/DAST) integration, security headers configuration, and defensive controls.

---

1. Core Application Security Principles

1. Defense-in-Depth Architecture: Never rely on a single defensive boundary. Enforce security controls at every application layer (Network, Gateway, Application Code, Database).
2. Strict Input Sanitization & Parameterization: Treat all user inputs as untrusted. Enforce parameterized queries (Prepared Statements) for database access to eliminate SQL injection, and context-aware HTML encoding to prevent XSS.
3. Principle of Least Privilege (PoLP): Grant minimum required API permissions, database permissions, and system rights to microservices and database users.
4. Secure Authentication & Session Lifecycle: Enforce multi-factor authentication (MFA), secure HTTP-Only SameSite cookies, session rotation on privilege escalation, and strong password hashing algorithms (Argon2id, bcrypt).
5. Continuous Security Automation (DevSecOps): Integrate Static Application Security Testing (SAST), Dependency Scanning (SCA), and Dynamic Application Security Testing (DAST) into CI/CD pipelines.

---

2. Threat Modeling & Vulnerability Remediation Lifecycle

[ Application Codebase ]
       │
       ├──▶ [ SAST Scanner (Semgrep / SonarQube) ] ──(Code Flaws)
       ├──▶ [ SCA Scanner (Trivy / Dependabot) ] ────(Vulnerable Dependencies)
       ▼
[ Security Audit Engine ]
       │
       │ 1. Triaging & Threat Modeling (STRIDE / DREAD)
       ▼
[ Security Remediation Pipeline ]
       │ 2. Apply Parameterization & Sanitization
       ▼
[ DAST Verification (OWASP ZAP) ] ──▶ [ Hardened Production Deployment ]

Vulnerability Class	Root Cause	Primary Defensive Remediation
SQL Injection (SQLi)	String concatenation in database queries	Parameterized Prepared Statements
Cross-Site Scripting (XSS)	Unescaped output rendered in HTML context	Content Security Policy (CSP) & DOM Encoding
Broken Access Control	Missing authorization checks on record IDs	Server-side RBAC / ABAC evaluation
CSRF	Cross-origin request forgery on cookie auth	Anti-CSRF Tokens & SameSite=Strict cookies
Insecure Direct Object Reference (IDOR)	Exposing raw database primary keys	Tenant-scoped database queries & UUIDs

---

3. Anti-Patterns & Common Vulnerabilities

• Anti-Pattern: String Concatenation in SQL Statements ("SELECT * FROM users WHERE email = '" + input + "'" )
  • Risk: High vulnerability to SQL Injection, leading to unauthorized database dump or remote code execution.
  • Remediation: Use ORMs or parameterized query placeholders (SELECT * FROM users WHERE email = $1).
• Anti-Pattern: Disabling TLS Certificate Validation (rejectUnauthorized: false or verify=False)
  • Risk: Vulnerable to Man-in-the-Middle (MitM) traffic interception and credential theft.
  • Remediation: Enforce strict CA certificate validation across all HTTP client stubs.
• Anti-Pattern: Storing Plaintext Passwords or Using Weak Hashes (MD5 / SHA1)
  • Risk: Instant offline dictionary credential crack on database breach.
  • Remediation: Hash credentials with Argon2id or bcrypt with appropriate cost factors.

---

4. Production Defensive Security Code Snippets

A. Python Secure Database Access & Input Parameterization (secure_db.py)

#!/usr/bin/env python3
"""
Production Secure Database Access Layer using Parameterized Queries & Argon2id Hashing
"""

import os
import psycopg2
from psycopg2.extras import RealDictCursor
from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

ph = PasswordHasher()

class SecureUserRepository:
    def __init__(self, db_url: str):
        self.db_url = db_url

    def get_connection(self):
        # Enforce SSL/TLS for database connections
        return psycopg2.connect(self.db_url, sslmode='verify-full', cursor_factory=RealDictCursor)

    def register_user(self, email: str, raw_password: str) -> dict:
        """
        Hashes password securely with Argon2id and inserts user via Parameterized Query.
        """
        password_hash = ph.hash(raw_password)

        query = """
            INSERT INTO users (email, password_hash, created_at)
            VALUES (%s, %s, NOW())
            RETURNING id, email, created_at;
        """
        with self.get_connection() as conn:
            with conn.cursor() as cursor:
                cursor.execute(query, (email, password_hash))
                user = cursor.fetchone()
                conn.commit()
                return dict(user)

     () -> :
        
        query = 
         .get_connection()  conn:
             conn.cursor()  cursor:
                cursor.execute(query, (email,))
                record = cursor.fetchone()
                  record:
                     

                :
                     ph.verify(record[], candidate_password)
                 VerifyMismatchError:
                     

---

B. Node.js Express Hardened Security Middleware (security_headers.js)

import express from 'express';
import helmet from 'helmet';
import rateLimit from 'express-rate-limit';

const app = express();

// 1. Apply Helmet to set robust HTTP Security Headers
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://trusted-cdn.com"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'"],
      fontSrc: ["'self'"],
      objectSrc: ["'none'"],
      upgradeInsecureRequests: [],
    },
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
}));

// 2. Enforce Strict Rate Limiting to prevent brute-force attacks
const apiLimiter = rateLimit({
  windowMs: 15 *  * , 
  : , 
  : ,
  : ,
  : { : , :  }
});

app.(, apiLimiter);


app.( {
  res.(, , {
    : , 
    : ,   
    : , 
    : 
  });
  ();
});

app.(,  res.({ :  }));

app.(,  .());