Plants vs thieves: Automated Tests in the World of Web Security

Web security is crucial in a constantly evolving environment where potential threats are always present. To better understand this concept, we can imagine our web application as a garden or a home that needs to be protected from possible attacks. We can draw parallels with the popular game "Plants vs. Zombies," which aims to safeguard your garden from intruders.

Our automated tests function as diligent guardians whose primary objective is to identify and address potential vulnerabilities, much like the diverse plant arsenal in the game. Instead of framing the security process as a never-ending fight, we will explore how automated tests act as defenders against possible issues, whether they are zombies or intruders. Next to an overview of tools you can utilize, we emphasize the importance of fundamental testing types, such as unit or end-to-end tests, in securing your digital garden.

Join this session to understand how to create a secure environment for your web application through test automation. This approach ensures that your web applications can successfully navigate the challenges posed by cyber threats without the necessity of introducing entirely new dedicated tools.

Transcript

1. Automated Tests in the World of Web Security
4. What does that have to do with web development?
10. Garden
11. Garden House = Protected parts
12. Garden Garden = our defenses House = Protected parts
14. Security best practises
16. Broken Access Control
17. Broken Access Control Cryptographic Failures
18. Broken Access Control Cryptographic Failures Injection
19. Test Cases
20. Injection
21. Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form'); cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
22. Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form'); cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
23. Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form'); cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
24. Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form'); cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
25. Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form'); cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
26. it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: 'john.doe@example.com' } }).then((response) => { expect(response.status).to.eq(403); }); }); Testing CSRF
27. Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: 'john.doe@example.com' } }).then((response) => { expect(response.status).to.eq(403); }); });
28. Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: 'john.doe@example.com' } }).then((response) => { expect(response.status).to.eq(403); }); });
29. Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: 'john.doe@example.com' } }).then((response) => { expect(response.status).to.eq(403); }); });
30. Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: 'john.doe@example.com' } }).then((response) => { expect(response.status).to.eq(403); }); });
31. Testing SQL Injection it('checks for SQL injection vulnerability', () => { cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
32. Testing SQL Injection it('checks for SQL injection vulnerability', () => { cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
33. Testing SQL Injection it('checks for SQL injection vulnerability', () => { cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
34. CSP Testing Using Cypress const { defineConfig } = require('cypress') module.exports = defineConfig({ // https://on.cypress.io/experiments // https://github.com/cypress-io/cypress/issues/1030 experimentalCspAllowList: ['default-src', 'script-src'], e2e: { baseUrl: 'http://localhost:3003', }, });
35. CSP Testing Using Cypress const { defineConfig } = require('cypress') module.exports = defineConfig({ // https://on.cypress.io/experiments // https://github.com/cypress-io/cypress/issues/1030 experimentalCspAllowList: ['default-src', 'script-src'], e2e: { baseUrl: 'http://localhost:3003', }, });
36. CSP Testing Using Cypress it('serves Content-Security-Policy header', () => { cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
37. CSP Testing Using Cypress it('serves Content-Security-Policy header', () => { cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
38. CSP Testing Using Cypress it('serves Content-Security-Policy header', () => { cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
39. CSP Testing Using Cypress it('stops XSS and reports CSP violations', () => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
40. CSP Testing Using Cypress it('stops XSS and reports CSP violations', () => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
41. CSP Testing Using Cypress it('stops XSS and reports CSP violations', () => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
42. Cover Login / Auth APIs
43. ... cy.get('#username').type(username); cy.get('#password').type(password); cy.get('[type="submit"]').click(); cy.contains('Access denied') .should('not.exist'); ... Cover Authn / Login
44. HTTPS!?
46. Test Automation Tools
48. SAST Tools
49. SAST Tools DAST Tools
50. SAST Tools DAST Tools IAST Tools
51. SAST Tools DAST Tools IAST Tools Static Code Quality Analysis
52. SAST Tools Keeping dependencies up-to-date DAST Tools IAST Tools Static Code Quality Analysis
53. General testing practises
56. Understand your app
57. Understand your app Create a test plan
58. Understand your app Create a test plan Write your test cases
59. Understand your app Create a test plan Write your test cases Execute tests and analyse
60. Understand your app Create a test plan Write your test cases Execute tests and analyse Include other tools
61. Understand your app Create a test plan Write your test cases Execute tests and analyse Include other tools Repeat your test runs
62. Understand your app Create a test plan Write your test cases Execute tests and analyse Include other tools Repeat your test runs
67. Automation = great complement
68. Automation = great complement Simple steps are most useful
69. Automation = great complement Simple steps are most useful Combine own test cases + Tools
70. Automation = great complement Simple steps are most useful Combine own test cases + Tools All testing types can be utilized