Plants vs thieves: Automated Tests in the World of Web Security

Web security is crucial in a constantly evolving environment where potential threats are always present. To better understand this concept, we can imagine our web application as a garden or a home that needs to be protected from possible attacks. We can draw parallels with the popular game "Plants vs. Zombies," which aims to safeguard your garden from intruders.

Our automated tests function as diligent guardians whose primary objective is to identify and address potential vulnerabilities, much like the diverse plant arsenal in the game. Instead of framing the security process as a never-ending fight, we will explore how automated tests act as defenders against possible issues, whether they are zombies or intruders. Next to an overview of tools you can utilize, we emphasize the importance of fundamental testing types, such as unit or end-to-end tests, in securing your digital garden.

Join this session to understand how to create a secure environment for your web application through test automation. This approach ensures that your web applications can successfully navigate the challenges posed by cyber threats without the necessity of introducing entirely new dedicated tools.

Transcript

1. Automated Tests in the World of Web Security
3. What does that have to do with web development?
10. Garden
11. Garden House = Protected parts
12. Garden Garden = our defenses House = Protected parts
13. ==
15. What’s our game plan?
16. What’s our game plan?
17. Know your house application
18. What to automate first?
19. Priority
20. Priority Risk Level
21. Priority Risk Level Automation Difficulty
22. Priority Risk Level Automation Difficulty Business Value
25. Broken Access Control
26. Broken Access Control Cryptographic Failures
27. Broken Access Control Cryptographic Failures Injection
28. How do we “cover” our garden?
30. Garden Attackers arrive here
31. Garden House = Infrastructure Attackers arrive here
32. Garden House = Infrastructure Frontend Attackers arrive here
33. Garden House = Infrastructure Frontend API Attackers arrive here
34. Garden House = Infrastructure Frontend API Backend Attackers arrive here
35. Test Cases
36. Test Cases
37. Injection
43. -> “Frame” -> “Test”
44. Sample repo
47. it('injects XSS payload into search field’, () => { cy.get('.mat-search_icon-search').click(); cy.get('.mat-toolbar-row .mat-form-field-infix') .type('<iframe src="javascript:alert(`xss`)">'); cy.get('.mat-toolbar-row .mat-form-field-infix’) .type('{enter}'); // Check if the payload is executed let spy = cy.spy(window, 'alert'); expect(spy).to.haveOwnProperty('callCount'); expect(spy).to.not.be.called; });
48. it('injects XSS payload into search field’, () => { cy.get('.mat-search_icon-search').click(); cy.get('.mat-toolbar-row .mat-form-field-infix') .type('<iframe src="javascript:alert(`xss`)">'); cy.get('.mat-toolbar-row .mat-form-field-infix’) .type('{enter}'); // Check if the payload is executed let spy = cy.spy(window, 'alert'); expect(spy).to.haveOwnProperty('callCount'); expect(spy).to.not.be.called; });
49. it('injects XSS payload into search field’, () => { cy.get('.mat-search_icon-search').click(); cy.get('.mat-toolbar-row .mat-form-field-infix') .type('<iframe src="javascript:alert(`xss`)">'); cy.get('.mat-toolbar-row .mat-form-field-infix’) .type('{enter}'); // Check if the payload is executed let spy = cy.spy(window, 'alert'); expect(spy).to.haveOwnProperty('callCount'); expect(spy).to.not.be.called; });
54. Broken Access Control
55. Cover protected areas
60. CSRF via API Testing
67. OpenFGA
68. Cryptographic Failures
69. HTTPS!?
70. HTTPS!?
71. Get better sample by randomizing
73. Use fixtures or helpers to store routes or input fields Helper
74. cy.sample by cypress map Cypress-map Cypress-map Use fixtures or helpers to store routes or input fields Helper
75. Use faker.js for test data cy.sample by cypress map Cypress-map Cypress-map Use fixtures or helpers to store routes or input fields Helper
76. Utilize API Schema Docs
77. How… or well, does it fit into our life(cycle)? Garden
78. Development Testing Staging Production
79. Development Testing Staging Production
80. Development Testing Staging Production Pre-Commit Hook SAST Linting
81. Development Testing Staging Production Pre-Commit Hook SAST Linting Built time tests DAST / IAST
82. Development Testing Staging Production Pre-Commit Hook SAST Linting Built time tests DAST / IAST Deploy Gates Pen Testing
83. Development Testing Staging Production Pre-Commit Hook SAST Linting Built time tests DAST / IAST Deploy Gates Pen Testing Runtime Monitoring Security Monitoring
84. Development Testing Staging Production Pre-Commit Hook SAST Linting Built time tests DAST / IAST Deploy Gates Pen Testing Runtime Monitoring Security Monitoring OWASP Web Security Testing Guide
86. Fast check Testing JSVerify
88. Shall we waive tool support?
89. The unknown thread?!
90. Cypress + OWASP ZAP ZAP as a proxy
91. Recommendations
92. SAST Tools Recommendations
93. SAST Tools DAST Tools Recommendations
94. SAST Tools DAST Tools IAST Tools Recommendations
95. SAST Tools DAST Tools IAST Tools Static Code Quality Analysis Recommendations
96. SAST Tools Keeping dependencies up-to-date DAST Tools IAST Tools Static Code Quality Analysis Recommendations
99. Only saving money and less of a learning curve?
100. Great messenger!!
101. Regression Tests
102. Building trust
103. Use Test Runner / Tracer for Reproducability
104. Learn what external tools do
109. Automation = great complement
110. Automation = great complement Intentional Test Cases as low hanging fruits
111. Automation = great complement Intentional Test Cases as low hanging fruits Combine own test cases + Tools
112. Automation = great complement Intentional Test Cases as low hanging fruits Combine own test cases + Tools All testing types can be utilized, including property-based testing
113. Auth0
114. Additional
115. Iframe!? - clickjacking
116. Rate limiter testing
117. Web vitals for performace topics?