Web Application Security Testing
This domain tests manual and tool-assisted testing of web apps against OWASP WSTG and Top 10 categories.
Test areas
Cover authentication, session management, access control, input handling, business logic, and transport security. Specific checks include IDOR, SQL injection, cross-site scripting, command injection, SSRF, insecure deserialization, CSRF, security headers, cookie flags, session expiration, and logout behavior. Use test accounts at multiple privilege levels and record every request and response.
Method
Map the application and roles first, then test authorization horizontally and vertically. Automated scanners help with breadth but miss logic flaws and multi-step access control issues. Respect rate limits and avoid destructive payloads. For production testing, use non-destructive proofs and coordinate timing.
Worked example
User A requests /api/invoice?account_id=1001 and receives their invoice. Changing the value to 1002 returns another user's invoice with HTTP 200. The reasoning: this is an IDOR only if User B's data is returned and User A is not authorized for it. Confirm with a second account, verify the response belongs to User B, and capture the full request, response, and timestamps. Do not enumerate further than needed.
Traps
Relying on a scanner alone. Testing only vertical privilege escalation and missing horizontal IDOR. Ignoring client-side controls as the only defense. Forgetting session fixation and logout invalidation. Using destructive SQL injection or file upload payloads in production.