Web Application Security Testing
Web Application Security Testing
This domain tests structured web and API testing using OWASP WSTG and the OWASP Top 10: authentication, session management, access control, input handling, and business logic. The exam favors manual confirmation over scanner output.
Core rules and concepts
- Map the application: endpoints, roles, parameters, cookies, tokens, APIs, and hidden functionality.
- Authentication: default and weak credentials, MFA bypass, password reset flaws, user enumeration. Session management: cookie flags, rotation, fixation, logout invalidation.
- Access control: test horizontal and vertical privilege boundaries, especially IDOR and missing function-level checks.
- Injection: SQLi, command injection, LDAP, template injection. Confirm with safe, minimal payloads and time-based checks.
- XSS: reflected, stored, DOM; CSRF; SSRF; file upload; insecure deserialization; business-logic abuse.
- APIs: REST and GraphQL authorization, mass assignment, excessive data exposure, rate limits.
- Use an intercepting proxy such as Burp Suite or ZAP, and keep requests/responses as evidence.
Worked example
A login form returns a generic error for bad passwords. A tester submits ' OR 1=1-- and receives a normal login failure, so the form is likely parameterized. A time-based payload then causes a five-second delay, confirming SQL injection. The tester records the request, response time, and a minimal proof; they do not dump the user table. Remediation is parameterized queries plus least-privilege database accounts. Calling the first payload 'successful' without confirmation would lose marks.
Traps that cost marks
- Submitting scanner output as a confirmed finding.
- Using destructive payloads such as
DROP TABLEon production. - Testing authentication but skipping authorization.
- Forgetting CSRF tokens or same-site cookie behavior.
- Reporting a reflected payload without showing execution context.