Security Testing

Authorization testing verifies that an authenticated user can only access the data and actions they're actually permitted to — checking role-based permissions, resource ownership, and access boundaries. It answers "what is this verified user allowed to do," distinct from authentication's "who is this."

Cross-Site Request Forgery (CSRF) is an attack that tricks a logged-in user's browser into submitting an unwanted, authenticated request to a site they're already logged into — transferring money, changing an email address — without the user's knowledge, by exploiting the browser automatically attaching valid session cookies to the request.

Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious script into a page viewed by other users — through an unescaped input field, URL parameter, or stored content — letting the script run in victims' browsers with their full session privileges, often to steal cookies or credentials.

DAST (Dynamic Application Security Testing) finds vulnerabilities by attacking a running application from the outside — sending malicious requests and observing the responses — the same way a real attacker would, without any access to or knowledge of the underlying source code.

Dependency scanning (Software Composition Analysis, or SCA) automatically checks a project's third-party libraries and packages against known vulnerability databases, flagging any dependency with a publicly disclosed security issue — a common and often overlooked attack surface, since most applications include far more third-party code than code they wrote themselves.

Fuzz testing automatically generates large volumes of random, malformed, or unexpected input and feeds it to a system to find crashes, hangs, memory issues, or unhandled exceptions — a brute-force way to discover edge cases and vulnerabilities no human tester would think to try by hand.

JWT testing verifies that JSON Web Tokens — the compact, signed tokens widely used for API authentication — are correctly issued, validated, and rejected when tampered with, expired, or signed with the wrong key. A flawed JWT implementation is a direct path to full authentication bypass.

The OWASP Top 10 is a regularly updated, widely referenced list of the most critical web application security risks — currently including issues like broken access control, injection, and security misconfiguration — published by the Open Worldwide Application Security Project as a baseline standard for security testing priorities.

Penetration testing (pen testing) simulates a real attack against a system, performed by a security professional actively trying to exploit vulnerabilities and gain unauthorized access — going beyond automated scanning to chain findings together the way a genuine attacker would, often revealing risks a scanner alone would miss.

SAST (Static Application Security Testing) analyzes source code, without running the application, to find security vulnerabilities — insecure patterns, known-dangerous function usage, potential injection points — early in development, before the code is even built or deployed.

Secrets scanning automatically checks source code, commit history, and configuration files for accidentally committed sensitive credentials — API keys, passwords, private certificates — before or after they're pushed to a repository, since a leaked secret in git history can remain exploitable indefinitely, even after being "removed" in a later commit.

Security regression testing re-verifies previously fixed vulnerabilities and previously validated security controls after a code change, confirming a new release hasn't silently reintroduced an old vulnerability or weakened an existing protection. It's regression testing specifically scoped to security findings.

Security testing evaluates a system's ability to protect data and maintain functionality against malicious attacks — covering authentication, authorization, data protection, and resilience against common attack patterns. It's a non-functional testing discipline focused specifically on adversarial, not accidental, failure.

Session hijacking testing checks whether an attacker can steal or forge a valid user session — through session ID theft, prediction, or fixation — and use it to impersonate the legitimate user without needing their actual credentials.

SQL injection is a vulnerability where an attacker inserts malicious SQL through an application's input fields to manipulate or extract data from its database — bypassing authentication, reading data they shouldn't see, or deleting records. It happens when user input is concatenated directly into a query instead of being parameterized, and remains one of the OWASP Top 10's most exploited flaws.

SSL/TLS testing verifies that a system's encrypted connections are correctly configured — valid, non-expired certificates, strong cipher suites, no support for deprecated or broken protocol versions — protecting data in transit between a client and server from interception or tampering.

Threat modeling is a proactive design-time exercise where a team systematically identifies potential attackers, attack vectors, and valuable assets in a system, then designs defenses before writing code — shifting security thinking upstream, before vulnerabilities are ever built in, rather than finding them afterward.

Vulnerability scanning automatically checks systems, networks, and applications against a database of known vulnerabilities, flagging outdated software, missing patches, and common misconfigurations — broad, fast, and largely automated, in contrast to the manual, targeted depth of a penetration test.