TIL: OWASP Security Resources - Cheat Sheets, Top 10, and Testing Guide

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// Secure session configuration example
app.use(
  session({
    name: "sessionId",
    secret: process.env.SESSION_SECRET, // Strong, unique secret
    resave: false,
    saveUninitialized: false,
    cookie: {
      secure: true, // HTTPS only
      httpOnly: true, // Prevent XSS access
      maxAge: 1800000, // 30 minutes
      sameSite: "strict", // CSRF protection
    },
    store: new RedisStore({
      host: "localhost",
      port: 6379,
    }),
  }),
);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# Secure input validation patterns
import re
from html import escape

def validate_email(email):
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email)) and len(email) <= 254

def sanitize_html_input(user_input):
    # Escape HTML entities
    escaped = escape(user_input)
    # Remove potential script tags
    cleaned = re.sub(r'<script.*?</script>', '', escaped, flags=re.IGNORECASE)
    return cleaned

# Parameterized queries for SQL injection prevention
cursor.execute(
    "SELECT * FROM users WHERE email = %s AND status = %s",
    (validated_email, 'active')
)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# Secure password hashing
import bcrypt
import secrets

def hash_password(password):
    # Generate salt with sufficient rounds
    salt = bcrypt.gensalt(rounds=12)
    return bcrypt.hashpw(password.encode('utf-8'), salt)

def verify_password(password, hashed):
    return bcrypt.checkpw(password.encode('utf-8'), hashed)

# Secure random token generation
def generate_csrf_token():
    return secrets.token_urlsafe(32)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

// Vulnerable: Direct object reference
app.get("/user/:id/profile", (req, res) => {
  const userId = req.params.id;
  // No authorization check!
  const profile = database.getProfile(userId);
  res.json(profile);
});

// Secure: Proper authorization
app.get("/user/:id/profile", authenticate, (req, res) => {
  const userId = req.params.id;
  const currentUser = req.user;

  // Verify user can access this profile
  if (currentUser.id !== userId && !currentUser.isAdmin) {
    return res.status(403).json({ error: "Access denied" });
  }

  const profile = database.getProfile(userId);
  res.json(profile);
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# Secure data encryption at rest
from cryptography.fernet import Fernet
import os

def encrypt_sensitive_data(data):
    # Use environment variable for key
    key = os.environ.get('ENCRYPTION_KEY').encode()
    cipher_suite = Fernet(key)

    encrypted_data = cipher_suite.encrypt(data.encode())
    return encrypted_data

def decrypt_sensitive_data(encrypted_data):
    key = os.environ.get('ENCRYPTION_KEY').encode()
    cipher_suite = Fernet(key)

    decrypted_data = cipher_suite.decrypt(encrypted_data)
    return decrypted_data.decode()

1
2
3
4
5

-- Vulnerable: SQL injection
SELECT * FROM users WHERE username = '" + user_input + "'

-- Secure: Parameterized query
SELECT * FROM users WHERE username = ?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Subdomain enumeration
subfinder -d example.com -o subdomains.txt

# Technology stack identification
whatweb https://example.com

# Directory and file discovery
dirb https://example.com /usr/share/dirb/wordlists/common.txt

# SSL/TLS configuration testing
sslscan example.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# Automated authentication bypass testing
import requests

def test_authentication_bypass(base_url):
    test_cases = [
        # SQL injection attempts
        {"username": "admin' OR '1'='1", "password": "anything"},
        {"username": "admin'--", "password": ""},

        # Default credentials
        {"username": "admin", "password": "admin"},
        {"username": "administrator", "password": "password"},

        # Empty authentication
        {"username": "", "password": ""},
    ]

    for case in test_cases:
        response = requests.post(
            f"{base_url}/login",
            data=case,
            allow_redirects=False
        )

        if response.status_code == 302:  # Redirect might indicate success
            print(f"Potential bypass: {case}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// Session testing checklist
const sessionTests = {
  // Test session token entropy
  checkTokenRandomness: (tokens) => {
    const uniqueTokens = new Set(tokens);
    return uniqueTokens.size === tokens.length;
  },

  // Test session fixation
  checkSessionFixation: async (sessionId) => {
    const loginResponse = await fetch("/login", {
      method: "POST",
      headers: { Cookie: `SESSIONID=${sessionId}` },
      body: JSON.stringify({ username: "test", password: "test" }),
    });

    const newSessionId = extractSessionFromResponse(loginResponse);
    return newSessionId !== sessionId; // Should be different
  },

  // Test session timeout
  checkSessionTimeout: async (sessionId) => {
    await new Promise((resolve) => setTimeout(resolve, 1800000)); // 30 minutes

    const response = await fetch("/protected", {
      headers: { Cookie: `SESSIONID=${sessionId}` },
    });

    return response.status === 401; // Should be unauthorized
  },
};