Known weakness classes.
WHAT INJECTION TESTING INVOLVES
Supplying input intended to be interpreted as code or commands.
WHERE TO TEST IT
Every input reaching a query, command, or interpreter.
WHAT TO CHECK
Whether input is parameterised rather than concatenated.
WHAT SCRIPTING ATTACKS INVOLVE
Input rendered into a page and executed by the browser.
WHERE TO TEST
Every place user input is displayed.
WHAT TO VERIFY
Contextual escaping, appropriate to where it appears.
WHAT REQUEST FORGERY INVOLVES
A user's browser making a request they did not intend.
WHAT TO VERIFY
Tokens on state-changing requests, and appropriate cookie settings.
WHAT INSECURE DIRECT REFERENCES ARE
Identifiers that can be changed to reach others' data.
WHY THEY ARE SO COMMON
They require an explicit check on every access, and one omission suffices.
WHAT FILE UPLOAD TESTING COVERS
Type validation Size limits Storage location Whether uploaded files can be executed
WHAT TO TEST ABOUT CONFIGURATION
Default credentials Unnecessary services Verbose errors disclosing internals Missing security headers
WHAT TO TEST ABOUT DATA EXPOSURE
Whether responses contain more than needed Whether errors reveal internals Whether logs contain sensitive values
