Comments (9)
Is instruction on regression testing in scope for the WSTG? Or have I got the wrong idea?
from wstg.
@victoriadrake we believe (me and @kingthorin ) that it could be a nice to have, nothing core to the project or its latest release. The project focuses more on guidance a tester through the stages in a manual approach more so than an automated one.
from wstg.
The project focuses more on guidance a tester through the stages in a manual approach more so than an automated one.
@ThunderSon Does that mean there's another OWASP project that focuses on adversarial unit tests that we should make sure to link to?
On this issue in general, the framework of Defect Dojo seems to work as a bit of a guide to write security tests: https://defectdojo.readthedocs.io/en/latest/models.html#engagements / https://owasp.org/www-project-defectdojo/
Personally, I handle security type tests in the same way as any other test (maybe I saw too much DevSecOps idealism marketing), so I'm not sure what this guide has to say about what makes a "security test case" different from any other test. Everything I can think of (business importance, which team is responsible for it, who to call if the feature underlying said test fails in production and forces people in at 02:00 on a Sunday) apply to both "security" and "non-security" tests.
from wstg.
What I read from DD (defect dojo) doesn't actually fit what is being discussed in here.
The project can contain these points, but at this stage, we see a bigger value in actually updating the tests written, adding the missing tests, and mapping to the ASVS.
Tests discussed in this issue are part of the automated pipeline that could be run.
If you feel like tackling this point, or anyone, we don't mind it. If this is something that is of interest to you or any other future reader, please take it. 😄
from wstg.
@itscooper any chance you want to contribute some content to address this?
from wstg.
"how a tester can write programmatic test cases as a form of output, that developers can re-run to determine if an issue has been fixed."?
I can help if it's the "BDD Security testing". It will require the integration of BDD framework.
However, is the topic "How to do Behavior-Based Driven Security Testing" what OWASP testing guide would like to add?
i.e. By applying the BDD security, and testing cases/report will be -
Testing Scenario - There is no port 80 open listening
Testing Steps
- Use Nmap to scan the target website
- Check if there is port 80 open
Results
There is no port 80 open
from wstg.
Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
from wstg.
Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
from wstg.
Please comment if you are still working on this issue, as it has been inactive for 90 days. To give everyone a chance to contribute, we are releasing it to new contributors.
from wstg.
Related Issues (20)
- Ambiguity in the summary related to the test case Testing for Bypassing Authorization Schema HOT 4
- [fix] : Typo in CONTRIBUTING.md
- [Fix] : Fix Formatting Issue in OWASP Web Security Testing Guide Document
- [fix]: Fix Formatting Issue in OWASP Web Security Testing Guide Document
- E-Book action artifact expired HOT 3
- yjh HOT 1
- fghhyg
- vbbbbbbbbbbbbbm
- jjjjjjjjjjjjjjj
- Adding "How to Test" for the WSTG Checklist [Work in Progress] HOT 17
- Adding "Test for Simultaneous sessions" in Session Management Testing HOT 2
- Provide a simplified Chinese translation version for this project HOT 1
- Cookies-Link under 4.08 #cookies points to itself HOT 1
- Invisible code parts - bright blue text on the blue background HOT 6
- Check List Translation to french and arabic HOT 3
- Update Privilege Escalation's Weak SessionID Section
- Juice Shop - Error Handling link not found HOT 1
- Grammar error HOT 1
- Review and update subdomain takeover content
- Need suggestion on issues mapping with wstg: Authenticator strength and Identity control issue HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wstg.