Security testing for QA
Where a QA role fits between the developers and a penetration test, and the references worth having open.
Most testers are not going to run a penetration test, and should not pretend otherwise. There is still a large band of security work that fits naturally into a test role, mostly because it is about behaviour: does the application do what it says with authorisation, does it leak information in its errors, does it trust input it should not.
The cleanest way to find that band is to read the OWASP Top 10 as a list of testable behaviours rather than a list of vulnerabilities. Broken access control — the category that has sat at the top for years — is mostly a question you can ask with the tools you already have: log in as one user, take a URL or an API call that belongs to another, and see what happens.
| The question | How a tester asks it |
|---|---|
| Can I reach another user's data? | Take an id from account A, request it while signed in as account B |
| Is the interface the only thing enforcing this rule? | Call the endpoint directly, skipping the disabled button |
| Does an error tell an attacker something? | Compare the response for a wrong password with the one for an unknown user |
| Does the session actually end? | Sign out, then replay a request with the old token |
Everything on this page is for systems you are employed or contracted to test, on an environment somebody agreed you could break. Scanning a third-party service without written permission is a crime in most jurisdictions regardless of intent, and “I was only testing” has never been a defence.
The references
4 entries-
OWASP Top 10
StandardThe ten categories that account for most real breaches, each with example scenarios and prevention advice. The shared vocabulary between testers, developers and whoever writes your security policy.
owasp.org -
OWASP Web Security Testing Guide
StandardNot a tool: a very long, very good checklist of how to test a web application's security by hand, organised by area, with the specific steps for each check. The reference this whole category orbits.
owasp.org -
OWASP Cheat Sheet Series
StandardShort, direct pages on the things people get wrong: session management, password storage, input validation, CORS, JWTs. When a developer asks “is this okay?”, the answer is usually one of these pages.
cheatsheetseries.owasp.org -
A tiered checklist of requirements, which is what you want when the question is not “find a bug” but “can we say this application meets a standard”. Useful as acceptance criteria.
owasp.org
Tools worth knowing
3 entries-
OWASP ZAP
ToolA free, open-source intercepting proxy and scanner. The passive scan — just browse the application with ZAP in the middle and read what it noticed — is a genuinely low-effort first step, and it can be automated in a pipeline.
www.zaproxy.org -
The industry standard intercepting proxy. The free edition is enough to learn how requests are manipulated, which is the skill; the paid scanner is the part most testers do not need.
portswigger.net -
Free, extremely good, and hands-on: interactive labs with deliberately vulnerable applications and worked explanations. The best available way to learn this material without a training budget.
portswigger.net
Building it into the pipeline
2 entries-
GitHub: about supply chain security
Official docsDependency alerts, Dependabot and secret scanning. Most reported vulnerabilities in a product are in something it depends on, and this part is close to free.
docs.github.com -
Scans your dependencies against published vulnerability data and fails a build on what it finds. Works across several ecosystems and runs anywhere.
owasp.org
What to take away
- Broken access control is a testing problem.Two accounts and a copied identifier find more real issues than most scanners.
- Never trust the interface to be the enforcement.If the only thing stopping an action is a disabled button, it is not stopped.
- Get permission in writing.Authorised scope first, testing second. Always.
Reading is the slow way to learn how a suite behaves. Record one against your own app, free, and watch what the report says.