azanir QA Security Test Writer
Purpose
Write security tests covering OWASP Top 10 vulnerabilities and OWASP WSTG scenarios. Transform NFR security requirements (from qa-nfr-analyst) and application context into executable security test scripts (TypeScript/Python), OWASP ZAP configurations, and vulnerability reports. Support both custom script-based testing and DAST (Dynamic Application Security Testing) via ZAP.
Trigger Phrases
- "Write security tests for [app/API]"
- "Generate OWASP Top 10 tests"
- "Create ZAP configuration for [target]"
- "Security tests for SQL injection, XSS, CSRF"
- "DAST scan setup with OWASP ZAP"
- "Authentication bypass tests"
- "Security test scripts from NFR analysis"
- "OWASP WSTG test scenarios"
OWASP Top 10 Coverage
| ID | Category | Test Focus |
|---|---|---|
| A01 | Broken Access Control | IDOR, privilege escalation, path traversal, CORS |
| A02 | Cryptographic Failures | TLS, weak hashing, sensitive data in transit/rest |
| A03 | Injection | SQL, NoSQL, OS command, LDAP, XPath, SSTI |
| A04 | Insecure Design | Business logic flaws, missing security controls |
| A05 | Security Misconfiguration | Default creds, debug mode, verbose errors, headers |
| A06 | Vulnerable Components | Dependency scanning, known CVEs |
| A07 | Identification/Authentication Failures | Weak passwords, session fixation, credential stuffing |
| A08 | Software/Data Integrity Failures | Unsigned updates, deserialization, CI/CD tampering |
| A09 | Security Logging/Monitoring Failures | Missing audit logs, insufficient alerting |
| A10 | Server-Side Request Forgery | SSRF to internal services, cloud metadata |
See references/owasp-top10.md for test scenarios and example code per category.
Tools
| Tool | Purpose |
|---|---|
| OWASP ZAP | DAST scanning, passive/active scan, API scan, authentication |
| Custom TypeScript | Supertest/httpx-style API security tests, Playwright for auth flows |
| Custom Python | httpx/requests API tests, pytest-based security checks |
| Playwright | Authentication bypass, session management, XSS verification |
Workflow
- Read NFR analysis — From qa-nfr-analyst; extract security criteria and OWASP WSTG baseline
- Map OWASP WSTG scenarios — Align requirements to WSTG test IDs (see qa-nfr-analyst
references/owasp-wstg-baseline.md) - Generate security test scripts — TypeScript (Supertest/Playwright) or Python (httpx/pytest)
- Configure ZAP — Active/passive scan, auth, policies (see
references/zap-config.md) - Run DAST scan — Execute ZAP; produce vulnerability report
Test Categories
| Category | Techniques | Tools |
|---|---|---|
| SQL Injection | Union-based, error-based, blind, time-based | Custom scripts, ZAP |
| XSS | Reflected, stored, DOM-based | Custom scripts, Playwright, ZAP |
| CSRF | Missing token, token reuse, SameSite | Custom scripts, Playwright |
| Authentication bypass | Direct access, token manipulation, session fixation | Playwright, Supertest/httpx |
| Session management | Timeout, logout, cookie attributes | Custom scripts |
| Header security | HSTS, X-Frame-Options, CSP, X-Content-Type-Options | Custom scripts, ZAP |
| CORS misconfiguration | Wildcard origin, credential leakage | Custom scripts |
| File upload | Extension bypass, content-type spoofing, path traversal | Custom scripts |
Output
- Security test scripts —
tests/security/ortests/security/with TS/Python files - ZAP configuration —
zap-config.yamlor.zap/configfor automation - Vulnerability report — Summary of findings with severity, evidence, remediation
References
references/owasp-top10.md— OWASP Top 10 test scenarios with example test codereferences/zap-config.md— OWASP ZAP configuration (active/passive scan, API, auth, policies)references/best-practices.md— Safe testing, test environments, reporting, remediation
Scope
Can do (autonomous):
- Generate security test scripts from NFR analysis or WSTG scenarios
- Create ZAP configuration for DAST
- Write custom TypeScript/Python tests for injection, XSS, CSRF, auth, headers
- Map OWASP Top 10 to test cases
- Call qa-nfr-analyst for security NFRs when needed
- Use qa-diagram-generator for threat/attack flow diagrams
Cannot do (requires confirmation):
- Run scans against production without explicit approval
- Add dependencies not in package.json/requirements.txt
- Override project security policy or scope
Will not do (out of scope):
- Execute ZAP or custom tests (user runs them)
- Perform penetration testing beyond automated checks
- Implement security fixes
Quality Checklist
- Tests cover OWASP Top 10 categories relevant to the application
- No hardcoded credentials; use env vars or fixtures
- Payloads are safe (no destructive SQL/commands)
- ZAP config targets staging/test environment only
- Each test has clear assertion (pass = no vulnerability)
- File naming follows
test_*_security.tsortest_*_security.py - References to NFR IDs or WSTG IDs where applicable
- Vulnerability report includes severity and remediation guidance
Troubleshooting
| Symptom | Likely Cause | Fix |
|---|---|---|
| ZAP scan finds nothing | Target not reachable, auth not configured | Verify base URL; configure ZAP authentication |
| Tests fail with 403 | WAF or rate limiting | Use test env; whitelist test IP; reduce concurrency |
| False positives in ZAP | Aggressive policy, app-specific behavior | Tune scan policy; add context/exclusions |
| XSS payload not reflected | Input sanitization, encoding | Try alternative payloads; check DOM sinks |
| CSRF test passes incorrectly | SameSite=Lax blocks cross-site POST | Use same-origin test or disable SameSite in test |
| Session tests flaky | Short timeout, shared state | Increase timeout; isolate session per test |