OWASP Top 10 for Testers

// ══════════════════════════════════════════════════════════════
// SECURITY TEST CASES FOR THE MOST CRITICAL OWASP CATEGORIES
// ══════════════════════════════════════════════════════════════

const securityTestCases = {
    
    // ── A01: Broken Access Control ───────────────────────────
    A01: [
        {
            id: "SEC-001",
            title: "Regular user cannot access admin endpoints",
            steps: [
                "Login as regular user alice@test.com",
                "GET /api/admin/users (admin-only endpoint)",
            ],
            expected: "HTTP 403 Forbidden - not 200 or 404",
        },
        {
            id: "SEC-002",
            title: "User cannot access another user's order",
            steps: [
                "Login as alice@test.com (user ID: 123)",
                "GET /api/users/456/orders (another user's orders)",
            ],
            expected: "HTTP 403 Forbidden",
        },
        {
            id: "SEC-003",
            title: "Manipulating object IDs in request doesn't expose other users' data",
            steps: [
                "Login as alice (ID: 123). GET /api/orders/ORD-100",
                "Check if ORD-100 belongs to alice",
                "Try GET /api/orders/ORD-101 (belongs to bob)",
            ],
            expected: "HTTP 403 or 404",
        },
    ],
    
    // ── A07: Auth Failures ───────────────────────────────────
    A07: [
        {
            id: "SEC-010",
            title: "Account lockout after 5 failed login attempts",
            steps: ["Attempt login with wrong password 5 times for same account"],
            expected: "Account locked on 6th attempt (not just rate limited)",
        },
        {
            id: "SEC-011",
            title: "Session token is invalidated after logout",
            steps: [
                "Login → capture session token",
                "Logout via POST /api/auth/logout",
                "Use captured token on GET /api/user/profile",
            ],
            expected: "HTTP 401 - token is no longer valid",
        },
        {
            id: "SEC-012",
            title: "Password reset token is single-use",
            steps: [
                "Request password reset → get reset token from email",
                "Use token once to reset password",
                "Attempt to use the SAME token a second time",
            ],
            expected: "Second use returns 400 Invalid token",
        },
        {
            id: "SEC-013",
            title: "Weak passwords are rejected",
            testData: ["password", "123456", "qwerty", "abc123"],
            expected: "All rejected with 'Password too weak' message",
        },
    ],
    
    // ── A05: Security Misconfiguration ───────────────────────
    A05: [
        {
            id: "SEC-020",
            title: "Error responses don't expose stack traces",
            steps: ["Send malformed request to any endpoint"],
            expected: "Generic error message - no stack trace, no line numbers, no internal paths",
        },
        {
            id: "SEC-021",
            title: "Security response headers are present",
            steps: ["GET / and check response headers"],
            expected: "Headers present: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Strict-Transport-Security: max-age=31536000, Content-Security-Policy: (defined policy)",
        },
    ]
};