Security Testing¶
We run a security test across user interface using a product called OWASP® Zed Attack Proxy (ZAP). These tests are slightly different from all the other tests mentioned in this document in that they take the form of tests that may be run several times against different parts of the application to ensure that the problem does not manifest itself anywhere in the application. So the total number of tests run is not the number we are really interested in but the number of requests that have been made to the application.
| Test Type | Strength |
|---|---|
| BackupFileDisclosureScanRule | Medium |
| BufferOverflowScanRule | Medium |
| CloudMetadataScanRule | Medium |
| CodeInjectionScanRule | Medium |
| CommandInjectionScanRule | Medium |
| CrlfInjectionScanRule | Medium |
| CrossDomainScanRule | Medium |
| CrossSiteScriptingScanRule | Medium |
| CsrfTokenScanRule | Medium |
| DirectoryBrowsingScanRule | Medium |
| DomXssScanRule | Medium |
| ElmahScanRule | Medium |
| EnvFileScanRule | Medium |
| ExpressionLanguageInjectionScanRule | Medium |
| FormatStringScanRule | Medium |
| GetForPostScanRule | Medium |
| HiddenFilesScanRule | Medium |
| HttpOnlySiteScanRule | Medium |
| HttPoxyScanRule | Medium |
| HttpParameterPollutionScanRule | Medium |
| InsecureHttpMethodScanRule | Medium |
| IntegerOverflowScanRule | Medium |
| PaddingOracleScanRule | Medium |
| ParameterTamperScanRule | Medium |
| PathTraversalScanRule | Medium |
| PersistentXssPrimeScanRule | Medium |
| PersistentXssScanRule | Medium |
| PersistentXssSpiderScanRule | Medium |
| ProxyDisclosureScanRule | Medium |
| RelativePathConfusionScanRule | Medium |
| RemoteCodeExecutionCve20121823ScanRule | Medium |
| RemoteFileIncludeScanRule | Medium |
| ScriptsActiveScanner | Medium |
| ServerSideIncludeScanRule | Medium |
| SessionFixationScanRule | Medium |
| ShellShockScanRule | Medium |
| SlackerCookieScanRule | Medium |
| SOAPActionSpoofingActiveScanRule | Medium |
| SOAPXMLInjectionActiveScanRule | Medium |
| SourceCodeDisclosureCve20121823ScanRule | Medium |
| SourceCodeDisclosureFileInclusionScanRule | Medium |
| SourceCodeDisclosureGitScanRule | Medium |
| SourceCodeDisclosureSvnScanRule | Medium |
| SourceCodeDisclosureWebInfScanRule | Medium |
| SqlInjectionMsSqlScanRule | Medium |
| SqlInjectionOracleScanRule | Medium |
| SqlInjectionScanRule | Medium |
| TraceAxdScanRule | Medium |
| UserAgentScanRule | Medium |
| UsernameEnumerationScanRule | Medium |
| XpathInjectionScanRule | Medium |
| XsltInjectionScanRule | Medium |
| XxeScanRule | Medium |