Security testing in the pipeline: unit, integration and fuzzing
You turn security requirements into automated tests, catch authorisation and input mistakes with tests and use fuzzing to find code that breaks on unexpected input.
Level 301 · 15 lessons · 12 practice labs
Lessons
Security tests
- Security unit tests: testing with bad input
- Authorisation matrix tests
- Security headers and cookies in integration tests
- A regression test for every vulnerability
- Short task: write authorisation tests for four roles and ten endpoints
Fuzzing
- What fuzzing is: coverage-guided random input
- Fuzzing Python with atheris
- Go’s built-in fuzzing
- Seed corpus, crashes and minimisation
- Short task: fuzz a parser and fix the crash
Into the pipeline
- Property-based tests with hypothesis
- Short fuzzing runs in CI, long runs at night
- Tracking security test coverage
- Short task: set up a nightly fuzzing job
Capstone
- Capstone: a security test suite for a payments module
Practice labs
- Write a security unit test with bad input: Write two tests checking the validation function rejects over-long input and input with special characters.
- Write authorisation tests for four roles and ten endpoints: Define the matrix as data, test every cell with a parameterised test and catch the unexpected permission.
- Check headers and cookies in integration tests and add a regression test: Write a test checking security headers and cookie flags on every response and add a regression test for a past flaw that breaks when the fix is reverted.
- Run a ready fuzzing target and read the output: Run the atheris target for a minute and note the growth in coverage and executions.
- Fuzz a parser and fix the crash: Start fuzzing with seed inputs, minimise the crashing input, fix the flaw and turn the input into a regression test.
- Test a decoder with Go’s built-in fuzzing: Write the fuzz function and seed corpus, reproduce the panic found, fix it and add the bad input to the test data.
- State an invariant property of a function: Write in a sentence the property that must hold for every input of an encode and decode pair and test it with one example.
- Write a property-based test with hypothesis: Write a test asserting an amount rounding function never returns a negative or over-limit result and fix the counterexample found.
- Measure security test coverage and close the gap: Report coverage for authorisation and validation code separately, find the untested branch and add a property test covering it.
- Set the duration of a short fuzzing run in CI: Make the pipeline step limit fuzzing to two minutes and fail if a crash occurs.
- Set up a nightly fuzzing job: Write the scheduled job, keep the corpus in a cache and publish any crashes as artefacts.
- Complete the security test suite for a payments module: Bring unit, authorisation matrix, property and fuzzing tests into one suite, split them into short CI and long nightly runs and report coverage.
About this course
You turn security requirements into automated tests, catch authorisation and input mistakes with tests and use fuzzing to find code that breaks on unexpected input.
What you will learn
- Security tests
- Fuzzing
- Into the pipeline
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.