Imported from NeuralBlitz/Agent-Gateway (agent-gateway/skills/user/cybersecurity/security-testing/SKILL.md). Install upstream with npx skills add NeuralBlitz/Agent-Gateway --skill security-testing. Copyright stays with the author.

Security Testing

What I Do

I provide guidance on testing the security posture of applications and infrastructure. This includes penetration testing methodologies, fuzzing strategies, vulnerability scanning, security unit testing, and building security regression test suites that catch vulnerabilities before deployment.

When to Use Me

• Planning a penetration test or security assessment
• Writing security-focused unit and integration tests
• Setting up fuzzing for parsers, APIs, or protocol handlers
• Building security regression tests for previously found vulnerabilities
• Evaluating SAST/DAST tool results and reducing false positives
• Testing authentication, authorization, and cryptographic implementations

Core Concepts

1. Penetration Testing: Simulated attacks on applications and infrastructure to identify exploitable vulnerabilities.
2. Fuzzing: Automated generation of malformed or random inputs to discover crashes, memory issues, and unexpected behavior.
3. SAST: Static analysis of source code to identify vulnerability patterns without running the application.
4. DAST: Dynamic testing of running applications by sending crafted HTTP requests and analyzing responses.
5. Security Unit Tests: Tests that verify security controls (auth, authz, input validation) function correctly.
6. Regression Testing: Tests for previously discovered vulnerabilities to prevent reintroduction.
7. Red Team/Blue Team: Adversarial exercises where red teams attack and blue teams defend to test detection and response.

Code Examples

1. Security Unit Tests for Authentication (Python/pytest)

import pytest
from app.auth import authenticate, hash_password, verify_password

class TestAuthentication:
    def test_reject_empty_password(self):
        with pytest.raises(ValueError, match="Password cannot be empty"):
            authenticate("user@example.com", "")

    def test_reject_sql_injection_in_username(self):
        result = authenticate("' OR 1=1 --", "password123")
        assert result is None

    def test_timing_safe_comparison(self):
        import time
        wrong_short = "a"
        wrong_long = "a" * 100
        valid_hash, salt = hash_password("correct_password")

        start = time.perf_counter()
        verify_password(wrong_short, valid_hash, salt)
        time_short = time.perf_counter() - start

        start = time.perf_counter()
        verify_password(wrong_long, valid_hash, salt)
        time_long = time.perf_counter() - start

        assert abs(time_short - time_long) < 0.01

    def test_password_hash_uniqueness(self):
        hash1, salt1 = hash_password("same_password")
        hash2, salt2 = hash_password("same_password")
        assert salt1 != salt2
        assert hash1 != hash2

    def test_account_lockout_after_failures(self, auth_service):
        for _ in range(5):
            auth_service.authenticate("user@example.com", "wrong")
        result = auth_service.authenticate("user@example.com", "correct")
        assert result is None
        assert auth_service.is_locked("user@example.com")

2. API Fuzzing with Hypothesis (Python)

from hypothesis import given, strategies as st, settings
import requests

BASE_URL = "http://localhost:8080"

@given(
    username=st.text(min_size=0, max_size=1000),
    password=st.text(min_size=0, max_size=1000),
)
@settings(max_examples=500)
def test_login_fuzz(username: str, password: str):
    response = requests.post(
        f"{BASE_URL}/api/v1/login",
        json={"username": username, "password": password},
        timeout=5,
    )
    assert response.status_code in (200, 400, 401, 422, 429)
    assert response.status_code != 500

@given(payload=st.dictionaries(st.text(), st.text(), max_size=50))
@settings(max_examples=200)
def test_arbitrary_json_endpoint(payload: dict):
    response = requests.post(
        f"{BASE_URL}/api/v1/data",
        json=payload,
        timeout=5,
    )
    assert response.status_code != 500

3. Authorization Matrix Test (Python/pytest)

import pytest
from typing import Dict, List

AUTHORIZATION_MATRIX: Dict[str, Dict[str, List[str]]] = {
    "GET /api/v1/users": {"admin": [200], "user": [200], "anonymous": [401]},
    "POST /api/v1/users": {"admin": [201], "user": [403], "anonymous": [401]},
    "DELETE /api/v1/users/{id}": {"admin": [204], "user": [403], "anonymous": [401]},
    "GET /api/v1/admin/settings": {"admin": [200], "user": [403], "anonymous": [401]},
}

@pytest.mark.parametrize("endpoint,roles", AUTHORIZATION_MATRIX.items())
def test_authorization_matrix(endpoint, roles, api_client):
    method, path = endpoint.split(" ", 1)
    for role, expected_codes in roles.items():
        client = api_client(role=role)
        response = client.request(method, path.replace("{id}", "1"))
        assert response.status_code in expected_codes, (
            f"{role} got {response.status_code} for {endpoint}, expected {expected_codes}"
        )

Best Practices

1. Write security tests for every vulnerability found to prevent regression.
2. Test authorization at every endpoint using a role-based authorization matrix.
3. Fuzz all input parsers including JSON, XML, file uploads, and query parameters.
4. Use property-based testing (Hypothesis, fast-check) to explore edge cases automatically.
5. Test for timing side channels in authentication and cryptographic comparisons.
6. Validate error responses do not leak internal details like stack traces or SQL queries.
7. Test rate limiting by exceeding thresholds and verifying enforcement.
8. Include negative tests that verify rejected inputs, denied access, and blocked attacks.
9. Automate security tests in CI so they run on every pull request.
10. Maintain a security test suite separate from functional tests for clear ownership and tracking.