Security Testing (Chinese Version)

security-testing-en

prompts/security-testing.md

When to Use

• When the user mentions "security testing" or "security-testing"
• Need to execute such tests or deliver corresponding artifacts based on Standard-version
• Trigger Examples: "Generate/design/write... based on the following content"

Output Format Options

How to Use

1. Open

   prompts/security-testing.md

   in this directory, copy the content below the dashed line into the AI conversation.
2. Attach your specific requirements.
3. If you need Excel/CSV/JSON, add the request sentence from output-formats.md at the end.

Code Examples

1. OWASP ZAP Security Scan

examples/owasp-zap-scan/

• Baseline scan script (quick scan)
• Full scan script (deep scan)
• API scan script
• Automated run script
• Detailed README documentation

cd examples/owasp-zap-scan
./run-scan.sh baseline https://example.com

• SQL injection detection
• XSS vulnerability detection
• CSRF vulnerability detection
• Security configuration check
• API security testing

Best Practices

Security Testing Principles

1. OWASP Top 10
   • Injection Attacks
   • Broken Authentication
   • Sensitive Data Exposure
   • XML External Entities (XXE)
   • Broken Access Control
   • Security Misconfiguration
   • Cross-Site Scripting (XSS)
   • Insecure Deserialization
   • Using Components with Known Vulnerabilities
   • Insufficient Logging & Monitoring
2. Testing Phases
   • Development Phase: Static Code Analysis
   • Testing Phase: Dynamic Security Testing
   • Pre-Release: Penetration Testing
   • Production Environment: Continuous Monitoring
3. Testing Methods
   • Black-box Testing: No knowledge of internal implementation
   • White-box Testing: Full knowledge of internal implementation
   • Gray-box Testing: Partial knowledge of internal implementation

Tool Selection Recommendations

Troubleshooting

Common Issues

1. ZAP Scan Timeout

# Increase timeout
zap-baseline.py -t http://example.com --timeout 300

# Limit scan depth
zap-baseline.py -t http://example.com -m 3

2. Too Many False Positives

• Use custom scan policies
• Exclude known false positives
• Manually verify high-risk vulnerabilities
• Adjust scan levels

3. Cannot Scan Authenticated Pages

# Configure authentication
zap-cli auth \
  --auth-mode form \
  --auth-url http://example.com/login \
  --auth-username user \
  --auth-password pass

4. Docker Permission Issues

# Use correct permissions
docker run -u $(id -u):$(id -g) \
  -v $(pwd):/zap/wrk/:rw \
  owasp/zap2docker-stable \
  zap-baseline.py -t http://example.com

5. Certificate Verification Error

# Skip certificate verification (test environment only)
zap-baseline.py -t https://example.com --hook-script skip-cert-check.py

6. Scan Blocked by WAF

• Reduce scan speed
• Use random User-Agent
• Coordinate testing time with the security team
• Use whitelisted IPs

7. Difficulty Interpreting Reports

• Refer to OWASP documentation
• Manually verify vulnerabilities
• Consult security experts
• Refer to CVE database

Reference Files

• prompts/security-testing.md — Security testing Standard-version prompt templates
• output-formats.md — Instructions for requesting Markdown / Excel / CSV / JSON output
• examples/owasp-zap-scan/ — Complete OWASP ZAP examples
• quick-start.md — 5-minute quick start guide