We have been performing application security testing based on OWASP standards. We use JIRA to report the bugs or improvements. However, is there any way where we can make a generic test case for these type of testing, so that it becomes part of my release and deployment certification process and becomes audit ready record.

  • You can take a look at the Software Assurance Reference Dataset samate.nist.gov/SARD/index.php - These are effectively vulnerable code snippets for multiple programming languages and include the OWASP top 10 vulnerabilities. However, if you want to try live examples you can try a number of opensource or commercial wargame apps: Owasp WebGoat Damn Vulnerable Web Application – Mornon Jul 22 '19 at 13:55
  • Jira bug types are basically free text entries - it should be trivial to write anything you want. Are you experiencing any problem in particular? – João Farias Jul 22 '19 at 14:13

Automate this with some kind of static code analyzer tool (e.g. SonarQube) which has OWASP checks included.

  • It will help me in code review. However, I would want security testing to be a part of release management. In order to this we need some basic test cases to be added. – Xterm Aug 26 '19 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.