# Security Testing Documentation
Comprehensive security testing infrastructure for the Custom PHP Framework.
## Overview
This security testing suite provides automated tests for:
- **Web Application Firewall (WAF)** - SQL injection, XSS, Path Traversal, Command Injection
- **CSRF Protection** - Token generation, validation, rotation
- **Authentication Security** - Session security, token validation, brute force protection
- **Security Headers** - CSP, HSTS, X-Frame-Options, and more
- **Dependency Security** - Vulnerability scanning for Composer packages
## Directory Structure
```
tests/Security/
├── WafTests/
│ ├── SqlInjectionTest.php # SQL injection attack tests
│ ├── XssAttackTest.php # XSS attack tests
│ ├── PathTraversalTest.php # Path traversal attack tests
│ └── CommandInjectionTest.php # Command injection attack tests
├── AuthenticationTests/
│ ├── SessionSecurityTest.php # Session hijacking, fixation, timeout
│ ├── TokenValidationTest.php # JWT/Bearer token validation
│ └── BruteForceProtectionTest.php # Rate limiting, account lockout
├── SecurityTestCase.php # Base class with attack patterns
├── SecurityHeadersTest.php # Security HTTP headers tests
├── CsrfProtectionTest.php # CSRF token tests
├── check-dependencies.php # Dependency vulnerability scanner
└── README.md # This file
```
## Running Security Tests
### All Security Tests
```bash
# Run all security tests
php tests/Security/run-all-tests.php
# Or run individual test categories
php tests/Security/run-waf-tests.php
php tests/Security/run-auth-tests.php
```
### Individual Test Classes
```php
// WAF Tests
$sqlTest = new SqlInjectionTest($wafEngine);
$results = $sqlTest->runAllTests();
$xssTest = new XssAttackTest($wafEngine);
$results = $xssTest->runAllTests();
// Authentication Tests
$sessionTest = new SessionSecurityTest();
$results = $sessionTest->runAllTests();
// Security Headers
$headersTest = new SecurityHeadersTest();
$results = $headersTest->runAllTests();
// CSRF Protection
$csrfTest = new CsrfProtectionTest($csrfTokenGenerator);
$results = $csrfTest->runAllTests();
```
### Dependency Security Check
```bash
# Check for vulnerable dependencies
php tests/Security/check-dependencies.php
# Or use Composer audit (built-in)
composer audit
# Or use local-php-security-checker
local-php-security-checker --path=.
```
## Test Categories
### 1. WAF (Web Application Firewall) Tests
**SQL Injection Tests** (`SqlInjectionTest.php`):
- Query parameter injection
- POST data injection
- HTTP header injection
- Encoded SQL injection
- False positive prevention
**XSS Attack Tests** (`XssAttackTest.php`):
- Script tag injection
- Event handler injection (onerror, onload, etc.)
- JavaScript protocol attacks
- DOM-based XSS
- Encoded XSS attacks
- False positive prevention
**Path Traversal Tests** (`PathTraversalTest.php`):
- Directory traversal attacks (../, ..\\)
- System file access attempts
- Encoded path traversal (%2e%2e%2f)
- Null byte injection (%00)
- Directory listing attempts
- False positive prevention
**Command Injection Tests** (`CommandInjectionTest.php`):
- Shell command injection (; ls, | cat, etc.)
- Backtick command execution
- Command substitution ($(command))
### 2. CSRF Protection Tests
**CsrfProtectionTest.php**:
- Token generation (length, randomness)
- Token uniqueness (100 tokens tested)
- Token validation logic
- Token mismatch detection
- Missing token detection
- POST/PUT/DELETE protection
- GET request exemption
- Token rotation mechanism
### 3. Authentication Security Tests
**Session Security** (`SessionSecurityTest.php`):
- Session hijacking prevention (IP/User-Agent mismatch)
- Session fixation prevention (session ID regeneration)
- Session timeout enforcement
- Session data integrity validation
- Session cookie security (HttpOnly, Secure, SameSite)
- Concurrent session limits
- Proper session destruction
**Token Validation** (`TokenValidationTest.php`):
- JWT structure validation (header.payload.signature)
- Token expiration (exp claim)
- Token signature verification (HMAC-SHA256)
- Bearer token format
- Token claims validation (sub, exp, iat, nbf)
- Issued-at (iat) validation
- Not-before (nbf) validation
**Brute Force Protection** (`BruteForceProtectionTest.php`):
- Rate limiting (5 attempts per 5 minutes)
- Account lockout (after 5 failed attempts)
- Progressive delay (exponential backoff)
- CAPTCHA requirement threshold
- Distributed brute force detection
- Password spray attack detection
- Attempt counter reset on success
### 4. Security Headers Tests
**SecurityHeadersTest.php**:
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Frame-Options
- X-Content-Type-Options
- X-XSS-Protection
- Referrer-Policy
- Permissions-Policy
- Server header masking
- X-Powered-By removal
- Cross-Origin-Resource-Policy (CORP)
- Cross-Origin-Embedder-Policy (COEP)
- Cross-Origin-Opener-Policy (COOP)
## Attack Patterns Library
The `SecurityTestCase` base class provides reusable attack pattern libraries:
### SQL Injection Patterns (10 patterns)
```php
"' OR '1'='1"
"'; DROP TABLE users--"
"' UNION SELECT NULL--"
"admin'--"
"' OR 1=1--"
"1' AND '1'='1"
"' OR 'x'='x"
"1' UNION SELECT NULL, NULL--"
"; DELETE FROM users WHERE '1'='1"
"1'; WAITFOR DELAY '00:00:05'--"
```
### XSS Patterns (12 patterns)
```php
""
"
"
"