Reusable test modules
Choose a security boundary and work through its procedure, commands, controls, evidence requirements, and checklist together. The same canonical module appears inside every applicable target playbook.
No matching entries. Clear a filter or try a broader term.
17 vulnerability references · 6 target families
Object, function, and property authorization
Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
21 vulnerability references · 6 target families
Authentication, recovery, federation, and session lifecycle
Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
7 vulnerability references · 6 target families
Trace input into queries, commands, and templates
Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
2 vulnerability references · 5 target families
Server-side fetching and network trust boundaries
Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
12 vulnerability references · 5 target families
Browser execution, cross-origin reads, and forged actions
Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
11 vulnerability references · 6 target families
Uploads, downloads, paths, archives, and XML
Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
5 vulnerability references · 6 target families
Workflow invariants, replay, idempotency, and races
Find security consequences in workflow ordering and concurrency, with serial controls and durable-state evidence.
10 vulnerability references · 6 target families
REST, GraphQL, gRPC, WebSocket, and SSE permission parity
Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
4 vulnerability references · 4 target families
Proxy normalization, cache isolation, and request boundaries
Investigate layered HTTP behavior with isolated cache keys and controlled front-end/back-end traffic.
5 vulnerability references · 4 target families
OSS lab: pin, install, prove, reset
Turn an eligible release into a repeatable synthetic environment with preserved versions, realistic controls, and an explicit reset recipe.
17 vulnerability references · 5 target families
Source review: entry point to protected operation
Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
9 vulnerability references · 5 target families
CI and releases: trace untrusted input into privileged work
Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
4 vulnerability references · 6 target families
Dependencies: from advisory match to reachable impact
Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
7 vulnerability references · 6 target families
Libraries and parsers: bounded fuzzing to a minimal reproducer
Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
4 vulnerability references · 1 target families
Cloud IAM: trust, delegation and effective permissions
Prove which principal can act on which resource, including cross-account trust, delegated roles and workload federation.
4 vulnerability references · 3 target families
Object storage, signed URLs and delivery boundaries
Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
7 vulnerability references · 2 target families
Container and Kubernetes isolation
Test RBAC, workload identity, admission, networking and host exposure as separate enforcement layers.
4 vulnerability references · 2 target families
Infrastructure configuration: from repository default to deployed impact
Trace IaC, charts, Compose and image packaging into supported deployments, including exposed services and sensitive artifacts.
5 vulnerability references · 2 target families
DNS, TLS and email trust boundaries
Separate dangling records, transfer/recursion exposure, TLS identity and SMTP relay into controlled protocol tests.
6 vulnerability references · 3 target families
Database, cache, queue and management service boundaries
Move from a reachable socket to a minimal proof of unintended service authority using synthetic records and paired identities.
7 vulnerability references · 1 target families
Android components, intents and deep links
Trace ordinary-app inputs through exported components, URI grants and links to one protected operation.
6 vulnerability references · 1 target families
iOS signing capabilities, links and protected data
Connect entitlements and application groups to actual callers, URL transitions and protected key use.
7 vulnerability references · 2 target families
Client storage, logs, backup and transport trust
Measure where sensitive client state goes, who can retrieve it, and whether transport rejects invalid peers.
3 vulnerability references · 1 target families
Desktop IPC, Electron bridges and native protocols
Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.
3 vulnerability references · 2 target families
Update signatures, rollback and privileged installation
Test the update decision and installation boundary while preserving production signer and privilege assumptions.
7 vulnerability references · 2 target families
AI tools: input trust, execution identity and approvals
Prove when lower-trust content changes a protected tool action, then locate the missing authorization or consent boundary.
4 vulnerability references · 3 target families
RAG isolation: ingestion, retrieval, citations and revocation
Trace document authorization through vector search, generated answers, citation downloads, caches and sharing changes.
4 vulnerability references · 2 target families
Contract state: authorization, callbacks and accounting
Turn protocol promises into explicit invariants and test realistic local operation sequences with independent accounting.
4 vulnerability references · 2 target families
Contract signatures and oracles: context, freshness and units
Test signed-action context and price-consumer assumptions with local keys, mock feeds and explicit negative controls.
4 vulnerability references · 2 target families
Firmware update and boot trust: signed bytes, product binding and rollback
Separate download trust, update authorization, image verification, rollback policy and boot enforcement using local artifacts.
4 vulnerability references · 2 target families
Hardware interfaces: production debug access and protected data
Distinguish diagnostic output from privileged UART, JTAG/SWD and firmware-secret boundary failures on an owned lab unit.
3 vulnerability references · 5 target families
MFA and passkeys: enrollment, proof, replacement, and recovery
Follow each authenticator from account binding to removal, and validate WebAuthn assertions without mistaking client UI or counter behavior for a security guarantee.
5 vulnerability references · 6 target families
OAuth, OIDC, and SAML: transaction binding and token trust
Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
2 vulnerability references · 4 target families
Request values: duplicate parameters, parser conflicts and downstream queries
Trace the value a security layer validates through to the value the application or downstream service actually consumes.
4 vulnerability references · 4 target families
Webhooks and integration events: authenticity, tenant binding and replay
Verify the event signature, provider-to-tenant binding and durable worker effect together across retries and out-of-order delivery.
5 vulnerability references · 2 target families
GitLab pipelines: contribution, job token and runner boundaries
Trace GitLab execution context, included configuration, downstream inputs, job-token permissions and runner reuse using private synthetic fixtures.
7 vulnerability references · 3 target families
Azure and GCP: identity, delegation and storage access
Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
2 vulnerability references · 3 target families
Browser extensions: message authority and document lifetime
Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.
4 vulnerability references · 3 target families
AI state: memory, resumed work, retries and private caches
Test persistent context, task ownership, MCP request-state integrity, duplicate effects and caches across identities and time.
2 vulnerability references · 4 target families
Resource budgets and sensitive business flows
Trace request fan-out, retries, recipient limits and tenant quotas using tiny local limits, recording stubs and measured downstream effects.
How reuse works#
An OSS deployment with an HTTP API uses the same object-authorization procedure as a SaaS target. Source access adds call-path evidence; it does not change the expected permission boundary. Follow the target-specific setup, then the shared module, and return to the playbook to record coverage.