---
name: application-security-pentesting
metadata:
  category: Cybersecurity and Penetration Testing
description: Production Application Security (AppSec) standards, OWASP Top 10 vulnerability remediation, SAST/DAST pipeline integration, secure code review, threat modeling, and defensive security posture.
compatibility: OWASP ZAP, Burp Suite, Semgrep, SonarQube, Python / Node.js / Go
---

# Application Security & Penetration Testing Remediation

## Overview
This skill provides standards and methodological frameworks for Application Security (AppSec) engineering, threat modeling, vulnerability assessment, and remediation of OWASP Top 10 vulnerabilities. It covers secure code review, static and dynamic analysis (SAST/DAST) integration, security headers configuration, and defensive controls.

---

## 1. Core Application Security Principles

1. **Defense-in-Depth Architecture**: Never rely on a single defensive boundary. Enforce security controls at every application layer (Network, Gateway, Application Code, Database).
2. **Strict Input Sanitization & Parameterization**: Treat all user inputs as untrusted. Enforce parameterized queries (Prepared Statements) for database access to eliminate SQL injection, and context-aware HTML encoding to prevent XSS.
3. **Principle of Least Privilege (PoLP)**: Grant minimum required API permissions, database permissions, and system rights to microservices and database users.
4. **Secure Authentication & Session Lifecycle**: Enforce multi-factor authentication (MFA), secure HTTP-Only SameSite cookies, session rotation on privilege escalation, and strong password hashing algorithms (Argon2id, bcrypt).
5. **Continuous Security Automation (DevSecOps)**: Integrate Static Application Security Testing (SAST), Dependency Scanning (SCA), and Dynamic Application Security Testing (DAST) into CI/CD pipelines.

---

## 2. Threat Modeling & Vulnerability Remediation Lifecycle

```
[ Application Codebase ]
       │
       ├──▶ [ SAST Scanner (Semgrep / SonarQube) ] ──(Code Flaws)
       ├──▶ [ SCA Scanner (Trivy / Dependabot) ] ────(Vulnerable Dependencies)
       ▼
[ Security Audit Engine ]
       │
       │ 1. Triaging & Threat Modeling (STRIDE / DREAD)
       ▼
[ Security Remediation Pipeline ]
       │ 2. Apply Parameterization & Sanitization
       ▼
[ DAST Verification (OWASP ZAP) ] ──▶ [ Hardened Production Deployment ]
```

| Vulnerability Class | Root Cause | Primary Defensive Remediation |
| :--- | :--- | :--- |
| **SQL Injection (SQLi)** | String concatenation in database queries | Parameterized Prepared Statements |
| **Cross-Site Scripting (XSS)** | Unescaped output rendered in HTML context | Content Security Policy (CSP) & DOM Encoding |
| **Broken Access Control** | Missing authorization checks on record IDs | Server-side RBAC / ABAC evaluation |
| **CSRF** | Cross-origin request forgery on cookie auth | Anti-CSRF Tokens & `SameSite=Strict` cookies |
| **Insecure Direct Object Reference (IDOR)** | Exposing raw database primary keys | Tenant-scoped database queries & UUIDs |

---

## 3. Anti-Patterns & Common Vulnerabilities

* **Anti-Pattern: String Concatenation in SQL Statements (`"SELECT * FROM users WHERE email = '" + input + "'"` )**
  * *Risk*: High vulnerability to SQL Injection, leading to unauthorized database dump or remote code execution.
  * *Remediation*: Use ORMs or parameterized query placeholders (`SELECT * FROM users WHERE email = $1`).
* **Anti-Pattern: Disabling TLS Certificate Validation (`rejectUnauthorized: false` or `verify=False`)**
  * *Risk*: Vulnerable to Man-in-the-Middle (MitM) traffic interception and credential theft.
  * *Remediation*: Enforce strict CA certificate validation across all HTTP client stubs.
* **Anti-Pattern: Storing Plaintext Passwords or Using Weak Hashes (MD5 / SHA1)**
  * *Risk*: Instant offline dictionary credential crack on database breach.
  * *Remediation*: Hash credentials with Argon2id or bcrypt with appropriate cost factors.

---

## 4. Production Defensive Security Code Snippets

### A. Python Secure Database Access & Input Parameterization (`secure_db.py`)

```python
#!/usr/bin/env python3
"""
Production Secure Database Access Layer using Parameterized Queries & Argon2id Hashing
"""

import os
import psycopg2
from psycopg2.extras import RealDictCursor
from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

ph = PasswordHasher()

class SecureUserRepository:
    def __init__(self, db_url: str):
        self.db_url = db_url

    def get_connection(self):
        # Enforce SSL/TLS for database connections
        return psycopg2.connect(self.db_url, sslmode='verify-full', cursor_factory=RealDictCursor)

    def register_user(self, email: str, raw_password: str) -> dict:
        """
        Hashes password securely with Argon2id and inserts user via Parameterized Query.
        """
        password_hash = ph.hash(raw_password)

        query = """
            INSERT INTO users (email, password_hash, created_at)
            VALUES (%s, %s, NOW())
            RETURNING id, email, created_at;
        """
        with self.get_connection() as conn:
            with conn.cursor() as cursor:
                cursor.execute(query, (email, password_hash))
                user = cursor.fetchone()
                conn.commit()
                return dict(user)

    def authenticate_user(self, email: str, candidate_password: str) -> bool:
        """
        Validates login credentials against secure hash, immune to SQL Injection.
        """
        query = "SELECT password_hash FROM users WHERE email = %s;"
        with self.get_connection() as conn:
            with conn.cursor() as cursor:
                cursor.execute(query, (email,))
                record = cursor.fetchone()
                if not record:
                    return False

                try:
                    return ph.verify(record['password_hash'], candidate_password)
                except VerifyMismatchError:
                    return False
```

---

### B. Node.js Express Hardened Security Middleware (`security_headers.js`)

```javascript
import express from 'express';
import helmet from 'helmet';
import rateLimit from 'express-rate-limit';

const app = express();

// 1. Apply Helmet to set robust HTTP Security Headers
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://trusted-cdn.com"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'"],
      fontSrc: ["'self'"],
      objectSrc: ["'none'"],
      upgradeInsecureRequests: [],
    },
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
}));

// 2. Enforce Strict Rate Limiting to prevent brute-force attacks
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 429, error: 'Too many requests, please try again later.' }
});

app.use('/api/', apiLimiter);

// 3. Secure Cookie Configuration for Session Tokens
app.use((req, res, next) => {
  res.cookie('session', 'xyz123', {
    httpOnly: true, // Prevents XSS cookie theft
    secure: true,   // Requires HTTPS
    sameSite: 'strict', // Prevents CSRF
    maxAge: 3600000
  });
  next();
});

app.get('/api/health', (req, res) => res.json({ status: 'SECURE_OK' }));

app.listen(8080, () => console.log('Secure server listening on port 8080'));
```