Backend Security Testing — Automating Security Testing for Backend APIs

// OWASP ZAP API scanning
const ZAPClient = require('zap-client');

async function runSecurityScan(baseUrl) {
  const zap = new ZAPClient({ apiKey: process.env.ZAP_API_KEY, proxy: { host: 'localhost', port: 8080 } });

  // Spider the site
  await zap.spider.scan(baseUrl);
  await zap.spider.waitForCompletion(baseUrl);

  // Active scan
  await zap.ascan.scan(baseUrl);
  await zap.ascan.waitForCompletion(baseUrl);

  // Get alerts
  const alerts = await zap.core.alerts({ baseUrl });
  const summary = {
    high: alerts.filter(a => a.risk === 'High').length,
    medium: alerts.filter(a => a.risk === 'Medium').length,
    low: alerts.filter(a => a.risk === 'Low').length,
    informational: alerts.filter(a => a.risk === 'Informational').length,
    details: alerts
  };

  return summary;
}

// API fuzzing
function generateFuzzingPayloads() {
  return [
    { name: 'SQL Injection', payloads: ["' OR '1'='1", "'; DROP TABLE scans; --"] },
    { name: 'XSS', payloads: ['<script>alert(1)</script>', '<img src=x onerror=alert(1)>'] },
    { name: 'Path Traversal', payloads: ['../../../etc/passwd', '..\\windows\\system32'] },
    { name: 'NoSQL Injection', payloads: ['{"$gt": ""}', '{"$ne": null}'] },
    { name: 'Command Injection', payloads: ['; ls -la', '| cat /etc/passwd', '$(whoami)'] },
    { name: 'SSRF', payloads: ['http://169.254.169.254/latest/meta-data/', 'http://localhost:9200'] },
    { name: 'Mass Assignment', payloads: ['{"role":"admin"}', '{"isAdmin":true}'] }
  ];
}

// Security test suite
describe('API Security Tests', () => {
  const payloads = generateFuzzingPayloads();

  payloads.forEach(({ name, payloads: testPayloads }) => {
    describe(name, () => {
      testPayloads.forEach(payload => {
        it(`should reject: ${payload}`, async () => {
          const response = await request(app)
            .post('/api/scans')
            .set('Authorization', `Bearer ${validToken}`)
            .send({ fileName: payload, fileContent: 'dGVzdA==' });

          expect(response.status).toBe(400);
        });
      });
    });
  });
});

// CI/CD integration
// package.json
// "security:scan": "zap-cli quick-scan --self-contained --start-options '-config api.key=12345' http://localhost:3000"