Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I must test a website for insufficient authentication. Use case:

  • I go to website which I'll testing.
  • Log in as admin(user with the highest permissions/privileges)
  • Run some tool.
  • Tool has login and password for regular user which doesnt has permissions that admin has.
  • Tool intercepts requests that I call manually as admin via browser
  • Then tool remove cookies from request which it intercepts and substitutes it with credentials for regular user
  • Then tool passes request but with cookies of regular user and shows response of request in the other browser or somewhere else.

Im looking this kind of tool. Can anyone recommend me one?

share|improve this question
up vote 5 down vote accepted

I believe Fiddler could be used to assist in the scenario you provided. Check it out at

share|improve this answer
The fiddler API is nice too if you want to automate this scenario. – Sam Woods Aug 1 '12 at 19:45

I would recommend Selenium or Watir. Both automate browsers. You can create a script that will take username and password as arguments. The script does what needs to be done as admin and regular user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.