Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I must test a website for insufficient authentication. Use case:

  • I go to website which I'll testing.
  • Log in as admin(user with the highest permissions/privileges)
  • Run some tool.
  • Tool has login and password for regular user which doesnt has permissions that admin has.
  • Tool intercepts requests that I call manually as admin via browser
  • Then tool remove cookies from request which it intercepts and substitutes it with credentials for regular user
  • Then tool passes request but with cookies of regular user and shows response of request in the other browser or somewhere else.

Im looking this kind of tool. Can anyone recommend me one?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

I believe Fiddler could be used to assist in the scenario you provided. Check it out at http://www.fiddler2.com/fiddler2/

share|improve this answer
    
The fiddler API is nice too if you want to automate this scenario. –  Sam Woods Aug 1 '12 at 19:45
add comment

I would recommend Selenium or Watir. Both automate browsers. You can create a script that will take username and password as arguments. The script does what needs to be done as admin and regular user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.