0

I've been using Selenium for awhile and I know many testers have compiled lists of standard security compliance types of tests to perform, like are listed here

These fall into a list of tests that are performed on every web site for basic security compliance, a short list here:

  • Form Fields: Visible and Hidden
    • Escape codes
    • SQL Injections
    • Non-ascii, Unicode vs UTF-8
  • URLs
    • Query String Manipulations

etc.

Question: Since these tests are commonly repeated and fairly generic, has anyone compiled a list of Tests created with Selenium that target these well known security compliance related issues?

Some granular extensions based on common security compliance checks like this:

public static class WebDriverComplianceExtensions
{
    public static void InputOneSixty(this IWebDriver driver, By by)
    {
        var input = driver.WaitUntil(d => d.FindElement(by));
        input.SendKeys(" ");
    }
}

And hopefully some sort of intelligent extensions like:

IWebDriver driver = new ChromeDriver();
// some page navigation...
Assert.IsTrue(driver.PerformComplianceCheck(By.Id("FirstNameInputBox")));
1

Selenium is not an ideal tool for this kind of testing. There are existing tools, which will be better suited to the task - Opening a browser, rendering the page and all the associated overhead is wasteful when conducting security testing!

I suggest Burp suite or OWASP ZAP, depending on your full set of use cases and available budget.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.