3

I must test a website for insufficient authentication. Use case:

  • I go to website which I'll testing.
  • Log in as admin(user with the highest permissions/privileges)
  • Run some tool.
  • Tool has login and password for regular user which doesnt has permissions that admin has.
  • Tool intercepts requests that I call manually as admin via browser
  • Then tool remove cookies from request which it intercepts and substitutes it with credentials for regular user
  • Then tool passes request but with cookies of regular user and shows response of request in the other browser or somewhere else.

Im looking this kind of tool. Can anyone recommend me one?

Improve this question

2 Answers 2

Reset to default
5

I believe Fiddler could be used to assist in the scenario you provided. Check it out at http://www.fiddler2.com/fiddler2/

Improve this answer
1
  • The fiddler API is nice too if you want to automate this scenario.
    – Sam Woods
    Commented Aug 1, 2012 at 19:45
1

I would recommend Selenium or Watir. Both automate browsers. You can create a script that will take username and password as arguments. The script does what needs to be done as admin and regular user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.