3

I must test a website for insufficient authentication. Use case:

  • I go to website which I'll testing.
  • Log in as admin(user with the highest permissions/privileges)
  • Run some tool.
  • Tool has login and password for regular user which doesnt has permissions that admin has.
  • Tool intercepts requests that I call manually as admin via browser
  • Then tool remove cookies from request which it intercepts and substitutes it with credentials for regular user
  • Then tool passes request but with cookies of regular user and shows response of request in the other browser or somewhere else.

Im looking this kind of tool. Can anyone recommend me one?

5

I believe Fiddler could be used to assist in the scenario you provided. Check it out at http://www.fiddler2.com/fiddler2/

  • The fiddler API is nice too if you want to automate this scenario. – Sam Woods Aug 1 '12 at 19:45
1

I would recommend Selenium or Watir. Both automate browsers. You can create a script that will take username and password as arguments. The script does what needs to be done as admin and regular user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.