Selenium Conference 2014 -- Bangalore
•Download as PPTX, PDF•
0 likes•884 views
Presentation in Selenium Conference @ Banagalore
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Similar to Selenium Conference 2014 -- Bangalore
Similar to Selenium Conference 2014 -- Bangalore (20)
Recently uploaded
Recently uploaded (20)
Selenium Conference 2014 -- Bangalore
- 1. Automation in Security Prasanna K, Ketan Soni
- 2. Agenda Typical use of Selenium Information Security How To achieve complete coverage Workflow Injection Attacks Conclusion
- 3. Introductions Prasanna Kanagasabai Pentester @ ThoughtWorks Author of IronSAP Speaker @ various security conferences Proud OSCP Ketan Soni QA @ ThoughtWorks
- 4. Typical use of Selenium UI Automation Cross Browser Testing Could We do more …….
- 5. Information Security Exploratory testing Find Defects Proactive Harming the system One of the most Exciting Jobs
- 6. How To achieve complete coverage Applications are ever increasing Applications Tech stack has become vast Security attacks have become complex Security cannot be compromised Trained resources are finite Solution : Automation
- 7. Workflow Define a Scenario Generate Payload Deliver Payload Match Results for Success / Failure Test Scenario Identify Test Data Execution of Test Scenario’s Validation QA Flow Security Flow
- 8. Workflow -- Example Login without User Credentials Password List Brute force Script Login Success / Failure
- 9. How did we arrive @ Selenium Ajax in Normal “Urllib” Libraries were difficult Selenium could handle Ajax Requests easily.
- 10. Security !!!
- 11. SQL Injection 11 admin adminPass Username Password Submit SELECT * FROM users WHERE username = ‘admin’ AND password = ‘adminPass’
- 12. SQL Injection 12 ’OR 1=1--' BlahBlah Username Password Submit SELECT * FROM users WHERE username = ‘’ OR 1=1 --’’ AND password = ‘BlahBlah’
- 13. SQL Injection 13 ’OR 1=1--' BlahBlah Username Password Submit SELECT * FROM users WHERE username = ‘’ OR 1=1
- 14. DEMO 14
- 15. XSS 15 Search
- 16. XSS 16 Search Hello there friends Search results for “Hello there friends”
- 17. XSS 17 Hello <script>alert(“Hello World)</script> Search there friends Search results for “Hello
- 18. DEMO 18
- 19. Command Injection Ping Host 12.0.0.1 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.044 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.049 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.040 ms --- 127.0.0.1 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.040/0.044/0.049/0.004 ms
- 21. Binary Protocols Binary Json, Protobuff Data is travelling in Mostly HEX Add code to teach tools Presented this plugin @ C0C0N
- 22. DEMO 22
- 23. What More … Cookiejar – for Cookie Management Suds – Web services Automation Lxml – Similar to BS4 Json – To work with Json pyAmf – AMF Protocol SimpleHTTPServer – Simplest Webserver (python –m SimpleHTTPServer 9080) Twisted
- 24. Conclusion Helps in larger code coverage Saving time Careful calibration is needed Cant fully replace manual testing
- 25. Questions ?? shifu@thoughtworks.com Ketan.soni@thoughtworks.com @prasannain @ketan_soni