RE: web application testing framework

["Dan Cornell" <dan () denimgroup com>]

We use WATIR (Web Application Tests In Ruby) <http://wtr.rubyforge.org/> rather than Selenium and have had really good 
luck.  This is helpful both for general automated integration testing as well as positive testing for security.  It 
actually drives an Internet Explorer browser so all of the JavaScript and whatnot execute as they would for a normal 
user.  We have seen some reliability problems when we run it in "fast" mode or if we don't have it drive a visual 
browser on the screen.  In normal mode, however, it has been pretty stable.  We have only used it on Windows so I am 
not sure if it will drive Mozilla on Linux.

For negative testing we tend to use one of the Perl HTTP libraries.  This lets us send "malicious" inputs where we need 
to bypass JavaScript validation on the client side.  I'm not sure which we have been using most recently but I can 
check later today.  There are a couple available that allow you to run an HTTP session that will keep track of session 
cookies, etc.  This lets you set up your application session and navigate to wherever you are testing.  You can then 
modify the request before it goes out and add the injection payload, modified cookies, etc and search through the 
response HTML to see if the "attack" worked.

We use these in combination often when we are doing security remediation to set up a baseline of existing behavior 
(both good and bad) so we have something to compare the remediated codebase to.  When we start the positive tests pass 
and the negative tests fail.  When we are finished all tests should pass.

Hope this helps.

Thanks,

Dan


-----Original Message-----
From: Serg Belokamen [mailto:serg.belokamen () gmail com]
Sent: Tue 9/13/2005 2:11 AM
To: webappsec () lists securityfocus com
Subject: web application testing framework
 
Hi All, 

   Does any one know or aware of any web application testing
frameworks? I would prefer something along the lines of Selenium
(http://selenium.thoughtworks.com/index.html) and open source.
Preferably usable from both Linux and Windows, one of the OS mentioned
would do as well, but both would be even better.

   Thanks,
      Serg