Practical Security Automation and Testing

Step 1: Selenium script with DDT

Here is the fuzz data we prepared for the username and password input. The sqli.csv file defined two columns of data, which are username and password:

username,passworda,a)%20or%20('x'='x,''%20or%201=1,' 1=1

The key highlight of the SignIn_DDT_NodeGoat.py Selenium Python script is the adoption of the DDT module. The code in bold is mostly related how to read each value from sqli.csv and replace them with the username and password parameters for every HTTP request:

# -*- coding: utf-8 -*-# SignIn_DDT_NodeGoat.pyfrom selenium import webdriverfrom selenium.webdriver.common.by import Byfrom selenium.webdriver.common.keys import Keysfrom selenium.webdriver.support.ui import Selectfrom ddt import ddt, data, unpack ...