Practical Security Automation and Testing

Testing scenarios

After user sign-in, particularly in step 6, we will be using JMeter to send HTTP requests with FuzzDB security loads through the OWASP ZAP proxy to the target testing website, NodeGoat.

The testing steps are as follows:

1. Sign in to NodeGoat with the username User1 and password User1_123
2. Visit the contributions page
3. Visit the allocations page
4. Visit the memos page
5. Visit the profile page
6. Input the security payloads for SQL and command injection testing on the profile update page
7. Log out
8. Generate the security reports in OWASP ZAP

During these steps, OWASP ZAP will be used to analyze the HTTP request/response traffic to identify potential security issues. The general steps to complete the automation testing will be as follows: ...