By Dan Morrill
Expert Author
Article Date: 2008-10-30
One of the hardest things to do is build out automated test cases for testing the security of your web server. Building out test harnesses is a pain to do, but something that needs to be done not just to stress your web server, but to check on conditionals and security flaws or even not called API strings within the confines of the web server.
Selenium is a new Firefox plug-in that will help you build out test cases by running through the test case in your browser, and then having the plug in record your actions for dumping into a test case later on. The good part is that as you do your security scanning, you can use this product to build out a number of repeatable test harnesses looking for common security flaws in your web app. There is an excellent Google Education channel talk on this right here.
With Selenium now a Firefox plug-in, this will automate your test harnesses in the longer run with the more common body of tests that you do and how they build up in the repository that you use for common tests. There are tests that you should always run, by adding common security tests, for cross site scripting, for CSRF, for bad API calls, bad limit calls, calls that are in the API but never used in the actual web page, you can automated much of your security testing, and move the common tests off to the testing group.
This is a very much so needed process and tool for security engineers who are doing web page hacking. Worth checking out, much of the Selenium site is not functioning today as they are rebuilding it, but there are tons of good videos, good tips on how to use the tool, and a great two minute overview movie of the product.
Comments About the Author: Dan Morrill runs Techwag, a site all about his views on social media, education, technology, and some of the more interesting things that happen on the internet. He works at CityU of Seattle as the Program Director for the Computer Science, Information Systems and Information Security educational programs.
