This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Appendix A: Testing Tools"

From OWASP
Jump to: navigation, search
(→‎Other Tools)
(→‎=Open Source Tools)
Line 94: Line 94:
 
==Acceptance Testing Tools==
 
==Acceptance Testing Tools==
 
Acceptance testing tools are used validate the functionality of web applications.  Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases.  Most, if not all, can be adapted to perform security specific tests in addition to functional tests.
 
Acceptance testing tools are used validate the functionality of web applications.  Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases.  Most, if not all, can be adapted to perform security specific tests in addition to functional tests.
−
===Open Source Tools==
+
===Open Source Tools===
 
* WATIR - http://wtr.rubyforge.org/ - A Ruby based web testing framework that provides an interface into Internet Explorer.  Windows only.
 
* WATIR - http://wtr.rubyforge.org/ - A Ruby based web testing framework that provides an interface into Internet Explorer.  Windows only.
 
* HtmlUnit - http://htmlunit.sourceforge.net/ - A Java and JUnit based framework that uses the Apache HttpClient as the transport.  Very robust and configurable and is used as the engine for a number of other testing tools.
 
* HtmlUnit - http://htmlunit.sourceforge.net/ - A Java and JUnit based framework that uses the Apache HttpClient as the transport.  Very robust and configurable and is used as the engine for a number of other testing tools.

Revision as of 12:24, 27 November 2006

[Up]
OWASP Testing Guide v2 Table of Contents


Open Source Black Box Testing tools

  • OWASP CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project
    • CAL9000 is a collection of browser-based tools that enable more effective and efficient manual testing efforts. Includes an XSS Attack Library, Character Encoder/Decoder, HTTP Request Generator and Response Evaluator, Testing Checklist, Automated Attack Editor and much more.

Testing for specific vulnerabilities

Testing AJAX

Testing for SQL Injection

Testing Oracle

Testing SSL

Testing for Brute Force Password

Testing for HTTP Methods

Testing Buffer Overflow

Fuzzer

Googling

Commercial Black Box Testing tools

Source Code Analyzers

Open Source / Freeware


Commercial

Acceptance Testing Tools

Acceptance testing tools are used validate the functionality of web applications. Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases. Most, if not all, can be adapted to perform security specific tests in addition to functional tests.

Open Source Tools

  • WATIR - http://wtr.rubyforge.org/ - A Ruby based web testing framework that provides an interface into Internet Explorer. Windows only.
  • HtmlUnit - http://htmlunit.sourceforge.net/ - A Java and JUnit based framework that uses the Apache HttpClient as the transport. Very robust and configurable and is used as the engine for a number of other testing tools.
  • jWebUnit - http://jwebunit.sourceforge.net/ - A Java based meta-framework that uses htmlunit or selenium as the testing engine.
  • Canoo Webtest - http://webtest.canoo.com/ - An XML based testing tool that provides a facade on top of htmlunit. No coding is necessary as the tests are completely specified in XML. There is the option of scripting some elements in Groovy if XML does not suffice. Very actively maintained.
  • HttpUnit - http://httpunit.sourceforge.net/ - One of the first web testing frameworks, suffers from using the native JDK provided HTTP transport, which can be a bit limiting for security testing.
  • Watij - http://watij.com - A Java implementation of WATIR. Windows only because it uses IE for it's tests (Mozilla integration is in the works).
  • Solex - http://solex.sourceforge.net/ - An Eclipse plugin that provides a graphical tool to record HTTP sessions and make assertions based on the results.
  • Selenium - http://www.openqa.org/selenium/ - JavaScript based testing framework, cross-platform and provides a GUI for creating tests. Mature and popular tool, but the use of JavaScript could hamper certain security tests.

Other Tools

Runtime Analysis

Binary Analysis

Requirements Management

Site Mirroring


OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents

Retrieved from "https://wiki.owasp.org/index.php?title=Appendix_A:_Testing_Tools&oldid=13736"