Skip to content

README.md

Latest commit

 

History

History
234 lines (164 loc) · 5.67 KB

README.md

File metadata and controls

234 lines (164 loc) · 5.67 KB

Selenium Security Testing Framework

A comprehensive Java-based security testing framework using Selenium WebDriver to automate OWASP Top 10 vulnerability testing.

🚀 Features

  • SQL Injection Testing -- Tests login forms and input fields for SQL injection vulnerabilities.
  • XSS Testing -- Cross-Site Scripting vulnerability detection.
  • Authentication Testing -- Tests for authentication bypass and broken access control.
  • Session Management Testing -- Session fixation, timeout, and cookie security tests.
  • Sensitive Data Exposure Testing -- HTTPS enforcement, password masking, etc.
  • CSRF Testing -- Cross-Site Request Forgery token validation.
  • OWASP ZAP Integration -- Optional integration with OWASP ZAP proxy for deeper scanning

📁 Project Structure

SecurityTestFramework/
│── pom.xml
│── README.md
│── src/
│   ├── main/java/com/security/
│   │   ├── config/
│   │   │   └── ConfigReader.java
│   │   ├── pages/
│   │   │   ├── BasePage.java
│   │   │   └── LoginPage.java
│   │   ├── utils/
│   │   │   ├── DriverFactory.java
│   │   │   ├── SecurityPayloads.java
│   │   │   ├── ReportManager.java
│   │   │   └── ZapIntegration.java
│   ├── test/java/com/security/tests/
│   │   ├── BaseTest.java
│   │   ├── SqlInjectionTest.java
│   │   ├── XssTest.java
│   │   ├── AuthenticationTest.java
│   │   ├── SessionManagementTest.java
│   │   ├── SensitiveDataExposureTest.java
│   │   └── CsrfTest.java
│   └── test/resources/
│       ├── config.properties
│       ├── log4j2.xml
│       └── payloads/
│           ├── sql_injection_payloads.txt
│           └── xss_payloads.txt
│── testng.xml

📋 Prerequisites

  • Java 17 or higher
  • Maven 3.6+
  • Chrome or Firefox browser
  • (Optional) OWASP ZAP for proxy-based testing

⚙️ Setup

1️⃣ Clone or Copy the Project

git clone <repository-url>

2️⃣ Configure Target Application

Edit:

src/test/resources/config.properties

base.url=https://your-target-app.com
browser=chrome
headless=false

3️⃣ Install Dependencies

mvn clean install -DskipTests

▶️ Running Tests

Run All Security Tests

mvn test

Run Specific Test Class

mvn test -Dtest=SqlInjectionTest
mvn test -Dtest=XssTest
mvn test -Dtest=AuthenticationTest

Run with Specific Browser

mvn test -Dbrowser=firefox

Run in Headless Mode

mvn test -Dheadless=true

🧪 Test Categories

1️⃣ SQL Injection Tests

  • Login form injection
  • Search field injection
  • URL parameter injection
  • Error-based injection detection

2️⃣ XSS Tests

  • Reflected XSS
  • Stored XSS
  • DOM-based XSS
  • Input sanitization verification

3️⃣ Authentication Tests

  • Direct URL access without login
  • Session token validation
  • Password policy enforcement
  • Account lockout testing

4️⃣ Session Management Tests

  • Session ID regeneration after login
  • Session timeout verification
  • Cookie security flags (HttpOnly, Secure)
  • Concurrent session handling

5️⃣ Sensitive Data Exposure Tests

  • HTTPS enforcement
  • Password field masking
  • Sensitive data in URL parameters
  • Autocomplete disabled for sensitive fields

6️⃣ CSRF Tests

  • CSRF token presence
  • Token validation on form submission

🔐 OWASP ZAP Integration

1️⃣ Start OWASP ZAP in Daemon Mode

zap.sh -daemon -port 8080

2️⃣ Enable ZAP in config.properties

zap.enabled=true
zap.host=localhost
zap.port=8080

3️⃣ Run Tests

Traffic will be proxied through ZAP for additional scanning.

📊 Reports

Test reports are generated in:

  • ExtentReports:
    test-output/SecurityTestReport.html

  • TestNG Reports:
    target/surefire-reports/

🔧 Customization

➕ Adding Custom Payloads

Add payloads to:

src/test/resources/payloads/
  • sql_injection_payloads.txt
  • xss_payloads.txt

➕ Adding New Tests

  1. Create a new test class extending BaseTest
  2. Use the @Test annotation with appropriate groups
  3. Add it to testng.xml if required

⚠️ Security Considerations

  • Only test applications you have permission to test
  • Use in controlled environments (dev/staging)
  • Never test production systems without explicit authorization
  • Review and comply with your organization's security testing policies

🚀 Built for DevSecOps & Security Automation Excellence