Security testing basics in Testing Fundamentals - Build an Automation Script

Verify login form resists SQL Injection attack

Preconditions (1)

Step 1: Enter 'admin' in the username field

Step 2: Enter "' OR '1'='1" in the password field

Step 3: Click the Login button

✅ Expected Result: Login should fail and an error message 'Invalid username or password' should be displayed

Automation Requirements - Selenium with Python

Assertions Needed:

Verify the error message 'Invalid username or password' is displayed

Verify the URL remains on the login page after the attempt

Best Practices:

Use explicit waits to wait for elements to be visible

Use descriptive locators like By.ID or By.NAME

Avoid hardcoded sleeps

Use Page Object Model to separate page structure from test logic

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC

class LoginPage:
    def __init__(self, driver):
        self.driver = driver
        self.username_input = (By.ID, 'username')
        self.password_input = (By.ID, 'password')
        self.login_button = (By.ID, 'loginBtn')
        self.error_message = (By.ID, 'errorMsg')

    def enter_username(self, username):
        WebDriverWait(self.driver, 10).until(EC.visibility_of_element_located(self.username_input)).clear()
        self.driver.find_element(*self.username_input).send_keys(username)

    def enter_password(self, password):
        WebDriverWait(self.driver, 10).until(EC.visibility_of_element_located(self.password_input)).clear()
        self.driver.find_element(*self.password_input).send_keys(password)

    def click_login(self):
        WebDriverWait(self.driver, 10).until(EC.element_to_be_clickable(self.login_button)).click()

    def get_error_message(self):
        return WebDriverWait(self.driver, 10).until(EC.visibility_of_element_located(self.error_message)).text


def test_sql_injection_login():
    driver = webdriver.Chrome()
    driver.get('https://example.com/login')

    login_page = LoginPage(driver)
    login_page.enter_username('admin')
    login_page.enter_password("' OR '1'='1")
    login_page.click_login()

    error_text = login_page.get_error_message()
    assert error_text == 'Invalid username or password', f"Expected error message not found, got: {error_text}"

    assert driver.current_url == 'https://example.com/login', "URL changed after failed login attempt"

    driver.quit()

if __name__ == '__main__':
    test_sql_injection_login()

This test script uses Selenium with Python to automate the manual test case.

We define a LoginPage class to hold locators and actions, following the Page Object Model. This keeps the test clean and easy to maintain.

Explicit waits ensure the script waits for elements to be ready before interacting, avoiding flaky tests.

The test function test_sql_injection_login opens the login page, enters the username 'admin' and the SQL injection string in the password field, then clicks login.

It asserts that the error message is exactly 'Invalid username or password' and that the URL remains on the login page, confirming the injection attempt failed.

Finally, the browser closes cleanly.

Common Mistakes - 4 Pitfalls

Using time.sleep() instead of explicit waits

Using brittle XPath locators that rely on full paths

Not verifying the error message text

Hardcoding URLs without verifying current URL after action

Bonus Challenge

Now add data-driven testing with 3 different SQL injection payloads in the password field

Show Hint

Practice

1. What is the main goal of security testing in software development?

easy

A. To test if the software looks good on all devices

B. To check if the software works fast enough

C. To verify the software's spelling and grammar

D. To find and fix weaknesses that could let attackers harm the software

Solution

1. Step 1: Understand the purpose of security testing

   Security testing aims to find weak points that attackers could exploit.

2. Step 2: Compare options to the goal

   Only To find and fix weaknesses that could let attackers harm the software talks about finding and fixing weaknesses to protect software.

3. Final Answer:

   To find and fix weaknesses that could let attackers harm the software -> Option D

4. Quick Check:

   Security testing = find weaknesses [OK]

Hint: Security testing finds weak spots to protect software [OK]

Common Mistakes:

• Confusing security testing with performance testing
• Thinking security testing checks UI design
• Mixing security testing with spell checking

2. Which of the following is the correct way to describe a security test case?

easy

A. Check if the login page accepts only valid usernames and passwords

B. Check if the page loads within 2 seconds

C. Check if the font size is consistent across pages

D. Check if the software supports multiple languages

Solution

1. Step 1: Identify what a security test case checks

   Security test cases verify protection against unauthorized access or attacks.

2. Step 2: Match options to security focus

   Check if the login page accepts only valid usernames and passwords tests login validation, which is a security check; others test performance, UI, or localization.

3. Final Answer:

   Check if the login page accepts only valid usernames and passwords -> Option A

4. Quick Check:

   Security test case = validate access control [OK]

Hint: Security tests check access and data protection [OK]

Common Mistakes:

• Choosing performance or UI tests as security tests
• Ignoring the focus on unauthorized access
• Confusing localization with security

3. Consider this simple security test code snippet in Python:

def test_password_length(password):
    return len(password) >= 8

result = test_password_length('pass123')
print(result)

What will be the output when this code runs?

medium

A. True

B. False

C. Error

D. None

Solution

1. Step 1: Understand the function logic

   The function returns True if password length is 8 or more, else False.

2. Step 2: Check the input password length

   'pass123' has 7 characters, which is less than 8, so function returns False.

3. Final Answer:

   False -> Option B

4. Quick Check:

   Password length 7 < 8 = False [OK]

Hint: Count characters to check length condition [OK]

Common Mistakes:

• Assuming 'pass123' length is 8
• Confusing True/False return values
• Expecting an error due to missing input validation

4. You have this test code to check if a user input is safe:

def is_safe_input(user_input):
    if ''))

What is the problem with this test?

medium

A. It does not print anything

B. It will cause a syntax error because of quotes

C. It only checks for exact '<script>' but misses other attack forms

D. It always returns True regardless of input

Solution

1. Step 1: Analyze the input check logic

   The function looks only for the exact string '<script>' in input.

2. Step 2: Consider other attack variations

   Attackers can use variations like uppercase, spaces, or encoded forms that this check misses.

3. Final Answer:

   It only checks for exact '<script>' but misses other attack forms -> Option C

4. Quick Check:

   Exact string check misses variants [OK]

Hint: Check for all attack patterns, not just exact strings [OK]

Common Mistakes:

• Thinking the code has syntax errors
• Assuming it blocks all script attacks
• Believing it never returns False

5. You want to test a web app for SQL injection vulnerabilities. Which approach best combines manual and automated security testing?

hard

A. Use an automated scanner to find injection points, then manually try custom payloads to confirm and explore

B. Only run automated scanners and trust their results

C. Manually type random SQL commands without tools

D. Ignore SQL injection and focus on UI bugs

Solution

1. Step 1: Understand the strengths of automated and manual testing

   Automated tools quickly find many injection points; manual tests explore complex cases.

2. Step 2: Evaluate options for best practice

   Use an automated scanner to find injection points, then manually try custom payloads to confirm and explore combines both methods effectively; others ignore manual checks or focus on unrelated issues.

3. Final Answer:

   Use an automated scanner to find injection points, then manually try custom payloads to confirm and explore -> Option A

4. Quick Check:

   Combine tools + manual tests for best security [OK]

Hint: Combine tools and manual tests for thorough security [OK]

Common Mistakes:

• Relying only on automated tools
• Skipping manual testing
• Ignoring SQL injection risks