Authentication vulnerability testing in Testing Fundamentals - Build an Automation Script

Test login form for authentication vulnerabilities

Preconditions (2)

Step 1: Open the login page URL in a browser

Step 2: Enter a valid username in the username field

Step 3: Enter an incorrect password in the password field

Step 4: Click the login button

Step 5: Verify that the login fails with an error message

Step 6: Enter a valid username in the username field

Step 7: Leave the password field empty

Step 8: Click the login button

Step 9: Verify that the login fails with an error message

Step 10: Enter a valid username in the username field

Step 11: Enter a SQL injection string "' OR '1'='1" in the password field

Step 12: Click the login button

Step 13: Verify that the login fails and no unauthorized access is granted

Step 14: Enter a valid username in the username field

Step 15: Enter a very long string (e.g., 1000 characters) in the password field

Step 16: Click the login button

Step 17: Verify that the login fails gracefully without crashing the application

✅ Expected Result: The login form should reject invalid credentials, empty passwords, SQL injection attempts, and overly long inputs without granting access or crashing.

Automation Requirements - Selenium with Python

Assertions Needed:

Verify error message is displayed on invalid login

Verify no access is granted on SQL injection input

Verify application does not crash on long input

Best Practices:

Use explicit waits to wait for elements

Use meaningful locators (id or name attributes)

Use assertions to check error messages and page state

Keep test steps clear and modular

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest

class TestAuthenticationVulnerabilities(unittest.TestCase):
    def setUp(self):
        self.driver = webdriver.Chrome()
        self.driver.get('https://example.com/login')
        self.wait = WebDriverWait(self.driver, 10)

    def tearDown(self):
        self.driver.quit()

    def login(self, username, password):
        username_field = self.wait.until(EC.presence_of_element_located((By.ID, 'username')))
        password_field = self.driver.find_element(By.ID, 'password')
        login_button = self.driver.find_element(By.ID, 'loginBtn')

        username_field.clear()
        username_field.send_keys(username)
        password_field.clear()
        password_field.send_keys(password)
        login_button.click()

    def test_invalid_password(self):
        self.login('validUser', 'wrongPass')
        error = self.wait.until(EC.visibility_of_element_located((By.ID, 'errorMsg')))
        self.assertIn('Invalid credentials', error.text)

    def test_empty_password(self):
        self.login('validUser', '')
        error = self.wait.until(EC.visibility_of_element_located((By.ID, 'errorMsg')))
        self.assertIn('Password cannot be empty', error.text)

    def test_sql_injection(self):
        self.login('validUser', "' OR '1'='1")
        error = self.wait.until(EC.visibility_of_element_located((By.ID, 'errorMsg')))
        self.assertIn('Invalid credentials', error.text)
        # Also verify URL did not change to dashboard
        self.assertNotIn('/dashboard', self.driver.current_url)

    def test_long_password(self):
        long_password = 'a' * 1000
        self.login('validUser', long_password)
        error = self.wait.until(EC.visibility_of_element_located((By.ID, 'errorMsg')))
        self.assertTrue(error.is_displayed())
        # Verify page is still responsive
        self.assertIn('/login', self.driver.current_url)

if __name__ == '__main__':
    unittest.main()

The setUp method opens the browser and navigates to the login page before each test.

The login helper method fills the username and password fields and clicks the login button, making tests cleaner.

Each test method covers one vulnerability scenario: invalid password, empty password, SQL injection, and long input.

Explicit waits ensure elements are ready before interacting or asserting.

Assertions check that error messages appear and no unauthorized access occurs.

The tearDown method closes the browser after each test to keep tests isolated.

Common Mistakes - 4 Pitfalls

Using hardcoded sleeps instead of explicit waits

Using brittle XPath locators that break easily

Not clearing input fields before sending keys

Not verifying that unauthorized access is prevented

Bonus Challenge

Now add data-driven testing with 3 different invalid username and password combinations

Show Hint

Practice

1. What is the main goal of authentication vulnerability testing?

easy

A. To ensure only authorized users can access the system

B. To check the system's speed under heavy load

C. To verify the user interface design

D. To test database backup procedures

Solution

1. Step 1: Understand authentication testing purpose

   Authentication testing focuses on verifying that only real, authorized users can access the system.

2. Step 2: Eliminate unrelated options

   Options about speed, UI, or backups do not relate to authentication vulnerabilities.

3. Final Answer:

   To ensure only authorized users can access the system -> Option A

4. Quick Check:

   Authentication goal = authorized access [OK]

Hint: Authentication testing checks who can enter the system [OK]

Common Mistakes:

• Confusing authentication with performance testing
• Thinking authentication tests UI elements
• Mixing authentication with data backup checks

2. Which of the following is a correct way to test for weak password acceptance during authentication?

easy

A. Try logging in with a password like 12345

B. Check if the system allows SQL queries in the username field

C. Test if the login page loads within 2 seconds

D. Verify if the password reset email is sent

Solution

1. Step 1: Identify weak password test

   Testing weak passwords means trying simple, common passwords like '12345' to see if the system accepts them.

2. Step 2: Differentiate from other tests

   Options about SQL injection, performance, or email sending are different security or functionality tests.

3. Final Answer:

   Try logging in with a password like 12345 -> Option A

4. Quick Check:

   Weak password test = simple password try [OK]

Hint: Use simple passwords to check weak password acceptance [OK]

Common Mistakes:

• Confusing weak password test with SQL injection test
• Testing page speed instead of authentication strength
• Mixing password reset with password strength testing

3. Consider this pseudocode for testing login lockout:

attempts = 0
while attempts < 5:
    login('user', 'wrongpass')
    attempts += 1
result = login('user', 'correctpass')

What should result be if the system locks the account after 5 failed attempts?

medium

A. Login successful

B. Account locked error

C. Password reset prompt

D. System crash

Solution

1. Step 1: Understand lockout after failed attempts

   After 5 wrong tries, the system should lock the account to prevent further access.

2. Step 2: Analyze final login attempt

   Even with the correct password, the account is locked, so login should fail with an account locked error.

3. Final Answer:

   Account locked error -> Option B

4. Quick Check:

   Lockout after 5 fails = account locked error [OK]

Hint: After 5 fails, login should block even correct passwords [OK]

Common Mistakes:

• Expecting login success after lockout
• Confusing reset prompt with lockout error
• Assuming system crashes on failed login

4. You wrote this test to check multi-factor authentication (MFA):

login('user', 'correctpass')
// skip MFA step
access = check_access()

Why might this test fail to detect an authentication vulnerability?

medium

A. It uses the wrong username format

B. It checks access before login

C. It tests password reset instead of login

D. It skips the MFA step, so it doesn't test full authentication

Solution

1. Step 1: Identify skipped MFA step

   The test logs in with correct password but skips the MFA step, missing a critical security check.

2. Step 2: Understand impact on vulnerability detection

   Skipping MFA means the test won't catch if MFA is bypassed, leaving a vulnerability undetected.

3. Final Answer:

   It skips the MFA step, so it doesn't test full authentication -> Option D

4. Quick Check:

   Skipping MFA = incomplete authentication test [OK]

Hint: Always include MFA step to test full authentication [OK]

Common Mistakes:

• Ignoring MFA step importance
• Confusing username format with MFA issues
• Mixing login and password reset tests

5. You want to test if the system properly prevents session fixation attacks after login. Which test approach is best?

hard

A. Verify if password reset emails are sent promptly

B. Try logging in with an invalid password multiple times

C. Check if session ID changes after successful login

D. Test if the login page uses HTTPS

Solution

1. Step 1: Understand session fixation attack

   Session fixation means attacker forces a known session ID before login to hijack session.

2. Step 2: Identify test to prevent session fixation

   The system should assign a new session ID after login to prevent fixation.

3. Final Answer:

   Check if session ID changes after successful login -> Option C

4. Quick Check:

   Session fixation test = session ID change after login [OK]

Hint: Session ID must change after login to stop fixation [OK]

Common Mistakes:

• Confusing session fixation with password errors
• Testing unrelated password reset or HTTPS only
• Ignoring session ID behavior after login