from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest
import requests
class TestOWASPTop10(unittest.TestCase):
def setUp(self):
self.driver = webdriver.Chrome()
self.wait = WebDriverWait(self.driver, 10)
self.base_url = "https://example.com" # Replace with actual URL
def test_sql_injection(self):
self.driver.get(f"{self.base_url}/login")
username = self.wait.until(EC.presence_of_element_located((By.ID, "username")))
password = self.driver.find_element(By.ID, "password")
login_button = self.driver.find_element(By.ID, "loginBtn")
# Attempt SQL injection payload
username.clear()
username.send_keys("' OR '1'='1")
password.clear()
password.send_keys("password")
login_button.click()
# Verify login failed or input sanitized
error_msg = self.wait.until(EC.presence_of_element_located((By.ID, "errorMessage")))
self.assertIn("Invalid", error_msg.text, "SQL Injection should not succeed")
def test_xss(self):
self.driver.get(f"{self.base_url}/comment")
comment_box = self.wait.until(EC.presence_of_element_located((By.ID, "commentBox")))
submit_btn = self.driver.find_element(By.ID, "submitComment")
# Attempt XSS payload
xss_payload = "<script>alert('XSS')</script>"
comment_box.clear()
comment_box.send_keys(xss_payload)
submit_btn.click()
# Verify alert does not appear and input is sanitized
page_source = self.driver.page_source
self.assertNotIn(xss_payload, page_source, "XSS payload should be sanitized")
def test_https_used(self):
self.driver.get(self.base_url)
current_url = self.driver.current_url
self.assertTrue(current_url.startswith("https://"), "Site should use HTTPS")
def test_unauthorized_access(self):
self.driver.get(f"{self.base_url}/admin")
# Should redirect to login or show access denied
self.assertTrue(
"login" in self.driver.current_url or
"access denied" in self.driver.page_source.lower(),
"Unauthorized access should be blocked"
)
def test_security_headers(self):
response = requests.get(self.base_url)
headers = response.headers
self.assertIn("Content-Security-Policy", headers, "CSP header should be present")
self.assertIn("X-Frame-Options", headers, "X-Frame-Options header should be present")
def test_sensitive_data_not_exposed(self):
self.driver.get(f"{self.base_url}/error")
page_source = self.driver.page_source.lower()
self.assertNotIn("password", page_source, "Passwords should not be visible in error messages")
def tearDown(self):
self.driver.quit()
if __name__ == '__main__':
unittest.main()This test script uses Selenium with Python's unittest framework to automate checks for OWASP Top 10 security risks.
setUp: Initializes the browser and sets the base URL.
test_sql_injection: Tries a common SQL injection string in the login username field and asserts that login fails with an error message.
test_xss: Inputs a script tag in a comment box and verifies the script does not appear in the page source, meaning it is sanitized.
test_https_used: Checks that the site URL starts with https:// to ensure secure communication.
test_unauthorized_access: Attempts to access a restricted admin page without login and verifies redirection or access denial.
test_security_headers: Uses requests library to check HTTP response headers for security headers like Content-Security-Policy and X-Frame-Options.
test_sensitive_data_not_exposed: Checks error pages do not show sensitive data like passwords.
tearDown: Closes the browser after tests.
Explicit waits ensure elements are loaded before interaction. Assertions clearly check expected security behavior. This structure follows best practices for maintainable and reliable tests.
