Security testing tools overview in Testing Fundamentals - Build an Automation Script

Verify basic security scan on a web application using OWASP ZAP

Preconditions (2)

Step 1: Open OWASP ZAP application

Step 2: Set the target URL to http://example.com

Step 3: Start an automated scan on the target URL

Step 4: Wait for the scan to complete

Step 5: Review the scan report for any detected vulnerabilities

✅ Expected Result: The scan completes without errors and the report lists detected vulnerabilities or confirms no issues found

Automation Requirements - Python with Selenium and OWASP ZAP API

Assertions Needed:

Verify that the scan status is 'completed'

Verify that the scan report contains vulnerability alerts or confirms no alerts

Best Practices:

Use OWASP ZAP API to start and monitor scans programmatically

Use explicit waits to check scan completion

Validate scan results with assertions

Keep test code modular and readable

Automated Solution

Testing Fundamentals

import time
import requests
from selenium import webdriver
from selenium.webdriver.common.by import By

# Configuration
ZAP_API_KEY = 'changeme'
ZAP_BASE_URL = 'http://localhost:8080'
TARGET_URL = 'http://example.com'

# Start OWASP ZAP scan using API
scan_url = f'{ZAP_BASE_URL}/JSON/ascan/action/scan/?url={TARGET_URL}&apikey={ZAP_API_KEY}'
scan_response = requests.get(scan_url)
scan_id = scan_response.json().get('scan')

# Poll scan status until complete
status_url = f'{ZAP_BASE_URL}/JSON/ascan/view/status/?scanId={scan_id}&apikey={ZAP_API_KEY}'
scan_progress = 0
while scan_progress < 100:
    time.sleep(5)  # wait 5 seconds before checking again
    status_response = requests.get(status_url)
    scan_progress = int(status_response.json().get('status', 0))

# Get alerts report
alerts_url = f'{ZAP_BASE_URL}/JSON/core/view/alerts/?baseurl={TARGET_URL}&apikey={ZAP_API_KEY}'
alerts_response = requests.get(alerts_url)
alerts = alerts_response.json().get('alerts', [])

# Assertions
assert scan_progress == 100, f'Scan did not complete, progress: {scan_progress}%'
assert alerts is not None, 'Alerts data missing'

# Print summary
print(f'Scan completed with {len(alerts)} alerts found.')

This script uses the OWASP ZAP API to automate a security scan on the target URL.

First, it sends a request to start the scan and retrieves the scan ID.

Then, it polls the scan status every 5 seconds until the scan progress reaches 100%.

After completion, it fetches the alerts report and asserts that the scan completed and alerts data is present.

This approach uses explicit waits (polling) and API calls to control the scan, which is more reliable than manual UI interaction.

Common Mistakes - 3 Pitfalls

Hardcoding scan wait time instead of polling scan status

Ignoring API key security and hardcoding it in code

Not validating scan results and only checking scan completion

Bonus Challenge

Now add data-driven testing with 3 different target URLs to scan

Show Hint

Practice

1. Which of the following is a primary purpose of security testing tools?

easy

A. To create new features automatically

B. To improve the software's user interface design

C. To speed up the software's performance

D. To find vulnerabilities and weak spots in software

Solution

1. Step 1: Understand the role of security testing tools

   Security testing tools are designed to identify security weaknesses in software to prevent attacks.

2. Step 2: Compare options with the purpose

   Only To find vulnerabilities and weak spots in software matches this purpose; others relate to UI, speed, or feature creation, which are not security testing goals.

3. Final Answer:

   To find vulnerabilities and weak spots in software -> Option D

4. Quick Check:

   Security testing = find vulnerabilities [OK]

Hint: Security tools find weak spots, not UI or speed [OK]

Common Mistakes:

• Confusing security testing with performance testing
• Thinking security tools add features
• Assuming security tools improve UI

2. Which of the following is the correct way to describe OWASP ZAP?

easy

A. A security testing tool for finding web vulnerabilities

B. A code editor for developers

C. A database management system

D. A tool for automated UI testing

Solution

1. Step 1: Identify OWASP ZAP's function

   OWASP ZAP is a popular open-source security tool used to find vulnerabilities in web applications.

2. Step 2: Eliminate incorrect options

   Options A, B, and C describe unrelated tools or software types.

3. Final Answer:

   A security testing tool for finding web vulnerabilities -> Option A

4. Quick Check:

   OWASP ZAP = web security tool [OK]

Hint: OWASP ZAP scans web apps for security issues [OK]

Common Mistakes:

• Confusing OWASP ZAP with UI or database tools
• Thinking OWASP ZAP edits code
• Assuming it manages databases

3. Given the following tool descriptions, which tool is best suited for scanning open ports on a network?

medium

A. Nmap - scans networks to find open ports and services

B. Burp Suite - intercepts and modifies web traffic

C. Nikto - scans web servers for vulnerabilities

D. OWASP ZAP - automates UI testing

Solution

1. Step 1: Match tools to their main functions

   Nmap is known for scanning networks to find open ports and services.

2. Step 2: Verify other tools' functions

   Nikto scans web servers, Burp Suite intercepts web traffic, and OWASP ZAP does not automate UI testing.

3. Final Answer:

   Nmap - scans networks to find open ports and services -> Option A

4. Quick Check:

   Nmap = network port scanner [OK]

Hint: Nmap scans ports; Nikto scans web servers [OK]

Common Mistakes:

• Mixing up Nmap and Nikto functions
• Thinking Burp Suite scans ports
• Assuming OWASP ZAP automates UI

4. You run a scan with Nikto but receive no results. Which of the following is the most likely cause?

medium

A. Nikto requires a database connection to work

B. Nikto was run against a non-web server or incorrect URL

C. Nikto only works on mobile apps

D. Nikto needs a graphical interface to run

Solution

1. Step 1: Understand Nikto's scanning scope

   Nikto scans web servers for vulnerabilities; it needs a valid web server URL.

2. Step 2: Analyze the cause of no results

   If run against a non-web server or wrong URL, Nikto finds nothing.

3. Final Answer:

   Nikto was run against a non-web server or incorrect URL -> Option B

4. Quick Check:

   Nikto needs correct web server URL [OK]

Hint: Nikto scans web servers; wrong target = no results [OK]

Common Mistakes:

• Thinking Nikto needs a database
• Assuming Nikto works on mobile apps
• Believing Nikto requires GUI

5. You want to test a web application for security flaws by intercepting and modifying HTTP requests. Which tool should you choose and why?

hard

A. Nikto, because it scans for outdated software versions

B. Nmap, because it scans open ports on the web server

C. Burp Suite, because it allows intercepting and modifying web traffic

D. OWASP ZAP, because it automates UI testing

Solution

1. Step 1: Identify the tool for intercepting HTTP requests

   Burp Suite is designed to intercept, inspect, and modify web traffic between client and server.

2. Step 2: Compare other tools' purposes

   Nmap scans ports, Nikto scans web servers for vulnerabilities, and OWASP ZAP does not automate UI testing.

3. Step 3: Confirm best fit for task

   Intercepting and modifying HTTP requests requires Burp Suite's proxy capabilities.

4. Final Answer:

   Burp Suite, because it allows intercepting and modifying web traffic -> Option C

5. Quick Check:

   Intercept HTTP = Burp Suite [OK]

Hint: Use Burp Suite to intercept and modify web requests [OK]

Common Mistakes:

• Choosing Nmap for HTTP interception
• Confusing Nikto with traffic interception
• Thinking OWASP ZAP automates UI testing