XSS testing in Testing Fundamentals - Build an Automation Script

Test for Cross-Site Scripting (XSS) vulnerability in user input field

Preconditions (2)

Step 1: Enter the script tag <script>alert('XSS')</script> into the comment input field

Step 2: Click the submit button to post the comment

Step 3: Observe the page after submission

✅ Expected Result: The script tag is not executed, and the input is either escaped or sanitized so that no alert popup appears. The comment is displayed as plain text including the script tags.

Automation Requirements - Selenium with Python

Assertions Needed:

Verify that no alert popup appears after submitting the script input

Verify that the displayed comment contains the script tags as plain text, not executed

Best Practices:

Use explicit waits to wait for page updates after submission

Use safe locators like By.ID or By.NAME for input and buttons

Handle alert presence gracefully to detect unexpected popups

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.common.exceptions import TimeoutException, NoAlertPresentException

# Initialize the WebDriver (assumes chromedriver is in PATH)
driver = webdriver.Chrome()

try:
    driver.get('http://example.com/comment')  # Replace with actual URL

    # Locate the comment input field and submit button
    comment_input = WebDriverWait(driver, 10).until(
        EC.presence_of_element_located((By.ID, 'comment'))
    )
    submit_button = driver.find_element(By.ID, 'submit-comment')

    # Enter the XSS test script
    xss_payload = "<script>alert('XSS')</script>"
    comment_input.clear()
    comment_input.send_keys(xss_payload)

    # Submit the comment
    submit_button.click()

    # Wait for the comment to appear on the page
    comment_display = WebDriverWait(driver, 10).until(
        EC.presence_of_element_located((By.ID, 'comment-display'))
    )

    # Check for alert popup - should NOT appear
    try:
        WebDriverWait(driver, 3).until(EC.alert_is_present())
        alert = driver.switch_to.alert
        alert_text = alert.text
        alert.dismiss()
        raise AssertionError(f"Unexpected alert appeared with text: {alert_text}")
    except TimeoutException:
        # No alert appeared, which is expected
        pass

    # Verify the displayed comment contains the script tags as plain text
    displayed_text = comment_display.text
    assert xss_payload in displayed_text, "The script tags are not displayed as plain text"

finally:
    driver.quit()

This script opens the web page with the comment form.

It waits until the comment input and submit button are present, then enters the XSS payload <script>alert('XSS')</script>.

After clicking submit, it waits for the comment to appear on the page.

It then checks if any alert popup appears. If an alert appears, the test fails because the script executed.

If no alert appears, it verifies that the comment text includes the script tags as plain text, meaning the input was safely handled.

Explicit waits ensure the test waits for elements and alerts properly.

Using By.ID locators is a best practice for stable element selection.

Common Mistakes - 3 Pitfalls

Using Thread.sleep() instead of explicit waits

Not checking for alert popups after submitting XSS payload

Using brittle XPath selectors that depend on page layout

Bonus Challenge

Now add data-driven testing with 3 different XSS payloads to verify the application handles all safely.

Show Hint

Practice

1. What is the main goal of XSS testing in software testing?

easy

A. To check if harmful scripts can run on a website

B. To test website speed under heavy load

C. To verify database backup integrity

D. To check user interface responsiveness

Solution

1. Step 1: Understand XSS testing purpose

   XSS testing aims to find if malicious scripts can run on a website, which can harm users or data.

2. Step 2: Compare options to XSS goal

   Only "To check if harmful scripts can run on a website" matches the goal of detecting harmful script execution on websites.

3. Final Answer:

   To check if harmful scripts can run on a website -> Option A

4. Quick Check:

   XSS testing = harmful script check [OK]

Hint: XSS testing checks for harmful scripts running on sites [OK]

Common Mistakes:

• Confusing XSS testing with performance testing
• Thinking XSS tests database or UI only
• Ignoring script execution risks

2. Which of the following is a correct example of an XSS test input to check script injection?

easy

A. SELECT * FROM users;

B. <script>alert('XSS')</script>

C. DROP TABLE users;

D. console.log('test')

Solution

1. Step 1: Identify typical XSS test input

   XSS tests use script tags like <script>alert('XSS')</script> to check if scripts run on the site.

2. Step 2: Eliminate unrelated inputs

   Options B and C are SQL commands, not XSS scripts. console.log('test') is JavaScript code but not wrapped in script tags for injection.

3. Final Answer:

   <script>alert('XSS')</script> -> Option B

4. Quick Check:

   Script tags = XSS test input [OK]

Hint: XSS test inputs use <script> tags to inject scripts [OK]

Common Mistakes:

• Using SQL commands as XSS inputs
• Not wrapping JavaScript in script tags
• Confusing console logs with injection

3. Given this input in a web form: <img src=x onerror=alert('XSS')>, what is the expected result if the site is vulnerable to XSS?

medium

A. The image will load normally without alert

B. The input will be saved as plain text without alert

C. The form submission will fail with an error

D. The alert box with message 'XSS' will appear

Solution

1. Step 1: Understand the input behavior

   The input uses an image tag with an invalid source and an onerror event that triggers an alert. If the site is vulnerable, this script runs.

2. Step 2: Predict the output on vulnerability

   If vulnerable, the alert('XSS') will execute, showing a popup message.

3. Final Answer:

   The alert box with message 'XSS' will appear -> Option D

4. Quick Check:

   onerror alert triggers popup if vulnerable [OK]

Hint: onerror event triggers alert if XSS vulnerability exists [OK]

Common Mistakes:

• Assuming input is saved as text without execution
• Thinking image loads normally despite invalid src
• Confusing form errors with script execution

4. You wrote this test input to check XSS: <script>alert('test')</script>. The alert does not appear, but the input is stored and shown as text on the page. What is the likely reason?

medium

A. The site properly escapes script tags to prevent execution

B. The browser blocked all JavaScript on the page

C. The input was rejected and not saved

D. The alert function is disabled in the browser

Solution

1. Step 1: Analyze why alert did not appear

   The alert script is stored and shown as text, meaning it was not executed but escaped.

2. Step 2: Identify cause of script escaping

   Proper XSS protection escapes script tags so they display as text, preventing execution.

3. Final Answer:

   The site properly escapes script tags to prevent execution -> Option A

4. Quick Check:

   Escaping scripts = no execution [OK]

Hint: Escaping script tags stops alert from running [OK]

Common Mistakes:

• Assuming browser blocked all JavaScript
• Thinking input was rejected when it was saved
• Believing alert function is disabled

5. You want to test if a website properly blocks XSS attacks in both URL parameters and form inputs. Which combined approach is best?

hard

A. Test URL parameters with SQL commands and form inputs with numbers

B. Only test form inputs with normal text values

C. Inject <script>alert(1)</script> in URL and form fields, then check if alert appears

D. Use browser developer tools to disable JavaScript and test inputs

Solution

1. Step 1: Understand testing both input types

   XSS can happen via URL parameters or form inputs, so both must be tested with script injections.

2. Step 2: Choose effective test input and verification

   Injecting <script>alert(1)</script> is a simple way to check if scripts run. Observing alert confirms vulnerability.

3. Final Answer:

   Inject <script>alert(1)</script> in URL and form fields, then check if alert appears -> Option C

4. Quick Check:

   Test scripts in URL and forms to find XSS [OK]

Hint: Test script injection in both URL and forms for full coverage [OK]

Common Mistakes:

• Testing only one input type
• Using unrelated inputs like SQL commands
• Disabling JavaScript instead of testing execution