Author: vibssingh

vibssingh

Multiple Choice Questions for Security Testing on Web Application

Last Updated On

HOME

Welcome to the Security Testing on Web Application Quiz!

1) What is the primary goal of security testing in a web application?

a) To improve the user interface and user experience.
b) To identify and mitigate security vulnerabilities within the application.
c) To enhance the application’s performance and load times.
b) To identify and mitigate security vulnerabilities within the application.

Answer 1

2) By using relative XPath locators

2) What does the acronym ‘OWASP’ stand for?

a) Open Web Application Security Project
b) Open Worldwide Application Security Protocol
c) Offline Web Application Security Program
d) Operational Web Application Safety Procedure

Answer 2

a) Open Web Application Security Project

3) Which of the following is a common method hackers use to find vulnerabilities in web applications?

a) Social engineering
b) Penetration testing
c) Phishing
d) All of the above

Answer 3

d) All of the above

4) What is the primary goal of encryption in web applications?

a) To compress data
b) To increase data integrity
c) To secure data transmission and storage
d) To improve server performance

Answer 4

c) To secure data transmission and storage

5) What is the main risk of using default configurations for web applications?

a) Performance degradation
b) Increased vulnerability to attacks
c) Incompatibility with browsers
d) Accessibility issues

Answer 5

b) Increased vulnerability to attacks

6) What is the main function of a web application firewall (WAF)?

a) To block unauthorized access to the network
b) To filter and monitor HTTP traffic between a web application and the Internet
c) To encrypt data in transit
d) To detect and remove malware from user devices

Answer 6

b) To filter and monitor HTTP traffic between a web application and the Internet

WAFs are designed to defend against a variety of attacks that aim to exploit vulnerabilities in web applications, including:

– SQL Injection
– Cross-Site Scripting (XSS)
– Cross-Site Request Forgery (CSRF)
– File Inclusion

7) Which of the following HTTP headers is used to enhance security by declaring how browsers should handle site’s content?

a) Content-Type
b) Strict-Transport-Security
c) Content-Security-Policy
d) Cache-Control

Answer 7

c) Content-Security-Policy

It helps to prevent various types of attacks such as Cross-Site Scripting (XSS), clickjacking, and other code injection attacks by restricting resources like scripts, styles, or media from being loaded from unauthorized sources.

8) What is a common result of a successful buffer overflow attack?

a) Data leakage
b) Execution of arbitrary code
c) Network eavesdropping
d) Denial of service

Answer 8

b) Execution of arbitrary code

9) What does the term “privilege escalation” refer to in web application security?

a) The granting of highest-level access to all users
b) An attacker obtaining unauthorized higher-level privileges
c) The prioritization of security patches based on severity
d) Increasing the complexity of user authentication mechanisms

Answer 9

b) An attacker obtaining unauthorized higher-level privileges

10) What is the function of the HttpOnly attribute in a cookie?

a) To ensure cookies are only transferred over HTTPS
b) To limit cookies to the current session
c) To prevent access to cookies via JavaScript
d) To enable cross-domain cookie usage

Answer 10

c) To prevent access to cookies via JavaScript

11) Which of the following is implemented during secure session management to enhance security?

a) Storing sessions in browser local storage
b) Terminating sessions after a period of inactivity
c) Using random session IDs
d) b and c

Answer 11

d) b and c

12) Which type of attack is mitigated by setting the Secure attribute on cookies?

a) Clickjacking
b) SQL Injection
c) Man-in-the-middle (MitM) attack
d) Session hijacking over HTTP

Answer 12

2) Clickjacking

13) What type of attack exploits the trust a user has in a particular site?

a) Phishing
b) SQL Injection
c) Cross-Site Scripting (XSS)
d) Cross-Site Request Forgery (CSRF)

Answer 13

d) Cross-Site Request Forgery (CSRF)

14) What is Cross-Site Request Forgery (CSRF)?

a) A method to steal user cookies
b) A technique to redirect users to a malicious site
c) An attack that tricks the victim into submitting a malicious request
d) None of the above

Answer 14

c) An attack that tricks the victim into submitting a malicious request

15) Which security mechanism is designed to prevent CSRF (Cross-Site Request Forgery) attacks?

a) Input validation
b) Use of CSRF tokens
c) Secure cookies
d) Output encoding

Answer 15

b) Use of CSRF tokens

16) What is Cross-Site Scripting (XSS)?

a) A scripting language for web development
b) A technique to enhance website design
c) An attack where malicious scripts are injected into web pages
d) A secure communication protocol

Answer 16

c) An attack where malicious scripts are injected into web pages

17) Which of the following is NOT a type of cross-site scripting (XSS)?

a) Reflected XSS
b) Stored XSS
c) DOM-based XSS
d) Injection XSS

Answer 17

d) Injection XSS

18) What is a potential risk associated with insecure file uploads on a web application?

a) Improved user experience
b) Increased server performance
c) Remote code execution
d) Enhanced data integrity

Answer 18

c) Remote code execution

19) Which of the following is a best practice for password storage?

a) Storing passwords in plain text
b) Encrypting passwords using symmetric key encryption
c) Hashing passwords using a strong, one-way hashing algorithm with salt
d) Using passwords only for trusted users

Answer 19

c) Hashing passwords using a strong, one-way hashing algorithm with salt

20) What is the primary purpose of HTTPS?

a) To redirect users to the correct webpage
b) To improve website loading times
c) To encrypt data transmitted between the user’s browser and the web server
d) To block unwanted ads

Answer 20

c) To encrypt data transmitted between the user’s browser and the web server

21) Which HTTP header can be used to protect against clickjacking attacks?

a) Content-Security-Policy
b) X-Frame-Options
c) X-XSS-Protection
d) Strict-Transport-Security

Answer 21

b) X-Frame-Options

22) What is the purpose of content security policy (CSP)?

a) To prevent data breaches
b) To protect against XSS attacks
c) To enforce secure password handling
d) To block SQL injections

Answer 22

b) To protect against XSS attacks

23) Which protocol is designed to replace the widely exploited TELNET and offer encrypted communication?

a) HTTP
b) SSH
c) FTP
d) SMTP

Answer 23

b) SSH

24) Which OWASP tool is used primarily for penetration testing of web applications?

a) OWASP ZAP
b) Metasploit
c) Nmap
d) John the Ripper

Answer 24

a) OWASP ZAP

25) During a web application penetration test, what is the importance of session management testing?

a) To identify UI/UX issues
b) To ensure efficient data processing
c) To verify secure user session handling
d) To optimize web server performance

Answer 25

c) To verify secure user session handling

vibssingh

Run ChainTest Report on Docker

Last Updated On

HOME

ChainTest Reports can be run on docker (dynamic report).

What is ChainLP?

ChainLP (Chain-Long-Playing like LP Record) is a Java (Spring) server which packs the Angular frontend and is distributed as a Docker image. ChainLP is the framework component providing historical analytics.

The recommended way to run ChainLP is with docker-compose. Currently, the supported databases are listed below but most RDBMS database should work.

  • H2
  • MySQL
  • PostgreSQL

For each database, there is a separate docker-compose.yml available at chainlp/docker. H2 provides the most straight-forward way to test, but it is NOT recommended for production use.

Docker image is available from https://hub.docker.com/r/anshooarora/chaintest.

We need to have Desktop Docker up and running. To know how to install the Desktop Docker, please refer to this tutorial – How to install Desktop Docker on Windows 11

Go the location where these docker images are placed and run the below command. In this example, we are running h2 docker image.

docker-compose -f docker-compose-h2.yml up

The output of the above execution is

Go to the http:localhost:80 and we will see an empty ChainTest Report.

Run the project contains the ChainTest report configuration. Refer this tutorial to get the ChainTest Report configuration – ChainTest Report with Cucumber and TestNG.

Add the following properties to chaintest.properties file in src/test/resources

# chaintest configuration
chaintest.project.name= ChaninTest Report with Cucumber and TestNG

# generators:
## chainlp
chaintest.generator.chainlp.enabled=true
chaintest.generator.chainlp.class-name=com.aventstack.chaintest.generator.ChainLPGenerator
chaintest.generator.chainlp.host.url=http://localhost/
chaintest.generator.chainlp.client.request-timeout-s=30
chaintest.generator.chainlp.client.expect-continue=false
chaintest.generator.chainlp.client.max-retries=3

Run the test either through command line or through Test Runner class.

Run the tests through command line

To run the tests, use the below command

mvn clean test

Updation of ChainTest Report

ChainTest Report is updated with the current test run as shown below:

Click on the project and it will show the complete test execution report.

Click on cucumber-jvm option. It will show the detailed execution report. This report includes a pie chart for the feature, Scenario and Steps. Here, we have executed 1 feature file and 1 scenario. The Feature file has failed. So, the Feature pie chart shows 100% failed. There are 5 scenarios. Out of 5, 4 tests are passed. 1 test failed. Therefore, the Scenario pie chart shows 80% passed. This report also shows error message for the failed test.

We see that one of the tests has failed. The screenshot of the failed test is also attached in the report.

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

vibssingh

ChainTest Report with Selenium and JUnit5

HOME

In this tutorial, will generate a ChainTest Report with Selenium and JUnit5. In the previous tutorial, I have explained the steps to generate ChainTest Report with Cucumber – ChainTest Report with Cucumber and TestNG. ChainTest Report is the replacement of Extent Report.

Table of Contents

  1. What is ChainTest Report?
  2. Prerequisite
  3. Dependency List
  4. Structure of Project
  5. Implementation
    1. Step 1 – Add ChainTest JUnit5 plugin dependency in Maven Project
    2. Step 2 – Create Pages and Test Code for the pages
    3. Step3 – Annotate test class with @ExtendWith(ChainTestExecutionCallback.class)
    4. Step 4 – Add chaintest.properties file in src/test/resources
    5. Step 5 – Run the tests
    6. Step 6 -View ChainTest Reports
    7. Step 7 – Run the tests through command line

What is ChainTest Report?

ChainTest is a complete reporting system, it supports a variety of sources, including email, static data, and real-time, historical analytics with ChainLP. The next-generation reporting framework ChainTest was developed for a number of test frameworks, such as Cucumber, JUnit, and TestNG.

Prerequisite

  1. Java 17 is installed
  2. Maven is installed
  3. Eclipse or IntelliJ is installed

Dependency List:

  1. Selenium – 4.28.1
  2. Java 17
  3. JUnit5 – 5.11.0-M2
  4. Maven – 3.9.6
  5. ChainTest JUnit5 – 1.0.11

Structure of Project

Implementation

Step 1 – Add ChainTest JUnit5 plugin dependency in Maven Project.

<dependency>
      <groupId>com.aventstack</groupId>
      <artifactId>chaintest-junit5</artifactId>
      <version>${chaintest.version}</version>
</dependency>

The complete pom.xml looks like as shown below:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.example</groupId>
  <artifactId>ChainTestReport_JUnit5_Demo</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>jar</packaging>

  <name>ChainTestReport_JUnit5_Demo</name>
  <url>http://maven.apache.org</url>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <selenium.version>4.21.0</selenium.version>
    <chaintest.version>1.0.11</chaintest.version>
    <junit.jupiter.engine.version>5.11.0-M2</junit.jupiter.engine.version>
    <junit.jupiter.api.version>5.11.0-M2</junit.jupiter.api.version>
    <junit.jupiter.params.version>5.11.0-M2</junit.jupiter.params.version>
    <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
    <maven.compiler.source.version>17</maven.compiler.source.version>
    <maven.compiler.target.version>17</maven.compiler.target.version>
    <maven.surefire.plugin.version>3.2.5</maven.surefire.plugin.version>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
  </properties>

  <dependencies>

    <dependency>
      <groupId>org.seleniumhq.selenium</groupId>
      <artifactId>selenium-java</artifactId>
      <version>${selenium.version}</version>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-engine</artifactId>
      <version>${junit.jupiter.engine.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-api</artifactId>
      <version>${junit.jupiter.api.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-params</artifactId>
      <version>${junit.jupiter.params.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.aventstack</groupId>
      <artifactId>chaintest-junit5</artifactId>
      <version>${chaintest.version}</version>
    </dependency>

  </dependencies>

  <build>
    <plugins>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>${maven.surefire.plugin.version}</version>

        <dependencies>
          <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-engine</artifactId>
            <version>${junit.jupiter.engine.version}</version>
          </dependency>
        </dependencies>
      </plugin>
    </plugins>
  </build>

</project>

Step 2 – Create Pages and Test Code for the pages

BasePage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.support.PageFactory;

public class BasePage {
    public WebDriver driver;

    public BasePage(WebDriver driver) {
        this.driver = driver;
        PageFactory.initElements(driver,this);
    }

}

LoginPage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class LoginPage extends BasePage {

    public LoginPage(WebDriver driver) {
        super(driver);

    }

    @FindBy(name = "username")
    public WebElement userName;

    @FindBy(name = "password")
    public WebElement password;

    @FindBy(xpath = "//*[@type='submit']")
    public WebElement loginBtn;

    @FindBy(xpath = "//*[@id='flash']")
    public WebElement errorMessage;

    public void login(String strUserName, String strPassword) {
        userName.sendKeys(strUserName);
        password.sendKeys(strPassword);
        loginBtn.click();
    }

    public String getErrorMessage() {
        return errorMessage.getText();
    }

}

SecurePage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class SecurePage extends BasePage {

    public SecurePage(WebDriver driver) {
        super(driver);

    }

    @FindBy(xpath = "//*[@id='flash']")
    public WebElement securePageTitle;

    public String getSecurePageTitle() {
        return securePageTitle.getText();
    }

}

Step3 – Annotate test class with @ExtendWith(ChainTestExecutionCallback.class)

BaseTests

package com.example;

import com.aventstack.chaintest.plugins.ChainTestExecutionCallback;
import org.junit.jupiter.api.extension.ExtendWith;
import org.junit.jupiter.api.extension.TestWatcher;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.chrome.ChromeOptions;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import java.time.Duration;

@ExtendWith(ChainTestExecutionCallback.class)
public class BaseTests implements TestWatcher {

    public static WebDriver driver;
    public final static int TIMEOUT = 10;

    @BeforeEach
    public void setup() {
        ChromeOptions options = new ChromeOptions();
        options.addArguments("--remote-allow-origins=*");
        options.addArguments("--no-sandbox");
        options.addArguments("--disable-dev-shm-usage");
        driver = new ChromeDriver(options);

        driver.manage().window().maximize();
        driver.get("https://the-internet.herokuapp.com/login");
        driver.manage().timeouts().implicitlyWait(Duration.ofSeconds(TIMEOUT));
    }

    @AfterEach
    void tearDown() {
        driver.quit();
    }

}

LoginPageTests

package com.example;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;

public class LoginPageTests extends BaseTests {

    String actualLoginPageTitle;
    String actualErrorMessage;
    String actualSecurePageTitle;
    
    @Test
    public void verifyPageTitle() {

        actualLoginPageTitle = driver.getTitle();
        
        // Verify Page Title - Fail
        Assertions.assertEquals("The Internet !!",actualLoginPageTitle);

    }

    @Test
    public void invalidCredentials() {

        LoginPage loginPage = new LoginPage(driver);
        loginPage.login("tomsmith", "happy!");
        actualErrorMessage = loginPage.getErrorMessage();

        // Verify Error Message
        Assertions.assertTrue(actualErrorMessage.contains("Your password is invalid!"));

    }

    @Test
    public void validLogin() {

        LoginPage loginPage = new LoginPage(driver);
        loginPage.login("tomsmith", "SuperSecretPassword!");

        SecurePage securePage = new SecurePage(driver);
        actualSecurePageTitle = securePage.getSecurePageTitle();

        // Verify Home Page
        Assertions.assertTrue(actualSecurePageTitle.contains("You logged into a secure area!"));

    }
}

Step 4 – Add chaintest.properties file in src/test/resources

Add chaintest.properties to the classpath, example: src/test/resources/chaintest.properties.

# chaintest configuration
chaintest.project.name= ChaninTest Report with Selenium and JUnit5

# storage
chaintest.storage.service.enabled=false
# [azure-blob, aws-s3]
chaintest.storage.service=azure-blob
# s3 bucket or azure container name
chaintest.storage.service.container-name=

# generators:
## chainlp
chaintest.generator.chainlp.enabled=true
chaintest.generator.chainlp.class-name=com.aventstack.chaintest.generator.ChainLPGenerator
chaintest.generator.chainlp.host.url=http://localhost/
chaintest.generator.chainlp.client.request-timeout-s=30
chaintest.generator.chainlp.client.expect-continue=false
chaintest.generator.chainlp.client.max-retries=3

## simple
chaintest.generator.simple.enabled=true
chaintest.generator.simple.document-title=chaintest
chaintest.generator.simple.class-name=com.aventstack.chaintest.generator.ChainTestSimpleGenerator
chaintest.generator.simple.output-file=target/chaintest/Index.html
chaintest.generator.simple.offline=false
chaintest.generator.simple.dark-theme=true
chaintest.generator.simple.datetime-format=yyyy-MM-dd hh:mm:ss a
chaintest.generator.simple.js=
chaintest.generator.simple.css=

## email
chaintest.generator.email.enabled=true
chaintest.generator.email.class-name=com.aventstack.chaintest.generator.ChainTestEmailGenerator
chaintest.generator.email.output-file=target/chaintest/Email.html
chaintest.generator.email.datetime-format=yyyy-MM-dd hh:mm:ss a

Step 5 – Run the tests

Right click on LoginPageTests and select Run ‘LoginPageTests’

The execution status looks like as shown below. There are 3 tests and 1 test will fail.

Step 6 -View ChainTest Reports

ChainTest Reports are generated in target folder – Index.html and email.html.

Index.html

Right-click and open with Web Browser.

The index.html has a summary section that displays the summary of the execution. The summary includes the overview of the pass/fail using a pictogram, start time, end time, and pass/fail details of tests as shown in the image below.

Email.html

This report contains the high level summary of the test execution.

Step 7 – Run the tests through command line

To run the tests, use the below command

mvn clean test

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

vibssingh

How to install Desktop Docker on Windows 11

HOME

In this tutorial, we will discuss the Docker, Docker Desktop and how to install Docker Desktop on the Windows 11.

Table of Contents

  1. What is Docker?
  2. What is Docker Desktop?
  3. How to verify WSL is installed?
  4. Install Docker Desktop
  5. Start Docker Desktop
  6. How to verify successful docker installation

What is Docker?

Docker is an open platform for developing, shipping, and running applications using the containers. Docker enables us to separate the applications from the infrastructure so we can deliver software quickly. With Docker, we can manage your infrastructure in the same ways you manage your applications.

Containers are lightweight, portable, and self-sufficient units that package an application and its dependencies, ensuring consistency across different environments.

The current image has no alternative text. The file name is: image-34.png

What is Docker Desktop?

Docker Desktop is a one-click-install application for your Mac, Linux, or Windows environment that lets you build, share, and run containerized applications and microservices.

It provides a straightforward GUI (Graphical User Interface) that lets you manage your containers, applications, and images directly from your machine.

Before installing Docker on Windows 10 or 11, ensure your system meets the following requirements:

  • Windows 10 64-bit: Build 18362 or higher
  • Windows 11 64-bit
  • Hardware Virtualization Technology (VT-x) enabled in BIOS
  • Microsoft Hyper-V and Containers features enabled

How to verify WSL is installed?

Windows Subsystem for Linux (WSL) 2 is a prerequisite for Docker Desktop on Windows. It provides a lightweight Linux kernel for compatibility and performance improvements.

wsl --version

The output of the above command should display the version of wsl installed on the machine.

Open PowerShell as Administrator and run:

wsl --install

Restart the computer if prompted.

 Install Docker Desktop

On the Docker download page, select “Windows” as your operating system.

The download will begin automatically. The duration will depend on your internet speed.

After installation, open Docker Desktop.

After clicking “OK,” the installation will start.

After installation completes, it will show a confirmation screen.

Create an account for Docker Desktop.

Once we will create the account, we will login and see that the Docker Engine is stopped.

Go to the settings and select “Start Docker Desktop when sign in to your computer.”. This is optional.

Go to the bottom tray and right click on the Desktop option.

It will show below mentioned options. Select “Quit Docker Desktop”.

Start Docker Desktop

Docker Desktop does not start automatically after installation. To start Docker Desktop:

Search for Docker, and select Docker Desktop in the search results.

The Docker menu displays the Docker Subscription Service Agreement. Select Accept to continue. Docker Desktop starts after you accept the terms.

Note that Docker Desktop won’t run if you do not agree to the terms. You can choose to accept the terms at a later date by opening Docker Desktop.

How to verify successful docker installation

Open a command prompt or PowerShell window.

Using the following command check the docker version for verifying the installation.

docker --version

Pull a sample image, such as Nginx, using the following command:

 docker pull nginx

If the image pulls successfully, Docker Desktop has been installed correctly

TroubleShooting

The error you’re seeing indicates that Docker is unable to authenticate when trying to pull the NGINX image from Docker Hub

Use the below command to login to docker

 docker login -u my-user-name (using real username)

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

vibssingh

ChainTest Report with Cucumber and TestNG

Last Updated On

HOME

ExtentReport, one of the most popular and extensively used test reports, has been officially retired. Changes in automated testing techniques led to this decision. The same developer, Anshoo Arora, fills the void with ChainTest, a potent reporting system. With its enhanced capabilities, real-time data, and seamless integration options, ChainTest is anticipated to transform how we see test results.

Table of Contents

  1. What is ChainTest Report?
  2. Prerequisite
  3. Dependency List
  4. Structure of Project
  5. Implementation
    1. Step 1 – Add ChainTest Cucumber plugin dependency in Maven Project.
    2. Step 2 – Create a feature file under src/test/resources/features
    3. Step 3 – Create the classes for locators, actions, and utilities in src/main/java
    4. Step 4 – Create a StepDefinition class in src/test/java
    5. Step 5 – Create a Hook class in src/test/java
    6. Step 6 – Create a TestNG Cucumber Runner class in the src/test/java
    7. Step 7 – Add ChainTest plugin to the runner class
    8. Step 8 – Add chaintest.properties to src/test/resources directory
    9. Step 9 – Create a testng.xml at the root directory
    10. Step 10 – Run the tests from TestNG
    11. Step 11 – View ChainTest Reports
    12. Step 12 – Run the tests through command line

What is ChainTest Report?

ChainTest is a complete reporting system. It supports a variety of sources, including email and static data. It also handles real-time and historical analytics with ChainLP. The next-generation reporting framework ChainTest was developed for a number of test frameworks, such as Cucumber, JUnit, and TestNG.

Prerequisite

  1. Java 17 is installed
  2. Maven is installed
  3. Eclipse or IntelliJ is installed

Dependency List:

  1. Selenium – 4.28.1
  2. Java 17
  3. TestNG – 7.10.2
  4. Cucumber – 7.18.1
  5. Maven – 3.9.6
  6. ChainTest Cucumber– 1.0.11

Structure of Project

Implementation

Step 1 – Add ChainTest Cucumber plugin dependency in Maven Project.

<dependency>
      <groupId>com.aventstack</groupId>
      <artifactId>chaintest-cucumber-jvm</artifactId>
      <version>${chaintest.cucumberjvm.version}</version>
      <scope>provided</scope>
 </dependency>

The complete pom.xml looks like as shown below:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.example</groupId>
  <artifactId>ChainTestReport_Cucumber_TestNG_Demo</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>jar</packaging>

  <name>ChainTestReport_Cucumber_TestNG_Demo</name>
  <url>http://maven.apache.org</url>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <cucumber.version>7.18.1</cucumber.version>
    <selenium.version>4.25.0</selenium.version>
    <testng.version>7.10.2</testng.version>
    <chaintest.cucumberjvm.version>1.0.11</chaintest.cucumberjvm.version>
    <apache.common.version>2.4</apache.common.version>
    <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
    <maven.surefire.plugin.version>3.3.1</maven.surefire.plugin.version>
    <maven.compiler.source.version>17</maven.compiler.source.version>
    <maven.compiler.target.version>17</maven.compiler.target.version>
    <maven.cucumber.reporting.version>5.8.2</maven.cucumber.reporting.version>
  </properties>

  <dependencies>

    <dependency>
      <groupId>io.cucumber</groupId>
      <artifactId>cucumber-java</artifactId>
      <version>${cucumber.version}</version>
    </dependency>

    <dependency>
      <groupId>io.cucumber</groupId>
      <artifactId>cucumber-testng</artifactId>
      <version>${cucumber.version}</version>
      <scope>test</scope>
    </dependency>

    <!-- Selenium -->
    <dependency>
      <groupId>org.seleniumhq.selenium</groupId>
      <artifactId>selenium-java</artifactId>
      <version>${selenium.version}</version>
    </dependency>

    <!-- TestNG -->
    <dependency>
      <groupId>org.testng</groupId>
      <artifactId>testng</artifactId>
      <version>${testng.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.aventstack</groupId>
      <artifactId>chaintest-cucumber-jvm</artifactId>
      <version>${chaintest.cucumberjvm.version}</version>
      <scope>provided</scope>
    </dependency>

  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>${maven.compiler.plugin.version}</version>
        <configuration>
          <source>${maven.compiler.source.version}</source>
          <target>${maven.compiler.target.version}</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>${maven.surefire.plugin.version}</version>
        <configuration>
          <testFailureIgnore>true</testFailureIgnore>
          <suiteXmlFiles>
            <suiteXmlFile>testng.xml</suiteXmlFile>
          </suiteXmlFiles>
        </configuration>
      </plugin>

    </plugins>
  </build>
</project>

Step 2 – Create a feature file under src/test/resources/features

It is recommended to create a features folder in the src/test/resources directory. Create all the feature files in this features folder. Feature file should be saved as an extension of .feature. The test scenarios in the Feature file are written in Gherkins language. Add the test scenarios in this feature file. I have added sample test scenarios.

Feature: Login to HRM Application

  Background:
    Given User is on HRMLogin page "https://opensource-demo.orangehrmlive.com/"

  @ValidCredentials
  Scenario: Login with valid credentials

    When User enters username as "Admin" and password as "admin123"
    Then User should be able to login successfully and new page open

  @InvalidCredentials
  Scenario Outline: Login with invalid credentials

    When User enters username as "<username>" and password as "<password>"
    Then User should be able to see error message "<errorMessage>"

    Examples:
      | username   | password  | errorMessage           |
      | Admin      | admin12$$ | Invalid credentials    |
      | admin$$    | admin123  | Invalid credentials    |
      | abc123     | xyz$$     | Invalid credentials    |

  @MissingUsername
  Scenario: Login with blank username - FailedTest

    When User enters username as " " and password as "admin123"
    Then User should be able to see a message "Required1" below Username

Step 3 – Create the classes for locators, actions, and utilities in src/main/java

LoginPageActions

package com.example.actions;

import com.example.locators.LoginPageLocators;
import org.openqa.selenium.support.PageFactory;
import com.example.utils.HelperClass;


public class LoginPageActions {

    LoginPageLocators loginPageLocators = null;

    public LoginPageActions() {

        this.loginPageLocators = new LoginPageLocators();
        PageFactory.initElements(HelperClass.getDriver(), loginPageLocators);
    }

    // Get the error message when username is blank
    public String getMissingUsernameText() {
        return loginPageLocators.missingUsernameErrorMessage.getText();
    }

    // Get the Error Message
    public String getErrorMessage() {
        return loginPageLocators.errorMessage.getText();
    }

    public void login(String strUserName, String strPassword) {

        // Fill user name
        loginPageLocators.userName.sendKeys(strUserName);

        // Fill password
        loginPageLocators.password.sendKeys(strPassword);

        // Click Login button
        loginPageLocators.login.click();

    }
}

HomePageActions

package com.example.actions;

import com.example.locators.HomePageLocators;
import org.openqa.selenium.support.PageFactory;
import com.example.utils.HelperClass;

public class HomePageActions {

    HomePageLocators homePageLocators = null;

    public HomePageActions() {

        this.homePageLocators = new HomePageLocators();
        PageFactory.initElements(HelperClass.getDriver(),homePageLocators);
    }

    public String getHomePageText() {
        System.out.println("Heading :" + homePageLocators.homePageUserName.getText());
        return homePageLocators.homePageUserName.getText();
    }

}

LoginPageLocators

package com.example.locators;

import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class LoginPageLocators {

    @FindBy(name = "username")
    public WebElement userName;

    @FindBy(name = "password")
    public WebElement password;

    @FindBy(xpath = "//*[@id='app']/div[1]/div/div[1]/div/div[2]/div[2]/form/div[1]/div/span")
    public WebElement missingUsernameErrorMessage;

    @FindBy(xpath = "//*[@id='app']/div[1]/div/div[1]/div/div[2]/div[2]/form/div[3]/button")
    public WebElement login;

    @FindBy(xpath = "//*[@id='app']/div[1]/div/div[1]/div/div[2]/div[2]/div/div[1]/div[1]/p")
    public  WebElement errorMessage;

}

HomePageLocators

package com.example.locators;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class HomePageLocators {

    @FindBy(xpath = "//span[@class='oxd-topbar-header-breadcrumb']/h6")

    public  WebElement homePageUserName;

}

HelperClass

package com.example.utils;

import java.time.Duration;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.chrome.ChromeOptions;

public class HelperClass {

    private static HelperClass helperClass;

    private static WebDriver driver;
    public final static int TIMEOUT = 5;

    private HelperClass() {

        ChromeOptions options = new ChromeOptions();
        options.addArguments("--start-maximized");
        driver = new ChromeDriver(options);
        driver.manage().timeouts().implicitlyWait(Duration.ofSeconds(TIMEOUT));
    }

    public static void openPage(String url) {
        driver.get(url);
    }

    public static WebDriver getDriver() {
        return driver;
    }

    public static void setUpDriver() {

        if (helperClass==null) {
            helperClass = new HelperClass();
        }
    }

    public static void tearDown() {

        if(driver!=null) {
            driver.quit();
        }

        helperClass = null;
    }

}

Step 4 – Create a StepDefinition class in src/test/java

Create a Java Class called Definition. In this class, we will create the Test Code related to the Given, When, Then of the Feature file. This will be in src/test/java.

package com.example.definitions;

import com.example.actions.HomePageActions;
import com.example.actions.LoginPageActions;

import io.cucumber.java.en.Given;
import io.cucumber.java.en.Then;
import io.cucumber.java.en.When;
import org.testng.Assert;
import com.example.utils.HelperClass;

public class LoginPageDefinitions {

    LoginPageActions objLogin = new LoginPageActions();
    HomePageActions objHomePage = new HomePageActions();

    @Given("User is on HRMLogin page {string}")
    public void loginTest(String url) {

        HelperClass.openPage(url);

    }

    @When("User enters username as {string} and password as {string}")
    public void goToHomePage(String userName, String passWord) {

        // login to application
        objLogin.login(userName, passWord);

    }

    @Then("User should be able to login successfully and new page open")
    public void verifyLogin() {

        // Verify home page
        Assert.assertTrue(objHomePage.getHomePageText().contains("Dashboard"));

    }

    @Then("User should be able to see error message {string}")
    public void verifyErrorMessage(String expectedErrorMessage) {

        // Verify error message
        Assert.assertEquals(objLogin.getErrorMessage(),expectedErrorMessage);

    }

    @Then("User should be able to see a message {string} below Username")
    public void verifyMissingUsernameMessage(String message) {

        Assert.assertEquals(objLogin.getMissingUsernameText(),message);
    }

}

Step 5 – Create a Hook class in src/test/java

Create the hook class that contains the Before and After hook. Use it to initialize the web browser. Then, close the web browser. I have added the code to take the screenshot of the failed scenario in @After Hook.

package com.example.definitions;
import org.openqa.selenium.OutputType;
import org.openqa.selenium.TakesScreenshot;

import io.cucumber.java.After;
import io.cucumber.java.Before;
import io.cucumber.java.Scenario;
import com.example.utils.HelperClass;

public class Hooks {

    @Before
    public static void setUp() {

        HelperClass.setUpDriver();
    }

    @After
    public static void tearDown(Scenario scenario) {

        //validate if scenario has failed
        if(scenario.isFailed()) {
            final byte[] screenshot = ((TakesScreenshot) HelperClass.getDriver()).getScreenshotAs(OutputType.BYTES);
            scenario.attach(screenshot, "image/png", scenario.getName());
        }

        HelperClass.tearDown();
    }
}

Step 6 – Create a TestNG Cucumber Runner class in the src/test/java

Below is the code for CucumberRunnerTests class.

package com.example.runner;

import io.cucumber.testng.AbstractTestNGCucumberTests;
import io.cucumber.testng.CucumberOptions;

@CucumberOptions(features = "src/test/resources/features/LoginPage.feature",
        glue = "com.example.definitions",
        plugin = {
                "pretty",
                "com.aventstack.chaintest.plugins.ChainTestCucumberListener:"
        }
)
public class RunnerTests extends AbstractTestNGCucumberTests {
}

Step 7 – Add ChainTest plugin to the runner class.

@CucumberOptions(plugin = { 
  "com.aventstack.chaintest.plugins.ChainTestCucumberListener:" 
})

Step 8 – Add chaintest.properties to src/test/resources directory

Add chaintest.properties to the classpath, example: src/test/resources/chaintest.properties.

# chaintest configuration
chaintest.project.name= ChaninTest Report with Cucumber and TestNG

# generators:
## chainlp
chaintest.generator.chainlp.enabled=true
chaintest.generator.chainlp.class-name=com.aventstack.chaintest.generator.ChainLPGenerator
chaintest.generator.chainlp.host.url=http://localhost/
chaintest.generator.chainlp.client.request-timeout-s=30
chaintest.generator.chainlp.client.expect-continue=false
chaintest.generator.chainlp.client.max-retries=3

## simple
chaintest.generator.simple.enabled=true
chaintest.generator.simple.document-title=chaintest
chaintest.generator.simple.class-name=com.aventstack.chaintest.generator.ChainTestSimpleGenerator
chaintest.generator.simple.output-file=target/chaintest/Index.html
chaintest.generator.simple.offline=false
chaintest.generator.simple.dark-theme=true
chaintest.generator.simple.datetime-format=yyyy-MM-dd hh:mm:ss a
chaintest.generator.simple.js=
chaintest.generator.simple.css=

## email
chaintest.generator.email.enabled=true
chaintest.generator.email.class-name=com.aventstack.chaintest.generator.ChainTestEmailGenerator
chaintest.generator.email.output-file=target/chaintest/Email.html
chaintest.generator.email.datetime-format=yyyy-MM-dd hh:mm:ss a

Step 9 – Create a testng.xml at the root directory.

Create a testng.xml at the root of the project. This xml holds parameter detail like allow passing parameters to test methods like browser name.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE suite SYSTEM "https://testng.org/testng-1.0.dtd">
<suite name="Suite">
    <test  name="Cucumber with TestNG Test">
        <classes>
            <class name="com.example.runner.RunnerTests"/>
        </classes>
    </test> <!-- Test -->
</suite> <!-- Suite -->

Step 10 – Run the tests from TestNG

You can execute the test script by right-clicking on TestRunner class -> Run As TestNG. (Eclipse)

In the case of the IntelliJ project, right-click on the runner class and select Run ‘RunnerTests’.

The execution status looks like as shown below. There are 5 tests and 1 test will fail.

Step 11 – View ChainTest Reports

ChainTest Reports are generated in target folder – Index.html and email.html.

Index.html

Right-click and open with Web Browser.

The index.html has a summary section that displays the summary of the execution. The summary includes the overview using a pictogram. It shows the start time and end time. The details of pass/fail tests are provided as shown in the image below.

Email.html

This report contains the high level summary of the test execution.

Step 12 – Run the tests through command line

To run the tests, use the below command

mvn clean test

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

You can get the project in GitHub, please refer this link

vibssingh

ChainTest Report Tutorials

Last Updated on

HOME

ChainTest Report is a comprehensive reporting framework supporting multiple generators – static, email & realtime, historical analytics with ChainLP.

Chapter 1 Replacement of Extent Report: ChainTest Report with Selenium and TestNG
Chapter 2 How to add logs and screenshot to ChainTest Report with TestNG – NEW
Chapter 3 ChainTest Report with Cucumber and TestNG – NEW
Chapter 4 ChainTest Report with Selenium and JUnit5 – NEW
Chapter 5 Run ChainTest Report on Docker – NEW
vibssingh

How to add logs and screenshot to ChainTest Report with TestNG

HOME

In the previous tutorial, will explain ChainTest Report and its implementation with Selenium with TestNG. In this tutorial, we will discuss the steps to add the screenshot for the failed tests in the ChainTest Report.

The chaintest-core client is the framework component that supports plugins to store embeds for each report. For example, with SimpleGenerator, the client saves all embeds relative to the report file in the resources folder.

Starting chaintest-testng plugin 1.0.5+, screenshots can be attached to tests while the test is in-flight or completing in the @BeforeMethod and @AfterMethod hooks.

@Test
public void testMethod(final Method method) {
  
//log
  ChainTestListener.log("log example");

  // embed
  ChainTestListener.embed(bytes, "image/png");
}

The complete implementation of ChainTest Report can be found here – Replacement of Extent Report: ChainTest Report with Selenium and TestNG

I have updated the BaseTests and added the implementation of adding the screenshots.

package com.example;

import com.aventstack.chaintest.plugins.ChainTestListener;
import com.aventstack.chaintest.service.ChainPluginService;
import org.openqa.selenium.OutputType;
import org.openqa.selenium.TakesScreenshot;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.chrome.ChromeOptions;
import org.openqa.selenium.edge.EdgeDriver;
import org.openqa.selenium.edge.EdgeOptions;
import org.openqa.selenium.firefox.FirefoxDriver;
import org.openqa.selenium.firefox.FirefoxOptions;
import org.testng.ITestResult;
import org.testng.annotations.*;

import java.time.Duration;

@Listeners(ChainTestListener.class)
public class BaseTests {

    public static WebDriver driver;
    public final static int TIMEOUT = 10;

    @BeforeTest
    @Parameters("browserName")
    public void setup(String browserName) throws Exception {

        System.out.println("Browser : " + browserName);

        switch (browserName.toLowerCase().trim()) {

            case "chrome":
                ChromeOptions options = new ChromeOptions();
                options.addArguments("--remote-allow-origins=*");
                options.addArguments("--no-sandbox");
                options.addArguments("--disable-dev-shm-usage");
                // options.addArguments("--headless");
                driver = new ChromeDriver(options);
                break;

            case "firefox":
                FirefoxOptions firefoxOptions = new FirefoxOptions();
                driver = new FirefoxDriver(firefoxOptions);
                break;
            case ("edge"):
                EdgeOptions edgeOptions = new EdgeOptions();
                driver = new EdgeDriver(edgeOptions);
                break;

            default:
                System.out.println("Incorrect browser is supplied...." + browserName);
                throw new IllegalArgumentException("WRONG BROWSER : " + browserName);
        }

        driver.manage().window().maximize();
        driver.get("https://the-internet.herokuapp.com/login");
        driver.manage().timeouts().implicitlyWait(Duration.ofSeconds(TIMEOUT));
    }

    @AfterMethod
    public void attachScreenshot(ITestResult result){
        if(!result.isSuccess()){
            ChainTestListener.embed(takeScreenshot(), "image/png");
        }
    }

    public byte[] takeScreenshot(){
        return ((TakesScreenshot)(driver)).getScreenshotAs(OutputType.BYTES);
    }

   @AfterTest
   public void tearDown() {
       driver.quit();
   }

}

How to add logs to the Report?

log is imported from package – import com.aventstack.chaintest.plugins.ChainTestListener;

ChainTestListener.log("Page Title :" + actualLoginPageTitle);

I have updated the LoginPageTests to add the logs also in the report.

package com.example;

import com.aventstack.chaintest.plugins.ChainTestListener;
import org.testng.Assert;
import org.testng.annotations.Test;

public class LoginPageTests extends BaseTests {

    String actualLoginPageTitle;
    String actualErrorMessage;
    String actualSecurePageTitle;

    @Test(priority = 0)
    public void verifyPageTitle() {

        actualLoginPageTitle = driver.getTitle();
        ChainTestListener.log("Page Title :" + actualLoginPageTitle);

        // Verify Page Title
        Assert.assertEquals(actualLoginPageTitle, "The Internet !!");

    }

    @Test(priority = 1)
    public void invalidCredentials() {

        LoginPage loginPage = new LoginPage(driver);
        loginPage.login("tomsmith", "happy!");
        actualErrorMessage = loginPage.getErrorMessage();
        ChainTestListener.log("Error Message :" + actualErrorMessage);

        // Verify Error Message
        Assert.assertTrue(actualErrorMessage.contains("Your password is invalid!"));

    }

    @Test(priority = 2)
    public void validLogin() {

        LoginPage loginPage = new LoginPage(driver);
        loginPage.login("tomsmith", "SuperSecretPassword!");

        SecurePage securePage = new SecurePage(driver);
        actualSecurePageTitle = securePage.getSecurePageTitle();
        ChainTestListener.log("Actual Dashboard Page Title :" + actualSecurePageTitle);

        // Verify Home Page
        Assert.assertTrue(actualSecurePageTitle.contains("You logged into a secure area!"));

    }

}

Execute the tests either using testng.xml or through command line

mvn clean test

The output of the above program is

Open the index.html report and we can see that the failed test has the screenshot attached to it.

Double click on the screenshot attached in the report and we can see the screenshot in the full screen.

Below highlighted ones are the logs mentioned in the LoginPageTests class.

Note:- The addition of screenshots for the failed test as well as the logs are only implemented in index.html report, and not in email.html.

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

vibssingh

Replacement of Extent Report: ChainTest Report with Selenium and TestNG

HOME

ExtentReport, one of the most popular and extensively used test reports, has been officially retired due to changes in automated testing techniques. The same developer, Anshoo Arora, fills the void with ChainTest, a potent reporting system. With its enhanced capabilities, real-time data, and seamless integration options, ChainTest is anticipated to transform how we see test results.

Table of Contents

  1. What is ChainTest Report?
  2. Key Features of ChainTest Report
  3. Prerequisite
  4. Dependency List
  5. Structure of Project
  6. Implementation
    1. Add ChainTest TestNG plugin dependency in Maven Project
    2. Create Pages and Test Code for the pages
    3. Add chaintest.properties
    4. Add ChainTestListener
    5. Create a testng.xml at the root directory
    6. Run the tests from testng.xml
    7. View ChainTest Reports
    8. Run the tests through command line

What is ChainTest Report?

ChainTest is a complete reporting system, it supports a variety of sources, including email, static data, and real-time, historical analytics with ChainLP. The next-generation reporting framework ChainTest was developed for a number of test frameworks, such as Cucumber, JUnit, and TestNG.

Key Features of ChainTest Report

Combination of Report – ChainTest generates a combination of static report, email and dynamic report.

Real Time Analysis – ChainTest’s incorporation of real-time statistics allows teams to monitor test executions in real time. This feature is very helpful for extensive testing projects with tight deadlines.

Simple SetUp – Setting up ChainTest is simple and quick with an easily accessible properties file. The setup procedure is streamlined by the ease with which users can specify project names, server URLs, and report options.

Support multiple test framework – This is compatible with a number of test frameworks, such as Cucumber, JUnit, and TestNG. Integration with PyTest is also expected to be available soon.

Docker-Enabled Setup – Docker simplifies the process of setting up ChainTest. The Chain LP server can be spun up in a matter of minutes by users by pulling the Docker image, which streamlines deployment and minimizes system requirements.

Monitoring of Historical Data – The historical data tracking tool, which enables teams to examine performance trends across several builds, is one notable feature. This makes it easier to spot trends and enhance test-taking techniques.

Prerequisite

  1. Java 17 is installed
  2. Maven is installed
  3. Eclipse or IntelliJ is installed

Dependency List:

  1. Selenium – 4.28.1
  2. Java 17
  3. TestNG – 7.10.2
  4. Maven – 3.9.6
  5. ChainTest TestNG – 1.0.7

Structure of Project

Implementation

Add ChainTest TestNG plugin dependency in Maven Project.

<dependency>
  <groupId>com.aventstack</groupId>
  <artifactId>chaintest-testng</artifactId>
  <version>${chaintest.testng.version}</version>
</dependency>

The complete pom.xml looks like as shown below:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.example</groupId>
  <artifactId>ChainTest_TestNG_Demo</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>jar</packaging>

  <name>ChainTest_TestNG_Demo</name>
  <url>http://maven.apache.org</url>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <selenium.version>4.28.1</selenium.version>
    <testng.version>7.10.2</testng.version>
    <chaintest.testng.version>1.0.7</chaintest.testng.version>
    <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
    <maven.compiler.source.version>17</maven.compiler.source.version>
    <maven.compiler.target.version>17</maven.compiler.target.version>
    <maven.surefire.plugin.version>3.2.5</maven.surefire.plugin.version>
    <aspectj.version>1.9.20.1</aspectj.version>
  </properties>

  <dependencies>

    <!-- Selenium -->
    <dependency>
      <groupId>org.seleniumhq.selenium</groupId>
      <artifactId>selenium-java</artifactId>
      <version>${selenium.version}</version>
    </dependency>

    <!-- TestNG -->
    <dependency>
      <groupId>org.testng</groupId>
      <artifactId>testng</artifactId>
      <version>${testng.version}</version>
      <scope>test</scope>
    </dependency>

    <!-- Chain Test Report -->
    <dependency>
      <groupId>com.aventstack</groupId>
      <artifactId>chaintest-testng</artifactId>
      <version>${chaintest.testng.version}</version>
    </dependency>
    
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>${maven.compiler.plugin.version}</version>
        <configuration>
          <source>${maven.compiler.source.version}</source>
          <target>${maven.compiler.target.version}</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>${maven.surefire.plugin.version}</version>
        <configuration>
          <suiteXmlFiles>
            <suiteXmlFile>testng.xml</suiteXmlFile>
          </suiteXmlFiles>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

Create Pages and Test Code for the pages

BasePage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.support.PageFactory;

public class BasePage {
    public WebDriver driver;

    public BasePage(WebDriver driver) {
        this.driver = driver;
        PageFactory.initElements(driver,this);
    }

}

LoginPage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class LoginPage extends BasePage {

    public LoginPage(WebDriver driver) {
        super(driver);

    }

    @FindBy(name = "username")
    public WebElement userName;

    @FindBy(name = "password")
    public WebElement password;

    @FindBy(xpath = "//*[@type='submit']")
    public WebElement loginBtn;

    @FindBy(xpath = "//*[@id='flash']")
    public WebElement errorMessage;

    public void login(String strUserName, String strPassword) {
        userName.sendKeys(strUserName);
        password.sendKeys(strPassword);
        loginBtn.click();
    }

    public String getErrorMessage() {
        return errorMessage.getText();
    }

}

SecurePage

package com.example;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.support.FindBy;

public class SecurePage extends BasePage {

    public SecurePage(WebDriver driver) {
        super(driver);

    }

    @FindBy(xpath = "//*[@id='flash']")
    public WebElement securePageTitle;

    public String getSecurePageTitle() {
        return securePageTitle.getText();
    }

}

BaseTests

package com.example;

import com.aventstack.chaintest.plugins.ChainTestListener;

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.chrome.ChromeOptions;
import org.openqa.selenium.edge.EdgeDriver;
import org.openqa.selenium.edge.EdgeOptions;
import org.openqa.selenium.firefox.FirefoxDriver;
import org.openqa.selenium.firefox.FirefoxOptions;
import org.testng.ITestResult;
import org.testng.annotations.*;

import java.time.Duration;

@Listeners(ChainTestListener.class)
public class BaseTests {

    public static WebDriver driver;
    public final static int TIMEOUT = 10;

    @BeforeTest
    @Parameters("browserName")
    public void setup(String browserName) throws Exception {

        System.out.println("Browser : " + browserName);
       
        switch (browserName.toLowerCase().trim()) {

            case "chrome":
                ChromeOptions options = new ChromeOptions();
                options.addArguments("--remote-allow-origins=*");
                options.addArguments("--no-sandbox");
                options.addArguments("--disable-dev-shm-usage");
                driver = new ChromeDriver(options);
                break;

            case "firefox":
                FirefoxOptions firefoxOptions = new FirefoxOptions();
                driver = new FirefoxDriver(firefoxOptions);
                break;
            case ("edge"):
                EdgeOptions edgeOptions = new EdgeOptions();
                driver = new EdgeDriver(edgeOptions);
                break;

            default:
                System.out.println("Incorrect browser is supplied...." + browserName);
                throw new IllegalArgumentException("Wrong Browser provided: " + browserName);
        }

        driver.manage().window().maximize();
        driver.get("https://the-internet.herokuapp.com/login");
        driver.manage().timeouts().implicitlyWait(Duration.ofSeconds(TIMEOUT));
    }

   @AfterTest
   public void tearDown() {
       driver.quit();
   }

}

LoginPageTests

package com.example;

import org.testng.Assert;
import org.testng.annotations.Test;

public class LoginPageTests extends BaseTests {

    String actualLoginPageTitle;
    String actualErrorMessage;
    String actualDashboardPageTitle;

    @Test(priority = 0)
    public void verifyPageTitle() {

        actualLoginPageTitle = driver.getTitle();

        // Verify Page Title - Failed Test
       Assert.assertEquals(actualLoginPageTitle, "The Internet !!");
    }

    @Test(priority = 1)
    public void invalidCredentials() {

        LoginPage loginPage = new LoginPage(driver);
         loginPage.login("tomsmith", "happy!");
        actualErrorMessage = loginPage.getErrorMessage();

        // Verify Error Message
        Assert.assertTrue(actualErrorMessage.contains("Your password is invalid!"));
    }

    @Test(priority = 2)
    public void validLogin() {

        LoginPage loginPage = new LoginPage(driver);
        loginPage.login("tomsmith", "SuperSecretPassword!");

        SecurePage securePage = new SecurePage(driver);
        actualSecurePageTitle = securePage.getSecurePageTitle();

        // Verify Home Page
        Assert.assertTrue(actualSecurePageTitle.contains("You logged into a secure area!"));
    }
}

Add chaintest.properties 

Add chaintest.properties to the classpath, example: src/test/resources/chaintest.properties.

# chaintest configuration
chaintest.project.name= ChaninTest Report with Selenium and TestNG

# generators:
## chainlp
chaintest.generator.chainlp.enabled=true
chaintest.generator.chainlp.class-name=com.aventstack.chaintest.generator.ChainLPGenerator
chaintest.generator.chainlp.host.url=http://localhost/
chaintest.generator.chainlp.client.request-timeout-s=30
chaintest.generator.chainlp.client.expect-continue=false
chaintest.generator.chainlp.client.max-retries=3

## simple
chaintest.generator.simple.enabled=true
chaintest.generator.simple.document-title=chaintest
chaintest.generator.simple.class-name=com.aventstack.chaintest.generator.ChainTestSimpleGenerator
chaintest.generator.simple.output-file=target/chaintest/Index.html
chaintest.generator.simple.offline=false
chaintest.generator.simple.dark-theme=true
chaintest.generator.simple.datetime-format=yyyy-MM-dd hh:mm:ss a
chaintest.generator.simple.js=
chaintest.generator.simple.css=

## email
chaintest.generator.email.enabled=true
chaintest.generator.email.class-name=com.aventstack.chaintest.generator.ChainTestEmailGenerator
chaintest.generator.email.output-file=target/chaintest/Email.html
chaintest.generator.email.datetime-format=yyyy-MM-dd hh:mm:ss a

Add ChainTestListener 

Add ChainTestListener in the list of @Listeners of the test class. Here, I have added this to BaseTests class.

@Listeners(ChainTestListener.class)
public class BaseTests {
}

Create a testng.xml at the root directory.

Create a testng.xml at the root of the project. This xml contains parameter detail like allow passing parameters to test methods ie browser name.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE suite SYSTEM "https://testng.org/testng-1.0.dtd">
<suite name="ChainTestReport with TestNG">

    <test name="Chrome Test">
        <parameter name="browserName" value="chrome" />
        <classes>
            <class name="com.example.LoginPageTests"/>
        </classes>
    </test> <!-- Test -->

    <test name="Firefox Test">
        <parameter name="browserName" value="firefox" />
        <classes>
            <class name="com.example.LoginPageTests"/>
        </classes>
    </test> <!-- Test -->

    <test name="Edge Test">
        <parameter name="browserName" value="edge" />
        <classes>
            <class name="com.example.LoginPageTests"/>
        </classes>
    </test> <!-- Test -->

</suite> <!-- Suite -->

Run the tests from testng.xml.

Right click on testng.xml and select Run ‘…\testng.xml’

The execution status looks like as shown below. There are 3 tests and 1 test will fail. These 3 tests are executed in 3 different browsers – Chrome, Firefox and Edge. So, total we are executing 9 tests and out of them 6 passed and 3 failed.

View ChainTest Reports

ChainTest Reports are generated in target folder – Index.html and email.html.

Index.html

Right-click and open with Web Browser.

The index.html has a summary section that displays the summary of the execution. The summary includes the overview of the pass/fail using a pictogram, start time, end time, and pass/fail details of tests as shown in the image below.

Email.html

This report contains the high level summary of the test execution.

Run the tests through command line

To run the tests, use the below command

mvn clean test

We are done! Congratulations on making it through this tutorial and hope you found it useful! Happy Learning!!

vibssingh

What is Security Testing in API?

HOME

Table of Contents

  1. What is Security Testing?
  2. What is Security Testing in API?
  3. Why Do You Need API Security Testing?
  4. What are the common security vulnerabilities found in API?
    1. Rest APIs
    2. SOAP APIs
    3. JSON-RPC and XML-RPC
    4. GraphQL
  5. Types of API Security Testing
    1. Dynamic API Security Tests
    2. Static API Security Tests
    3. Software Composition Analysis

What is Security Testing?

Security Testing is a type of software testing that aims to identify and address vulnerabilities and threats in an application to ensure that its data and resources are protected against potential intrusions, misuses, and breaches. The primary goal of security testing is to ensure that the software is robust and secure from external and internal threats.

What is Security Testing in API?

API security testing is a process of evaluating API endpoints to identify and remediate vulnerabilities such as fuzzy input, parameter tampering, or injection attacks. Historically, this was done through penetration testing or manual scanning of the APIs by an enterprise security team. However, teams are shifting to running API security tests as part of the DevOps pipeline, ensuring that security issues are caught early in the development lifecycle.

Why Do You Need API Security Testing?

1. Protection of Sensitive Data – APIs often handle sensitive data, including personal information, financial data, and proprietary business information. Security testing helps ensure that this data is protected from unauthorized access, breaches, and leaks.
Examples: Ensure data in transit is encrypted; prevent exposure of Personally Identifiable Information (PII)

2. Prevent Unauthorized Access: APIs typically serve as the gateway to an application’s backend and other critical infrastructure. Security testing helps to identify and mitigate flaws in authentication and authorization mechanisms, preventing unauthorized access.
Examples: Ensuring proper use of API keys, tokens, and OAuth; verifying role-based access control (RBAC).

3. Ensuring Service Availability: Malicious actors can exploit vulnerabilities to launch Denial-of-Service (DoS) attacks, overwhelming your APIs and making them unavailable to legitimate users. Robust API penetration testing tools help uncover these weaknesses, allowing you to implement measures that prevent such attacks and ensure reliable service for your users.

4. Maintaining Compliance: Industrial regulations, such as HIPAA, GDPR, ISO, and SOX, mandate specific security controls during data handling. Failure to comply with such regulations due to API vulnerabilities can lead to hefty fines and legal liabilities. Security testing ensures that APIs comply with these regulatory requirements and avoid legal penalties.
Examples: Encrypting sensitive data, maintaining proper access logs, and ensuring data integrity.

5. Prevent Injection Attacks: Injection attacks, such as SQL injection and command injection, can compromise the security of API endpoints and underlying systems. Security testing helps identify and remediate these vulnerabilities by validating input handling and data sanitization processes.
Examples: Testing for SQL injection flaws; ensuring proper input validation.

6. Improving Stakeholder Trust: Customers and partners entrust the company with their data when they interact with their APIs. Regular security testing demonstrates your commitment to data protection, strengthening business relationships, and fostering customer confidence in your services.

What are the common security vulnerabilities found in API?

Rest APIs

REST APIs or RESTful APIs are stateless APIs that use simple HTTP requests to access and use data. It is one of the most used types of API due to its simplicity and flexibility of implementation in any language.

Common Vulnerabilities in REST APIs


1. Broken Authentication and Session Management: Weak authentication mechanisms can lead to unauthorized access. Use of tokens and proper handling of sessions is crucial.

2. Broken Access Control: Insufficient enforcement of user permissions can lead to unauthorized access to endpoints. Implement role-based access control (RBAC) and least privilege principle.

3. Sensitive Data Exposure: Failure to encrypt sensitive data both in transit and at rest. Use HTTPS, encrypt sensitive data and avoid exposing unnecessary data in API responses.

4. Lack of Rate Limiting: Failure to implement request throttling can result in Denial of Service (DoS) attacks. Implement rate limiting and quotas to control abuse.

5. Injection Attacks: Attackers insert malicious code into the requests to manipulate the APIs’ intended behavior. SQL Injection, Host-Header Injection, and Command Injection are some of the most common attacks.

6. Insufficient Logging and Monitoring: Lack of proper logging mechanisms can lead to undetected security incidents. Enforce comprehensive logging and monitoring for suspicious activities.

SOAP APIs

SOAP, or Simple Object Access Protocol, uses XML-based messaging to transfer data between the client and server. 

Common Vulnerabilities in SOAP APIs

1. XML External Entity (XXE) Attacks: An attacker can manipulate XML data to exploit vulnerabilities in the XML parsers. Disable DTDs (Document Type Definitions) and external entity references.

2. Inadequate Input Validation: SOAP messages may not be thoroughly checked for integrity. Validate and sanitize all incoming XML content.

3. WS-Security Misconfigurations: Weak or improperly configured WS-Security policies can lead to security lapses. Ensure robust WS-Security configurations including encryption and digital signatures.

4. Token Replay Attacks: Reuse of tokens for unauthorized API requests. Implement mechanisms to detect and prevent token reuse, such as timestamps and nonces.

5. WSDL Exposure: If the WSDL file is exposed to the attackers, they can view detailed information about the API structure and operations, allowing them to craft more targeted attacks.

JSON-RPC and XML-RPC

JSON-RPC and XML-RPC are remote call protocols that use JSON and XML, respectively, to communicate between the client and the server. They send an HTTP request to a server that implements RPC and receives an HTTP response.

Common Vulnerabilities in JSON and XML RPC:

1. Brute Force Attacks: These attacks involve attempting various combinations of user credentials to gain unauthorized access. XML-RPC can be easily leveraged as an entry point for attacks and can execute multiple login attempts rapidly, leading to brute-force attacks.

2. Remote Code Execution: In this attack, attackers can execute malicious code on the server from a remote connection. 

GraphQL

GraphQL is a flexible and efficient query language for APIs. It allows the client side to request the exact amount of data required to reduce data over- and underfetching.

Common Vulnerabilities Found in GraphQL APIs

1. Injection Attacks: Attackers insert malicious code into the requests to manipulate the APIs’ intended behavior. SQL Injection, Host-Header Injection, and Command Injection are some of the most common attacks.

2. Introspection Attack: It exploits an API’s introspection endpoint to gather information about access tokens, exposing sensitive details that attackers can use to compromise security. Introspection endpoints are designed to validate and retrieve metadata about tokens, such as their scopes, expiration, and the user they represent. If improperly secured, attackers can leverage them to gain unauthorized access or manipulate token data.

Types of API Security Testing

Dynamic API Security Tests

Dynamic API Security Testing involves testing the security of APIs during runtime. It dynamically interacts with the API, sends various requests with different payloads, and observes how the API behaves under different conditions to identify security vulnerabilities. 

Running a dynamic API security test simulates an actual API-based attack and surfaces vulnerabilities introduced from both open-source dependencies and the code your team wrote.

 OWASP ZAP (Zed Attack Proxy) – It is an open-source web application security scanner designed to find vulnerabilities in web applications and APIs.

Burp Suite – It is a comprehensive web vulnerability scanner that supports both automated and manual testing. It is used for the advanced scanning for API vulnerabilities and support for GraphQL, SOAP, and REST APIs.

SQLMap – It is an open-source penetration testing tool for automating SQL injection detection and exploitation. It supports various types of SQL injection attacks.

Static API Security Tests

Static analysis security testing tools look at the source code of the application to identify potential vulnerabilities. This form of testing looks for patterns in the code that represent potential security concerns. These tools are language-dependent, meaning you have to use a static tool that matches the language your API is written in.

SonarQube – It is an open-source platform that inspects code quality and security.

Checkmarx – It is a comprehensive static application security testing tool that focuses on security vulnerabilities.

Fortify Static Code Analyzer (SCA) – It is a static analysis tool by Micro Focus that identifies security vulnerabilities in source code.

Software Composition Analysis

Software Composition Analysis (SCA) tools look at the dependency tree of your application and match this against a database of known vulnerabilities. Using these tools, you would be alerted if your application or API uses a library or framework with a known vulnerability. With the ever-increasing use of open source in API development, these tools are essential to include in security testing. The limitations of SCA tools are that (1) they generally do not surface if the vulnerability is actually exploitable within your API, and (2) they only capture open-source vulnerabilities, not security bugs your team may have introduced.

Black Duck by Synopsys – Comprehensive SCA tool that identifies open-source components, assesses vulnerabilities, and manages license compliance.

Snyk – Developer-friendly tool that integrates with CI/CD pipelines to detect and fix open-source vulnerabilities in dependencies.

WhiteSource – Tool focused on managing open-source components, identifying vulnerabilities, and ensuring license compliance.

vibssingh

Multiple Choice Questions for Security Testing on API Testing

HOME

Security Quiz – You can test your knowledge with this Security Testing. 

1. What is the primary goal of security testing in API testing?

a) To ensure the API functions as expected
b) To verify the API’s security features against potential vulnerabilities
c) To check API response times
d) To test the user interface of the API

Answer 1

b) To verify the API’s security features against potential vulnerabilities

2. Which of the following is a common security vulnerability in APIs?

a) SQL Injection
b) Cross-Site Scripting (XSS)
c) Cross-Site Request Forgery (CSRF)
d) All of the above

Answer 2

d) All of the above

3. Which attack can occur if an API does not properly validate user inputs?

a) Cross-Site Scripting (XSS)
b) Denial of Service (DoS)
c) SQL Injection
d) Both a and c

Answer 3

d) Both a and c

4. What type of vulnerability can occur if an API leaks sensitive information in error messages?

a) Data Injection
b) Information Disclosure
c) XML External Entity (XXE)
d) Broken Object Level Authorization (BOLA)

Answer 4

b) Information Disclosure

5. Which of these is a common tool used for API security testing?

a) Postman
b) Burp Suite
c) Swagger
d) Selenium

Answer 5

b) Burp Suite

6. Which of the following is NOT a common security mechanism used for APIs?

a) OAuth
b) JWT (JSON Web Token)
c) SSL/TLS
d) XML Parsing

Answer 6

d) XML Parsing

7. What does the term “Rate Limiting” refer to in API security?

a) The process of limiting the number of API requests a user can make within a specified time period
b) The restriction of access to a specific set of users based on their IP address
c) The process of allowing only authenticated users to access the API
d) The encryption of data being sent in API requests

Answer 7

a) The process of limiting the number of API requests a user can make within a specified time period

8. What is the primary purpose of using an API token for authentication?

a) To ensure that the API request is coming from a valid user or system
b) To speed up the API response
c) To make the API endpoint accessible to everyone
d) To increase the load on the server

Answer 8

a) To ensure that the API request is coming from a valid user or system

9. What is the best practice to prevent SQL Injection in API testing?

a) Allowing raw user inputs in the SQL queries
b) Using parameterized queries or prepared statements
c) Relying only on the database’s built-in security
d) Allowing all API inputs

Answer 9

b) Using parameterized queries or prepared statements

10. Which of the following is a technique for testing the authorization of API access?

a) Testing if an API endpoint allows unauthenticated requests
b) Testing the validity of an API token
c) Ensuring that API responses include proper status codes for unauthorized access (e.g., 401, 403)
d) All of the above

Answer 10

d) All of the above

11. What is the significance of encryption in API security?

a) To ensure data integrity by verifying the data is not tampered with
b) To ensure data is securely transmitted and cannot be easily read by unauthorized users
c) To speed up the API response
d) To allow multiple API users to access the same data

Answer 11

b) To ensure data is securely transmitted and cannot be easily read by unauthorized users

12. Which of the following API security measures helps in protecting sensitive data during transmission?

a) Use of HTTPS
b) IP Whitelisting
c) User Authentication
d) Query String Parameters

Answer 12

a) Use of HTTPS

13. What type of attack does Cross-Site Request Forgery (CSRF) typically target in API security?

a) It exploits the trust that a site has in the user’s browser
b) It targets the API endpoint to inject malicious code
c) It exploits weaknesses in the client-side JavaScript
d) It bypasses authentication mechanisms

Answer 13

a) It exploits the trust that a site has in the user’s browser

14. Which method is commonly used to protect sensitive data in APIs during storage?

a) Encryption
b) Caching
c) Compression
d) Rate Limiting

Answer 14

a) Encryption

15. What type of API attack involves sending malicious code through input fields to compromise the server or database?

a) Cross-Site Scripting (XSS)
b) SQL Injection
c) Man-in-the-Middle (MitM)
d) DoS (Denial of Service)

Answer 15

b) SQL Injection

16. Which of the following is a valid security mechanism to prevent API key theft?

a) Store the API key in a local text file
b) Use secure methods like OAuth for authentication
c) Embed API keys directly in the frontend JavaScript code
d) None of the above

Answer 16

b) Use secure methods like OAuth for authentication

17. What is Broken Object Level Authorization (BOLA)?

a) An attack that exploits poor input validation
b) A vulnerability where users can access objects they are not authorized to view
c) A flaw in API rate limiting implementation
d) A security gap caused by misconfigured SSL/TLS settings

Answer 17

b) A vulnerability where users can access objects they are not authorized to view

18. What does the term API spoofing refer to in security?

a) Manipulating API responses to deceive users
b) Impersonating a legitimate user or system to gain unauthorized access
c) Intercepting API requests and altering data during transmission
d) Exploiting an API vulnerability to crash the server

Answer 18

b) Impersonating a legitimate user or system to gain unauthorized access

19. Which of the following is a best practice for securing API endpoints?

a) Using a single access key for all users
b) Applying security measures such as authentication, encryption, and authorization for every API request
c) Allowing unlimited access to the API without any restrictions
d) Not validating input from users

Answer 19

b) Applying security measures such as authentication, encryption, and authorization for every API request

20. Which of the following is an example of an insecure API design practice?

a) Using secure, token-based authentication (OAuth)
b) Storing API keys in a public GitHub repository
c) Encrypting sensitive data in transit
d) Implementing rate limiting

Answer 20

b) Storing API keys in a public GitHub repository

21. What is the primary function of OAuth in API security?

a) To enable public access to APIs
b) To authenticate and authorize users securely for API access
c) To protect the API server from being overloaded
d) To validate data inputs

Answer 21

b) To authenticate and authorize users securely for API access

22. Which HTTP status code indicates that a client is not authorized to access a resource?

a) 200 OK
b) 401 Unauthorized
c) 500 Internal Server Error
d) 404 Not Found

Answer 22

b) 401 Unauthorized

23. Why is it essential to validate API responses?

a) To minimize bandwidth usage
b) To detect unauthorized data leakage
c) To ensure API compatibility with browsers
d) To verify that the API uses REST principles

Answer 23

b) To detect unauthorized data leakage

24. What type of API attack involves overwhelming the server with a massive number of requests?

a) SQL Injection
b) XML Injection
c) Denial of Service (DoS)
d) Man-in-the-Middle (MITM)

Answer 24

c) Denial of Service (DoS)

25. What is the purpose of using CORS (Cross-Origin Resource Sharing) in API security?

a) To block all external access to APIs
b) To prevent unauthorized domains from accessing API resources
c) To speed up API communication
d) To allow unrestricted access to API endpoints

Answer 25

b) To prevent unauthorized domains from accessing API resources