3

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong to ask this question.

2

If you boil an XSS exploit down to the basics, it's just inserting text in a field. In this regard, yes Selenium WebDriver could be used to carry out an XSS attack by inserting the appropriate code into text fields.

That said, there is a lot more to effecting an XSS attack than just inserting a script into text fields. You could just scan pages for text fields and blindly insert your payload, hoping for the best, but I wouldn't imagine it being a very effective delivery system. Then you come to the hurdle of verifying whether or not a payload was successful or not. You could reload the page and scan the DOM for your script, obviously countering any nasty surprises you inserted, and verify it that way but it doesn't sound very efficient. There is a research/discovery period in any successful attack unless you just hope to strike it lucky.

From a test automation / QA point of view I could see it being useful in terms of pen testing or regression testing. You can attempt to carry out XSS attacks on fields within your web application. Inserting script tags and ensuring the input is either rejected or handled properly depending on the expected outcome could be useful.

It really depends what your goal is. Are you looking to test and secure your own app or find vulnerabilities in others?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.