1. Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation LASCON 2010 Austin, Tx http://www.owasp.org Automating Web Testing Beyond OWASP WebScarab Using Python Brad Causey OWASP Guy IISFA Guy brad.causey@owasp.org

2. LASCON 2010 2 About Brad  Survivalist  MMA  Local Cop  Gun Enthusiast  Married with 5 Kids

3. LASCON 2010 3 About Brad  Instructor for 8 years  Various Publications  Books  BBVA Compass Security Analyst  Training videos  OWASP GPC  OWASP Alabama Chapter Lead  IISFA Alabama Chapter Lead

4. LASCON 2010 4 Why are we here?  Have the need to Automate tests  Some of these are difficult  Adapt to the app  WebScarab and Python are pretty popular

5. LASCON 2010 5 Why WebScarab?  Open Source  Scriptable  Uses text to store data  Cross-Platform  Browser Agnostic

6. LASCON 2010 6 WS Configuration and Special Notes  Saved Session Structure  Scripting  http://www.owasp.org/index.php/Scripting_in_ WebScarab import org.owasp.webscarab.model.HttpUrl; import org.owasp.webscarab.model.Request; import org.owasp.webscarab.model.Response;

7. LASCON 2010 7 WS Advanced Features  Search  Extensions  Session ID Analysis  XSS  Tagging

8. LASCON 2010 8 WS Weaknesses  AJAX  Performance  Output Format  Reporting

9. LASCON 2010 9 Why Python?  Open Source Interpreter  Plain Text  Great Support  Cross-Platform  Text Processing

10. LASCON 2010 10 A Python Primer  very clear, readable syntax  strong introspection capabilities  intuitive object orientation  natural expression of procedural code  exception-based error handling  very high level dynamic data types  extensive standard libraries  embeddable within applications as a scripting interface

11. LASCON 2010 11 Useful Python Libraries  string  Built-in Library .find .index .count

12. LASCON 2010 12 Useful Python Libraries  urllib2  Built-in Library .urlopen  Encoding  Data (for request)

13. LASCON 2010 13 Gluing the two together  WebScarab Files  Python File Reader  WebScarab Storage in-depth

14. LASCON 2010 14 Possibilities are endless!  Http Methods testing  Post/Get fuzzing  Cookies? Yes!  import cookielib, urllib2  http://docs.python.org/library/cookielib.html

15. LASCON 2010 15 Demo! http://cdn1.gamepro.com/article_img/gamepro/ 214635-1.jpg?rand=2487A2F8-E22A-95A8- 2C5A303E3847C9A2

16. LASCON 2010 16 The Norris convention center?