The domain of automation includes white-box code inspection, unit testing, acceptance testing, integration testing, API testing, and end-to-end UI testing. In terms of implementation effort, unit testing and white-box inspection usually take the least effort, while UI testing often takes the most effort, particularly in order to understand the UI business flow.

Therefore, most automated testing cases are done with unit testing or API-level testing. Automated UI testing may only cover the scenarios from a user perspective while the API testing may cover more business logic or exception handling use cases. The following diagram illustrates the different levels of automation testing and how much effort they take.

On the other hand, the domain of security testing can be much broader. The following...

In this section, we will introduce some common automation testing frameworks, covering API, functional, UI, and mobile testing. Understanding the key characteristics of each automation framework will help the security team know how to integrate security testing and figure out what can be improved by automation.

UI functional testing looks at the end user's perspective. It walks through the UI flow and verifies the response from the GUI. There are three testing target platforms: web services, mobile applications, and Windows applications. The following table lists some common open source/free automation frameworks:

If the team already have certain security testing measures in place and would like to apply an automation testing framework to improve efficiency or reduce manual execution efforts, there are some recommended automation frameworks the team may consider. The following table details the automation frameworks that may help in various kinds of security testing scenarios:

If the team has done some automation testing, security testing can be built on top of it. For security testing to be integrated with automation frameworks, we need to consider the input data for the tool, the support of the API or CLI to trigger the execution, and the preferred testing report format, such as JSON, XML, or CSV. In addition, in order to consolidate all the testing reports generated by various security testing tools, we will introduce OWASP DefectDojo to import all the security findings and the security dashboard presentation. Therefore, the output format of the security testing tools is also part of the security testing tool selection criteria.

The following table lists some recommended security testing tools that provide flexible interfaces for automation framework integration, and the output formats can be...

This chapter introduces the integration of security and automation. The domain of automation testing covers white-box code inspection, unit testing, API testing, integration testing, and end-to-end UI integration testing. The automation technique being used may depend on the effort required and the automation rate. The security testing domain was also explored in this chapter. We will primarily be focused on common security issues for web applications and mobile applications, such as password attacks, data validation, information disclosure, session management, and secure transmission.

We also illustrated some security testing scenarios where automation frameworks can help. For example, the Selenium Web UI framework is used to walk through the UI flow for security tools to inspect security issues. JMeter can be used with security payloads to do RESTful API security testing...

1. Which one of these is not part of security testing domain?
   1. BDD
   2. Information gathering
   3. Data validation
   4. Cryptography

2. Which one of the following is not used for UI functional testing?
   1. AutoIT
   2. Selenium
   3. Appium
   4. ZAP

3. Which of the following is used for HTTP API testing?
   1. JMeter
   2. Fiddler
   3. Python requests
   4. All of the above
4. Which of these is not the purpose of using a mock server?
   1. Reducing the dependencies of the backend web services
   2. Defining standard HTTP responses
   3. Doing UI functional testing
   4. Responding to the HTTP requests
5. Which of these is used for known vulnerabilities scanning?
   1. OpenVAS
   2. OWASP Dependency Check
   3. RetireJS
   4. All of above

• Arachni Scanner: http://www.arachni-scanner.com/
• OWASP ZAP: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
• OWASP Dependency Check: https://www.owasp.org/index.php/OWASP_Dependency_Check
• OpenVAS: http://www.openvas.org/
• RetireJS: https://retirejs.github.io/retire.js/
• SecLists: https://github.com/danielmiessler/SecLists
• Nmap: https://nmap.org/
• ssllabs-scan: https://github.com/ssllabs/ssllabs-scan
• VCG: https://github.com/nccgroup/VCG/tree/master/VCG-Setup/Release
• Automated security testing for REST APIs: https://github.com/flipkart-incubator/Astra
• WireMock: http://wiremock.org/
• MockJS: http://mockjs.com/examples.html
• MockBin: https://github.com/Kong/mockbin
• PACT Python: https://github.com/pact-foundation/pact-python/
• Power Mock: https://github.com/powermock/powermock
• Mock-Server: http://www.mock-server.com/#why-use-mockserver
• WireMock: https://github...