In this chapter, we mainly discussed how to apply a BDD framework to security testing. The security testing process and results can be difficult to understand for a non-security team; the adoption of a BDD security framework can reduce the communication gap. For example, a security team may test for POODLE vulnerability; in business language, that would be the verification of the secure communication of TLS.
We introduced two automation frameworks, Robot Framework and Gauntlt. Robot Framework uses a keyword-driven approach to define the testing steps and Gauntlt uses a GWT approach to define the testing scripts. We demonstrated the testing of SQL injection by using sqlmap, and illustrated how Robot Framework can be used to execute sqlmap . In the Robot Framework script, we use Execute Command to execute sqlmap, and we define the expected results by using Should Not Contain...
