Adoption of Robot Framework with sqlmap

Let's take SQL injection testing as a simple example to see the effects of Robot Framework adoption. As the business objective, we would like to avoid any SQL injection attacks, which may result in authentication bypasses, information leakage, authorization bypasses, and command injection. Before integration with Robot Framework, SQL injection execution by sqlmap will be as follows:

$ python sqlmap.py   -u    "http://demo.testfire.net/"    -- batch    --banner

The following is an excerpt from the sqlmap testing results. If these results were just delivered to stakeholders with no context, few stakeholders would be able to understand the report:

[xx:xx:39] [INFO] heuristic (basic) test shows that GET parameter 'id' might be 
injectable (possible DBMS: 'MySQL')
[xx:xx:39] [INFO] testing for SQL injection on GET parameter 'id'
[xx:xx:39] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE or HAVING clause '
[xx:xx:39] [INFO] GET parameter 'id' is 'MySQL >= 4.1 AND error-based - WHERE or
HAVING clause' injectable
GET parameter 'id' is vulnerable.

The following steps show how this is done.On the other hand, if we apply Robot Framework to execute sqlmap, the Robot Framework execution script would be much more understandable, as certain keywords are used to define the testing steps. 

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.225.31.159