{"id":999,"date":"2022-03-27T14:22:36","date_gmt":"2022-03-27T03:22:36","guid":{"rendered":"http:\/\/clickworks.me\/?p=999"},"modified":"2023-04-07T19:49:50","modified_gmt":"2023-04-07T09:49:50","slug":"browser-developer-tools-and-knowledge-of-api-in-functional-security-testing","status":"publish","type":"post","link":"https:\/\/clickworks.me\/index.php\/2022\/03\/27\/browser-developer-tools-and-knowledge-of-api-in-functional-security-testing\/","title":{"rendered":"Examples of using  browser developer tools and knowledge of API in functional and security testing"},"content":{"rendered":"<p>I am relatively new to API testing so I have very little experience using API testing in real projects. However, I&#8217;d like to share some interesting findings and show how API testing skills can aid everyday testing activities.<\/p>\n<p>This is also a good example of how MoT and testing courses help me grow as a tester. <a title=\"MoT's 30 Days of API Testing challege\" href=\"http:https:\/\/www.ministryoftesting.com\/dojo\/lessons\/30-days-of-api-testing\/\/\">MoT&#8217;s 30 Days of API Testing challege<\/a> inspired me to write this post.<\/p>\n<h2>&#8220;Edit and resend&#8221; in Firefox can help you find security issues<\/h2>\n<p>I learned about this Firefox feature during the <a title=\"Rapid Software Testing  Explored online course which I took in 2021 \" href=\"http:\/\/clickworks.me\/index.php\/2021\/10\/03\/rapid-software-testing-explored-online-course-hosted-by-michael-bolton-august-2021\/\">Rapid Software Testing Explored online course which I took in 2021 <\/a>. Later I sterted using this knowledge in my testing and realised how useful it can be.<\/p>\n<p>I was testing a workflow approval scenario. The workflow went through various stages: submit workflow, review, onboard user, approve\/reject, etc. There were multiple types of fields (text, number, boolean, list, muli-list) that had different states (editable\/locked) depending on the stage of the process and user permissions.<\/p>\n<p>After initial exploration using UI, I tried to manipulate fields using API. This is where I discovered interesting thing: I could update one of the fields using &#8220;Edit and resend&#8221; feature in Firefox although the field was &#8220;locked&#8221; (not editable using UI).<\/p>\n<p>I find this feature very helpful. You can edit and resend previous API requests and explore how application responds directly in the browser without launching external tools like Postman.<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/clickworks.me\/wp-content\/uploads\/2022\/03\/Edit-and-resend22-in-Firefox-can-help-you-find-security-issues--1024x258.jpeg\" alt=\"\" \/><\/p>\n<h2>Using &#8220;copy as Fetch&#8221; feature and sending multiple requests in browser console<\/h2>\n<p><strong>Another example<\/strong> is related to issue where our app was using this ABN lookup service <a href=\"https:\/\/abr.business.gov.au\/Tools\/WebServices\">Web services | ABN Lookup<\/a> to return company name when user enters business number. Using exploratory testing I discovered that for certain types of business entities it did not work.<\/p>\n<p>Later when I learned more about using Chrome console, I experimented with this test to see if I could use some automation to check the response for for a large number of input data. Instead of trying to submit different data through UI manually and see the result, I used &#8220;copy as Fetch&#8221; feature of Chrome. This gives you JS code that you can edit and resend in console.<\/p>\n<p>I created an array of 100 business numbers and used the copied fetch request to run it in a loop passing one element from my array at a time. I did it directly in Chrome console. It took less than 1 sec to check the response against 100 elements.<\/p>\n<p>This is another example of how API skills can help us test better and faster. Yes, it took some time to write the code but I think it was worth it. Next time I can reuse this template and it will save me time when I need to test against a large set of data.<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/clickworks.me\/wp-content\/uploads\/2022\/03\/Using-22copy-as-Fetch22-feature-and-sending-multiple-requests-in-browser-console-1024x428.jpeg\" alt=\"\" \/><\/p>\n<p>Here is example<\/p>\n<pre><code class=\"language-javascript\">async function postAbn(url = &#039;&#039;, data = {}) {\n const response = await fetch(url, {\n    &#039;credentials&#039;: &#039;include&#039;,\n    &#039;headers&#039;: {\n               ...\n    },\n    &#039;body&#039;: JSON.stringify(data),\n    &#039;method&#039;: &#039;POST&#039;,\n    &#039;mode&#039;: &#039;cors&#039;\n});\nreturn response.json();\n}<\/code><\/pre>\n<p>Run the above snippet in browser console.<\/p>\n<p>Use async function and array to run multiple requests.Again, open console and execute:<\/p>\n<pre><code class=\"language-js\">arr = [&#039;62 056 429 504&#039;,&#039;62 726 330 943&#039;]<\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre><code class=\"language-javascript\">arr.map((n) =&gt;\n  postAbn(&quot;https:\/\/host\/api\/bus-number&quot;, { businessNumber: `${n}` }).then(\n    (data) =&gt; {\n      console.log(data[&quot;organisationName&quot;]);\n    }\n  )\n);<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>I am relatively new to API testing so I have very little experience using API testing in real projects. However, I&#8217;d like to share some interesting findings and show how API testing skills can aid everyday testing activities. This is also a good example of how MoT and testing courses help me grow as a tester. MoT&#8217;s 30 Days of API Testing challege inspired me to write this post. &#8220;Edit<\/p>\n<div class=\"read-more\"><a class=\"btn read-more-btn\" href=\"https:\/\/clickworks.me\/index.php\/2022\/03\/27\/browser-developer-tools-and-knowledge-of-api-in-functional-security-testing\/\">Read More<\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[57,1],"tags":[79,87,86,88,89],"post_folder":[],"_links":{"self":[{"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/posts\/999"}],"collection":[{"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/comments?post=999"}],"version-history":[{"count":14,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/posts\/999\/revisions"}],"predecessor-version":[{"id":1158,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/posts\/999\/revisions\/1158"}],"wp:attachment":[{"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/media?parent=999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/categories?post=999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/tags?post=999"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/clickworks.me\/index.php\/wp-json\/wp\/v2\/post_folder?post=999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}