Case 3 – fuzz XSS and SQLi testing with JMeter

In Case 3, we will demonstrate the same user flows as in Case 2. The key difference in Case 3 is that we will have the data input with SQL injection payloads. This will be done by using Jmeter with FuzzDB and CSV Config elements. In Chapter 13, Automated Infrastructure Security, we will also demonstrate how to do fuzz SQLi testing with selenium and Robot Framework.

Testing scenarios

After user sign-in, particularly in step 6, we will be using JMeter to send HTTP requests with FuzzDB security loads through the OWASP ZAP proxy to the target testing website, NodeGoat.

The testing steps are as follows:

1. Sign in to NodeGoat with the username User1 and password User1_123
2. Visit...