Using Variables in Multi-Step Operations

上一篇 / 下一篇  2010-08-11 15:24:06 / 个人分类:IBM Appscan Security Scan

Technote (FAQ)
 
Question
How can variables be implemented in a multi-step sequence with IBM Rational AppScan Standard Edition? This technote provides a scenario for where a variable will be useful along with details on how to make it work.
 
Cause

When recording a multi-step sequence that requires a form. parameter, the parameter value cannot be changed. This means that once a value has been entered in a particular form. field, the value cannot be altered. This causes a problem during the testing phase, due to the same form. being submitted multiple times, leading to an error because the value is not unique.

Example:

On page A, there is a form. field that requires a unique value. If page A is visited again, the same value cannot be entered. If the value is not unique, then you do not get to page B.

It will be helpful to get AppScan Standard Edition to enter a unique value every time it visits this page.

 
Answer

Overview

AppScan has the ability to useSequence Variables. These variables can be appended to a parameter's value, or replace the value, making AppScan enter a unique value each time it submits a form.

Note:Currently, there is no way to define a configuration for sequence variables in AppScan. The only way to define such parameters is to manually edit a sequence file (using text editor).


Manually edit the Sequence File

To begin, perform. the following steps:
  1. Record the multi-step sequence in AppScan

  2. Export the result and save it locally

  3. Open up the saved file in a text editor


Modifying the Values

Setting a parameter asSequence Variableis done by modifying the values of the problematic parameters in the sequence text file described above.

Example:

If the user wants to modify all pages in their sequence where "Nick0001" was entered as a value, they can then define a wildcard to say enter "Nick" followed by a random 4 digit integer as a value for any parameters that uses it in the sequence. The user will find and replace all relevant instances of the "Nick0001" with their "Sequence Variable" entry in the sequence file.

The "Sequence Variable" will be a global setting so that when an instance of a particular explore sequence is running, the new value will be used throughout the sequence. The next time a new instance of the same sequence is running (for the next test), a new value will be generated, and so on.


Parameter Definition Example

Here is an example of parameter definition (from the sequence file) that contains "Sequence Variable":



In this example, the name of the sequence variable is itemID and the value that will be sent is a 5 characters random string.

To append a random string to the end of a parameter the definition would look like:



When AppScan submits the _%24RokId parameter, its value looks like
BEGINNINGVALUEdfndo


Types of Sequence Variables that can be used

Note: Any reference below to [variable id] is meant to uniquely identify a group of variables so that two identical variables can generate two different values if required by the user defining a new id, otherwise if the same id exists, the exact same generated value will be associated with it for any given iteration of a sequence:
  1. __SeqVariable__[variable id]__random_integer(min,max)__

    This will permit the user to request a random integer to be used, as well as the minimum and maximum acceptable values.

  2. __SeqVariable__[variable id]__incrementing_integer(min,increment)__

    This will permit the user to request an incrementing integer to be used, as well as its starting value and the amount to increment (will be incremented from the value used in the previous instance of the explore).

  3. __SeqVariable__[variable id]__random_string(length)__

    This will permit the user to request a random string to be used, as well as its length.

  4. __SeqVariable__[variable id]__date_time()__

    This will permit the user to request a date/time stamp to be used. It will be in the following format and consist strictly of integers:
    MMddyyHHmmss

    Where:
    MM is the 2-digit current month of the year (i.e. 04 for April)
    dd is the 2-digit current day of the month.
    yy is the 2-digit current year (i.e. 07 for 2007)
    HH is the 2-digit current hour of the day in 24 hour format (i.e. 17 for 5 pm.)
    mm is the 2-digit current minute of the given hour.
    ss is the 2-digit current second of the given minute.


    Example:

    If the current time is 30 seconds past 5:52 pm on April 9th, 2007, the string will be as follows:

    040907175230

  5. __SeqVariable__[variable id]__ date_time_milliseconds()__

    This will permit the user to request a date/time stamp with milliseconds to be used. It will be in the following format and consist strictly of integers:
    MMddyyHHmmssSSS

    Where:
    MMddyyHHmmss is defined the same as the date/time stamp in iv) above.
    SSS is the 3-digit current millisecond of the given second.



TAG:

 

评分:0

我来说两句

Open Toolbar