zaproxy
Test with Alexa Top 500 sites (or more)
Try opening each of the top 500 or so sites in a browser running the HUD. Check the HUD loads ok. Ideally click a link or 2 on the target site.
Ideally we should have a test script that automates this, eg using selenium.
I've got a PoC which allows you to test the HUD against a list of urls - it launches a browser (currently hard coded to firefox, but will support chrome), waits until the page has loaded and checks to see if the left hand HUD frame is present and has the expected number of buttons. Working well so far (just tested vs the top 50 sites) but needs quite a bit more tidying up ;) Right now its a button in the HUD options - was thinking this could be a std HUD feature - eg it would allow users to test the HUD against their own sites.
any thoughts on what would be the most useful format for displaying the results? (currently just write to the logs). Possibilities inc writing to a new file, a new lower results tab, a new API endpoint...
Point made by @thc202 on irc - maybe an API end point that just reports progress and failure? Eg if we're testing 1M urls ;)
Maybe I'm not quite understanding how this is implemented, but this would be a INCREDIBLE first test to throw into some CI. (Travis, Circle, whatever we're comfortable with). If it would run on every PR and just log the results I think that would be a really powerful way to introduce this.
I'm also looking forward to iterating on top of the basic test of "is there a panel and buttons". I think having that data would provide miles more insight than we currently have. but thats such an awesome platform to start diving into:
- are there javascript errors reported
- is the websocket connection working
- did all the iframes load
- can you click a button
- is the target page responsive
Right now I'm looking at implementing it as a set of API end points. I want to be able to run the HUD vs a v large number of websites. But I also agree that running it vs a set of sites we know cause problems in CI would be really useful too :)
Have tested vs the Alext top 200 and updated #136 Its taking ~ 15 secs per site, so the top 500 will take a couple of hours at this rate. But already getting some good results from this.
Implemented the test API calls in https://github.com/psiinon/zap-hud/tree/browser-test - will issue a PR when #173 (which it kind of depends on) is merged.
