Is wacat tool usefull in web application normal or security testing?

[mikesmallhelp]

Hello,

I have developed a wacat tool, https://github.com/mikesmallhelp/wacat.

With wacat you can test your web application with random inputs etc.

What you think? Is wacat tool usefull in a web application normal or security testing? Please comment!

In cyber security field there is for example Nessus tool. Do you know are there other competitors among the normal or security web testing tools? Is wacat better in some areas than the competitors?

What features you would like to have in wacat. Please comment or add the issue in the page https://github.com/mikesmallhelp/wacat/issues.

I have also some specific technical questions:

1)

wacat uses internally Playwright tool. Normally Playwright tests wait for some text etc. wacat can't wait for any text, because it is a general tool. Currently wacat waits some time for the page (2000 milliseconds is default). Do you have any tips, how to make this better. I have tried for example createNetworkHelper (https://github.com/mikesmallhelp/wacat/blob/wait-for-network-settled/utils/test-utils.ts), which waits that the network is settled (I got the code from some discussion group). But nothing works. Playwright has also

page.waitForLoadState({ waitUntil: "domcontentloaded" }); etc.

but they are not working for my test cases.

2)

I have noticed that https://mui.com/ have dropdown menus, which implementation is far from normal html option. Mui uses some kind special css implementation and it's hard for general tool to select from those dropdown menus. If you have any tips how to handle those dropdown menus with wacat, please comment.

Finally if you are interested in to contribute to development, all contributions are welcome.

Also I'm really interested if you have used wacat. Was it usefull for your usecase?

Please note wacat is still under construction. Please create a new issue, if you find a bug or some particular feature is needed.

BR,

Mika

[a_lifters_life]

Mika - this looks similar to a fuzzing tool in security - what were you hoping to achieve with this project?

Are you detecting the response upon submitting a request?

[mikesmallhelp]

Hello!

Thanks for the comment!

Maybe my goals where both for security and normal web development testing.

I'm personally software developer and cybersecurity is my hobby. First I thought I had unique idea, but one friend working in the infosec area told about Nessus etc tools. Then I thought I finish my tool and see if some users are interested.

wacat detects a response HTTP code and if that is >= 400, it reports error. Then wacat can also detect error etc strings in the response page it they are configured.

Maybe my main focus is in the normal web testing. I have found that companies don't have enough end-to-end testing and wacat is easy to use tool to do some kind of testing. Even smoke testing with the --only-links flag. wacat also supports CI pipeline with the --headless flag.

BR,

Mika