Automatic penetration testing enablement of regression buckets
A computer-implemented method for generating penetration tests automatically includes parsing an existing system test case, and identifying a particular program call in the system test case. The particular program call can require a particular data access authorization. The method further includes, in response to the system test case including the particular program call, generating a penetration test using a predetermined attack vector. The method further includes executing the penetration test and detecting an unauthorized access being performed during the penetration test. Further, the method includes responsively, sending a notification that identifies the particular program call.
1. A computer-implemented method for generating penetration tests automatically, the computer-implemented method comprising:
parsing an existing system test case for a system;
identifying a particular program call in the system test case, the particular program call requiring a particular data access authorization;
in response to the system test case including the particular program call, converting the system test case into a penetration test case, wherein the converting comprises:
creating a new test case that comprises all computer-executable instructions from the existing system test case;
adjusting the particular program call for the penetration test case by adding computer-executable instructions to the new test case, wherein the computer-executable instructions test one or more types of unauthorized accesses listed in a predetermined attack vector;
testing the system, which comprises:
executing the system test case; and
in response to determining that the penetration test case is to be performed based on a first value of a flag:
executing the new test case that performs a penetration test and detecting an unauthorized access being performed during the penetration test; and
responsively, sending a notification that identifies the particular program call and the unauthorized access that was detected when executing the system new test case.
2. The computer-implemented method of claim 1 , wherein parsing the system test case comprises performing natural language parsing or parsing the system test case that is in a programming language.
3. The computer-implemented method of claim 1 , wherein generating the penetration test case comprises generating a penetration test case for each of the one or more types of unauthorized accesses listed in the predetermined attack vector.
4. The computer-implemented method of claim 1 , wherein the predetermined attack vector lists the one or more types of unauthorized accesses that are specifically associated with the particular program call in the system test case.
5. The computer-implemented method of claim 1 , wherein detecting the unauthorized access comprises monitoring for a specific signal and checking contents of a particular storage location based on the execution of the computer-executable instructions added to the system test case.
6. The computer-implemented method of claim 1 , wherein creating the new test case comprises crating a plurality of new test cases respectively corresponding to each unauthorized access listed in the predetermined attack vector.
7. The computer-implemented method of claim 1 , wherein the flag is a bit that is set/reset in a testing framework being used to test the system.
8. A system comprising:
a memory; and
a processor communicatively coupled with the memory, the processor configured to perform a method for generating penetration tests automatically, the method comprising:
parsing an existing system test case for a system under test;
identifying a particular program call in the system test case, the particular program call requiring a particular data access authorization;
in response to the system test case including the particular program call, converting the system test case into a penetration test case, wherein the converting comprises:
creating a new test case that comprises all computer-executable instructions from the existing system test case;
adjusting the particular program call for the penetration test case by adding computer-executable instructions to the new test case, wherein the computer-executable instructions test one or more types of unauthorized accesses listed in a predetermined attack vector;
testing the system under test, which comprises:
executing the system test case; and
in response to determining that the penetration test case is to be performed based on a value of a flag:
executing the new test case that performs a penetration test and detecting an unauthorized access being performed during the penetration test; and
responsively, sending a notification that identifies the particular program call and the unauthorized access that was detected when executing the system new test case.
9. The system of claim 8 , wherein parsing the system test case comprises performing natural language parsing or parsing the system test case that is in a programming language.
10. The system of claim 8 , wherein generating the penetration test comprises generating a penetration test case for each of the one or more types of unauthorized accesses listed in the predetermined attack vector.
11. The system of claim 8 , wherein the predetermined attack vector lists the one or more types of unauthorized accesses that are specifically associated with the particular program call in the system test case.
12. The system of claim 8 , wherein detecting unauthorized access comprises monitoring for a specific signal and checking contents of a particular storage location based on the execution of the computer-executable instructions added to the system test case.
13. The system of claim 8 , wherein creating the new test case comprises crating a plurality of new test cases respectively corresponding to each unauthorized access listed in the predetermined attack vector.
14. A computer program product comprising a computer-readable memory that has computer-executable instructions stored thereupon, the computer-executable instructions when executed by a processor cause the processor to perform a method comprising:
parsing an existing system test case for a system;
identifying a particular program call in the system test case, the particular program call requiring a particular data access authorization;
in response to the system test case including the particular program call, converting the system test case into a penetration test case, wherein the converting comprises:
creating a new test case that comprises all computer-executable instructions from the existing system test case;
adjusting the particular program call for the penetration test case by adding computer-executable instructions to the new test case, wherein the computer-executable instructions test one or more types of unauthorized accesses listed in a predetermined attack vector;
testing the system, which comprises:
executing the system test case; and
in response to determining that the penetration test case is to be performed based on a first value of a flag:
executing the new test case that performs a penetration test and detecting an unauthorized access being performed during the penetration test; and
responsively, sending a notification that identifies the particular program call and the unauthorized access that was detected when executing the new test case.
15. The computer program product of claim 14 , wherein parsing the system test case comprises performing natural language parsing or parsing the system test case that is in a programming language.
16. The computer program product of claim 14 , wherein generating the penetration test comprises generating a penetration test case for each of the one or more types of unauthorized accesses listed in the predetermined attack vector.
17. The computer program product of claim 14 , wherein the predetermined attack vector lists the one or more types of unauthorized accesses that are specifically associated with the particular program call in the system test case.