01 default %Cmds.Site% http://www.eggendorfer.info/
02 GotoURL %Cmds.Site%
03
04 set %Count% 1
05 foreach %Link% in %Response://a%
06   set %URL% as selectIn %Link% @href
07   Notice %Count% Link: %Link% %URL%
08   set %Count% as binOp %Count% + 1
09 end

Listing 2 contains the simple counting test from Listing 1, but it is more complex: Here, TestPlan logs on to Facebook for the author and verifies whether HTTPS is enabled. This check is performed in two stages: First, the Check function ensures that the desired text is found on the page. If that is successful, the test script continues running. It then reads the message, removes the HTML from it, and uses a regular expression to check whether enabled is present. (Frequent tests in the form of Listing 2 will, however, cause Facebook to become suspicious, and it will require a CAPTCHA for login.)

01 default %Cmds.Site% https://www.facebook.com
02 GotoURL %Cmds.Site%
03
04 SubmitForm with
05   %Form% id:login_form
06   %Params:email% someone@somewhere.com
07   %Params:pass% somesecurepassword
08   %Submit% key:enter
09 end
10
11 set %Count% 1
12 foreach %Link% in %Response://a%
13   set %URL% as selectIn %Link% @href
14   set %Count% as binOp %Count% + 1
15 end
16
17 Notice %Count% Links on Facebook homepage.
18 GotoURL https://www.facebook.com/settings?tab=security
19
20 Notice Check if HTTPS is enabled.
21 Check //span[contains(text(),'Secure browsing is currently')]
22 set %all% %Response://span[contains(text(),'Secure browsing is currently')]%
23 if strMatches %all% ^(Secure browsing is currently).* (enabled)\.$
24 Pass HTTPS enabled
25 else
26   Notice HTTPS disabled
27   Notice Try to enable HTTPS.
28   Notice Subsequently start test again.
29   GotoURL https://www.facebook.com/settings?tab=security&section=browsing&view
30   set %id% %Response://form[@action='/ajax/settings/security/browsing.php']/@id%
31   set %fb_dtsg% %Response://form[@action='/ajax/settings/security/browsing.php']/input[@name='fb_dtsg']/@value%
32   SubmitForm with
33     %Form% id:%id%
34     %Params:secure_browsing% 1
35     %Params:fb_dtsg% %fb_dtsg%
36     %Submit% value:Save changes
37   end
38   Notice Test HTTPS again
39   Fail HTTPS
40 end

If enabled is present, the script reports this test as having been passed (see Figure 3); otherwise, the test will automatically try to enable HTTPS itself (Figure 4, line 6-00). Because Facebook assigns a form a new, seemingly random ID on each new access, you'll have to employ a small trick. With the XPath expression in line 30, it is possible to read the ID. The result is deposited in the local variable %id%. This is also the case for the contents of a hidden input field in line 31. With these values, you can address the desired form on the page (line 33), filled out correctly and posted to Facebook.

If you now want to test automatically whether Facebook has really enabled HTTPS – which is necessary if the test is to continue, you must now write a small test to see whether Facebook has logged the user out again. Depending on the result, the script must log on again if necessary and then run the test again. The TestPlan language includes the possibility of calling up external test modules, so it is sufficient to implement the HTTPS test once – your own test script will then call up the module in several places. This approach simplifies the maintenance of the test.

Fundamentally, TestPlan's own language is powerful and easy to learn, but it is poorly documented. A bit of initial experimentation is therefore necessary. TestPlan is worth using because of its flexibility – and not just for your own web applications, but for small (and of course, legal) attacks as well.