Test Cases
When creating a new project, you can select one or more methodologies or checklists to apply to the project - referred to as Test Suites. Each test suite has a collection of test cases which gets assigned to the project.
A test suite helps:
- Clients understand exactly what was tested on the project;
- Developers/Engineers link test cases to vulnerabilities;
- Pentesters structure their testing in a methodical, consistent & standardized way;
- Organizations create repeatable, standardized & comparable assessments - independent of who was actually performing the assessment.
Test cases can provide valuable insight into a penetration test or audit. It shows:
- What was tested
- When it was tested
- Who tested it
- What was the status
- Supporting evidence
- Whether test case failed
To view the test cases assigned to the project, click on Test Cases from the project menu.
It is the function of a pentesters (or assessor) on the project to update the test cases, as they work through the assessment. Therefore only users with Edit permissions on the project can update a test case.
Test cases by default are set to Not Tested.
Authorized users can update the status of a test case to any of the following:
- Not Tested
- Testing In Progress
- Tested
- Not Applicable
You can update a test case by clicking on the status of the test case and selecting an option from the drop-down menu.
You can also update multiple test cases in bulk. Select multiple test cases, then select the desired option.
Each test case can have supporting notes & files which contains the evidence & observations from the pentester or assessor. For example, if the test case required to perform a scan using a tool - the results of the scan can be uploaded. All notes & evidence are included in the on-demand reports.
To add a note - select Add Note.
To upload evidence or files - select Upload Evidence.
You can filter test cases using the filters menu.
Administrators and Project Coordinators can assign test cases to any project team members with Edit permissions on the project, i.e. pentesters or consultants. This helps to delegate tasks to team members to maximise efficiency during testing, as well as accountability for certain tasks.
You can assign test cases to a user by selecting the test cases and using the actions menu to assign them to a user.
Administrators and Project Coordinators can assign assets to test cases. This helps to delegate tasks to individual assets to increase testing coverage and traceability.
You can assign one or more assets to the test case.
Failed test cases can help to identify tests which need to be re-performed as part of remediation testing.
Remediated test cases help to identify which failed test cases have had all vulnerabilities fixed/closed.
You can fail a test case by linking a vulnerability to a test case.
When creating or updating a vulnerability on a project, select the failed test case(s) to link them.
You can add a vulnerability directly from the test cases page, to quickly link the test case to the new vulnerability.
When a vulnerability is linked to a test case, the test case will be automatically marked as failed.
You can click on the Vulnerabilities tab to see all linked vulnerabilities.
If all vulnerabilities linked to a failed test case have been Closed, the test case will be considered Remediated.
Execution flows can be assigned to each test case.
Execution flows can have many uses such as:
- Document steps and procedures guiding a person in how to perform the test case
- Document which tools should be used to perform the test case
- Document internal processes and procedures required by the test case
- Provides links to external resources
Every test case has its own dedicated workspace, where testers can document information and upload supporting files relating to the testing process.
You can create a new workspace note by clicking on Workspace Notes tab, then click on Add Note.
Test case workspace notes can have supporting files attached.
As an Admin or Project Coordinator, you have the ability to Lock and Unlock test cases on a project at any given time.
Locking test cases is useful if you need to allocate a new round of testing to your project, to ensure previous rounds of testing cannot be altered or tampered with.
When a test case is locked, it cannot be updated. You cannot add any new notes or evidence either. This provides greater assurance from an auditing perspective.
Locked test cases will not show up on or affect the project status and percentage completion.
Locked test cases will not show up in the reports as reporting is focused on the current round of testing. This helps to avoid lengthy reports on projects where multiple rounds of testing are performed.
To lock a Test Case - selected the test cases then click on Lock from the actions menu.
To unlock a Test Case - click on Show Locked button, then select test cases and click on Unlock in the actions menu.
As an Administrator or Project Coordinator, you can add additional test suites to a project after the project has been created.
To add new test suites on a project, click on Add --> Test Suites.
By default, the test cases loaded on to the project will be set to Unlocked/Active status.
You can automatically lock the previous test cases if required. This will ensure the previous test cases can’t be tampered with or changed accidentally. It will also reset the project status to Waiting to Start and progress will be set to 0% (based on the new test suites added).
As an Administrator or Project Coordinator, you can delete test cases on a project. This can help if you need to remove test cases which do not need to be actioned on the project.
To delete test cases on a project, select the test cases then click on Delete from the actions menu.
Abuse cases are project-specific test cases. They are unique test cases which apply to the assets on the project, or objective of the assessment. For example, consider a web application pentest for a reverse auction website. Typically the pentest may cover the standard OWASP ASVS test cases, however the customer also requires that business logic tests are performed against the bidding functionality to determine whether it can be cheated or not. Abuse cases can be created to specifically test this functionality and provide higher level of assurance beyond standard test cases.
To create abuse cases on the project, you must be either an Administrator or Project Coordinator.
Click on Add --> Abuse Case.
Enter in the details for the abuse case, and optional code and tags.
You can access all abuse cases for each project via the Test Suites module. You can make changes to the abuse cases from here. If you need to delete an abuse case, you can perform this directly from the project (see Deleting Test Cases On Your Project above).
Last modified 8mo ago