Zero-configuration, automated, random testing tools for web-apps?

Question

In short, I'm looking for a tool to perform an automated, zero-configuration, full-frontal assault on a web application.

I'm thinking this would logically be a browser-extension that both crawls links on a given domain/path, AND randomly inputs data into forms and submits them. Specifically, form input would randomly include various data types, special characters, excessive data, various character encodings, and null values. Multithreading is a necessity (perhaps one plugin simply utilizing multiple Firefox tabs).

The tool does NOT (and should not) need to make any assertions about the results, or verify any application behavior. Instead, the persistence layer (DB records, etc) and applications logs would be used to evaluate the results of this "testing effort."

This would be a tool to complement existing testing tools (Selenium, QuickTestPro) and methodologies that may not have 100% coverage.

Any suggestions for existing or in-development tools? If not, I am eager to start an open-source project.

CLARIFICATION: I am specifically not looking for a penetration testing tool.

UPDATE: I have founded an open source project to satisfy this question. See comments below.

Gwyngwyneth

Since there has not been a satisfactory suggestion up until this point, I have founded the FuzzyFox project for Firefox: code.google.com/p/fuzzyfox – Gwyngwyneth

Answer 1

I used the trial of Acunetix for a while. It seemed reasonably effective, although it took longer than I thought it ought to and it's certainly not open source.

I forgot what the thing was called, and this list at SoftwareQATest is where I found it again. That list may be useful to you. The list of testing tools at OWASP looks similarly handy.

Bracken

As I stated in my reply to Toby's answer, I'm specifically NOT looking for a penetration testing tool, nor am I interested in having the tool evaluate any "results." I'm giving you a point for that first list though, even though I couldn't find anything relevant on it. – Gwyngwyneth

And yet, "randomly input data [...] include various data types, special characters, excessive data, various character encodings, and null values" is exactly what a web-based pen-testing tool will do. – Bracken

"and it's certainly not open source" Oh no, how could it possibly be useful then. – Lilly

Answer 2

It sounds like a fuzz testing tool may be what you need; tools like Wapiti will scan your app looking for parameterized URLs and forms to fill out, and use randomly generated data to exercise them.

Here is a good list of web app fuzzing tools.

Ophthalmoscope

Fuzzing is definitely the term for what I'm looking for, but none of the tools I can find (that describe themselves as such) offer the basic features that I'm looking for. They're too focused on security, producing narrowly defined inputs, and analyzing the application's response. I'm more interested in simulating an insane user, not a malicious one. – Gwyngwyneth

Answer 3

What about paros? http://www.parosproxy.org/functions.shtml

Proportioned

I just installed Paros and tried it against my project. Penetration testing is specifically not my goal, but the tool's capabilities are in line with what I'm looking for... the input behavior would just need to be changed. – Gwyngwyneth

Answer 4

I'm not sure I've came across anyting that fits the bill exactly, but Sulley is fairly close...

http://code.google.com/p/sulley/

I've never used it first hand, but I've heard it mentioned. Additionally, perhaps check this out:

http://www.owasp.org/index.php/Category:OWASP_JBroFuzz

Snyder

I tried both of those through keturn's answer, and neither was quite right. It looks like I'll be rolling my own solution as an open source Firefox plugin in the near future. Thanks though! – Gwyngwyneth

Answer 5

Better late than never, I have just released a monkey-testing web service that I think fits the bill:

https://elsetest.com

It clicks links and inputs random words, long paragraphs, emails, passwords, phone numbers, dates, special characters, Javascript etc. It deletes inputs, clicks buttons, checkboxes & radio buttons and selects from dropdowns. It also clicks randomly all over the page.

For years I have been using a similar approach at our company web site. It is quite comforting to let the monkey-testing run for a couple of hours, either some unexpected bugs show up or you feel a bit more at ease to schedule a new release.

I'm hoping others may find it useful as well.

Disclaimer: I am the founder of Elsetest and as of June 2023 it is an early release.

Keefe