Cypress Plugin to test web apps for security vulnerabilities
npm install cypress-pentest-pluginbash
npm install cypress-pentest-plugin
`
2. add "type": "module" to your package.json
3. Create a /logs directory in the root of your project.
Extend Cypress Commands
In order to use the plugin functions in Cypress, you have to add the event listeners to your cypress configuration file:
`js
export default defineConfig({
e2e: {
setupNodeEvents(on, config) {
configurePlugin(on);
return config;
},
}
})
`
In the commands.ts/js, insert the add commands function:
`js
// import { addCommands } from "cypress-pentest-plugin/dist/index-browser";
addCommands();
`
This plugin extends Cypress commands with the following:
- cy.sqlMap(): Use sqlmap to test for SQL injection vulnerabilities
- cy.checkEndpoint(): Check if an endpoint is vulnerable to SQL injection
- cy.reflectedXSS(): Check if an endpoint is vulnerable to reflected XSS`