The world wide web hosts over <a href="https://www.internetlivestats.com/total-number-of-websites/" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">1.7 billion websites</a> today. The reason for this big number is obvious &#8211; the web has become the modern marketplace and to be able to get visitors, a place here has become essential. For an online business, a website becomes the first impression. Customers are bound to judge the quality of your business by the quality of your website. And that is why the below statistic would not seem surprising at all: 



“<a href="https://www.sweor.com/firstimpressions" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">88%</a> of online consumers are less likely to return to a site after a bad experience” 



Now that we know, just having a website is not enough and that quality and experience play a major role too, it becomes imperative that you test your website to ensure both of these criteria are met. The one obvious way of ensuring this is via testing.&nbsp; 



If you are a beginner and your website does not have many visitors you could do the testing manually, without any tool. But if you are growing and customers have started encountering issues then you might need to use some <a href="https://testsigma.com/automated-testing" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">automation</a>. 



To automate your website, the best way is to do automated web testing. Automated web testing is done with the help of automated web testing tools.<a href="https://testsigma.com/automated-web-application-testing" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)"> Testsigma is one such tool for automated web testing</a> and in this article, we will list down the features that make it an ideal tool for automated web testing. 



1. It’s very easy to start your test automation for the web with Testsigma 



i. No setup required as it is completely cloud-based Testsigma is a completely cloud-based automated testing tool. Because of this feature, you just have to signup and you can start with automating your web test cases.



ii. You can start your test case creation quickly as test creation is done in simple English and no programming skills are required: Of the major feature of Testsigma, that makes it an ideal tool for automated web testing is that it requires you to use simple English for test case creation. Thus, it is very easy to learn. You don’t need to be perfect in any programming language to get started with Testsigma. Thus, if you are looking for a tool that is very easy to start with and does not require heavy skills to start with test automation then Testsigma is the way to go for you.



<figure class="wp-block-image"><img src="https://lh4.googleusercontent.com/0pLf4ZtgNKQbVKrfHncufdPsP7QG8YSD-x_yn9_vTiTELvF7xIAtfme6H5dQ9lOAvqfDs8tQgsRY9p05VoOokdRj-Nqd0b32_sMnoQi4x2bMGJES7Cj6EF67ePwKJQ29GIRAAyNc" alt="Testsigma - Reusable test steps" /></figure>



iii. Reusable test steps When you start automating your tests, you will find out that there are some steps that will be repeated quite often. A great practice that would save you time would be to make those test steps reusable such that you are needed to create them once and use them again and again. Testsigma has a built-in feature like that to save your time.



iv. Support for loops Even though in real life, your user might never need to do a looped task, there would be times when you would need to use that during test automation. Testsigma is built-in with the support for these complex loops that let you automate complex test steps easily and on time.



2. Tests can be reviewed by other non-technical project stakeholders



Once the tests are created, they are as easy to understand as reading English. Thus, the non-technical members of the team can be included in the test review process. 



This ensures that all-around knowledge can be included in the test automation, making it effective. This also helps improve test coverage as well as the quality of testing.&nbsp; 



3. Multiple time-saving features during test maintenance 



While performing test automation, there are two activities that take up most of the time &#8211; test creation and test maintenance. Having dealt with test creation in the above points, test maintenance is made easy when the tool provides functionalities that help in healing the failing test cases automatically. These are the test cases that are failing because of some recent changes in the UI. 



i. Self-healing tests: Testsigma uses an AI-based intelligent engine in the backend that helps the test cases self-heal and saves a good amount of your time that you would have otherwise spent on test maintenance.



<figure class="wp-block-image"><img src="https://lh4.googleusercontent.com/prXciJ-X4fE1ImR3bcFsp7q2Cqvf8L6QoloXxdLzgkzX3r6HR31hGu2EwpiZ0Y58zIdfapjkptm3bEicjRqUD_DChdzpE7rQLXDkSJrt8lJbSunJKveGTwRpV8V3XvoSTZxoEvdK" alt="Testsigma - Self-healing tests" /></figure>



PC:<a href="https://www.freepik.com/" target="_blank" rel="noreferrer noopener nofollow"> freepik.com</a>



ii. Affected resources: Whenever you make a change in your website, there will be some related resources that would be impacted too. Testsigma will help you figure them out automatically.



4. Smart locators To use a website, a user performs different actions on the elements visible on the UI. To be able to automate them, a tool needs to be able to access these elements easily. These elements are accessed via locators.&nbsp;



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/m5ByTEE8P64sD1Dz0WV4pBkQTdQ3V0BXts9EPPkteLUvGvZJmvcgWnzuY7vlllNlIr9mRLgQ__PDk-ZJBxFuI16SZ34dcxeFFH9dbsppBHgRChKEYMBDv5rxQeby8Ku6BeleEMW2" alt="Smart locators" /></figure>



PC: <a href="https://www.freepik.com/" target="_blank" rel="noreferrer noopener nofollow">freepik.com</a>



The tests created from a tool for automated web testing become robust when the locators are robust too. Testsigma has a unique strategy by which a locator or a UI identifier gathers multiple locators for one element. This way it becomes easier for the test cases to keep working even if there are changes in the UI.



5. Supports headless browser automation



Sometimes while test execution, having all the test cases replicated on a real browser can take up a lot of time and create a lot of issues of its own. To remove the hurdle of having UI rendered before the test case can run, there is a solution in the test automation world. Something like magic, where the UI is not in the picture but test cases are still executed, is called headless browser automation.&nbsp;



<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/ciFN30nWPXJjAo_tO74CL0EuBeZr42V2MiEipTKcETlbu8E3FMkde_6HVdc-TfglTODRZ41An7DjgHd0VV1udl_MVRJGvpNvZGsJMvR7PL2Y-eDTDn_nJx2IJpJJWI1QHG44ikiQ" alt="Testsigma" /></figure>



PC: <a href="https://www.freepik.com/" target="_blank" rel="noreferrer noopener nofollow">freepik.com</a>



In headless browser automation, test cases are executed on the browser without rendering the UI thus the complexity of UI interactions is minimized and actions are performed quickly. Testsigma supports headless browser automation and lets you speed up the execution of your test cases easily.



6. Lets you execute your tests on 2000+ real mobile and web browser There is no point in automating your test cases if you are not executing them on all the web browsers that your users are using your website on. If you are supporting your website on the mobile web too (most people do) then you will need to test your website on browsers on mobile devices as well.



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/5Jvr_uNf4bSeQ3DBRC1V4XrDuNkNTgQIeX-L2s1BNIoSkoo2uZ_OXqZhK2-YlzU5w37WQ1UpTX_sC4GgRZlc2KAMnUJuetQd2rJ-h5Pv1f1_yTEDqH_GMaaBZW6GjalUbr3IcPeR" alt="Testsigma - Test automation" /></figure>



Testsigma is equipped with different kinds of cloud device labs. These labs host most of the modern and old web browsers and mobile devices. You can easily plug into these device labs and execute your automated tests on them. 



7. The UI for test development is very intuitive and guides you throughout the process Just as your website won’t be usable if it is not intuitive for your users, the same is the case for automated testing tools. Understanding that fact, Testsigma has been created with special care and attention given to every module of the tool. This makes sure that the tool is built while making it highly intuitive and usable. Also, instructions and pointers are provided where ever possible to aid you in smooth and speedy test case creation and execution.



8. Let&#8217;s you implement waits in multiple ways so asynchronous loading of web elements is not a problem at all.



Anyone who has ever tried automating a website would know that the first problem that is encountered during test automation is ‘waits’. Even though the actions are automated, the way different elements on a web page load end up creating wait issues &#8211; Sometimes, the next expected element does not appear on time while other times it appears too quickly and vanishes &#8211; this results in test cases failing. Testsigma is built-in with multiple kinds of waits. Some waits are implicit such that you don’t need to worry about them. But, if you want to add your own waits, Testsigma gives you the flexibility there. 



9. You can do test automation on the web irrespective of what technology was used during web development 



Today, the development of a website can be done using multiple programming languages and technologies. Looking for a tool that supports your specific set of development practises is a sensible practice but what if you decide to include some other technologies later? The solution is that you need to be looking for a tool that supports all technologies you use and is made to include all others that might come up in the future.&nbsp;



Thus, when you include Testsigma as your test automation tool, you make your test automation future-proof. 



10. If you support mobile or you plan to support mobile in future or still do, then Testsigma will let you automate the test cases from the same place. You won’t need to look for new tools.



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/pdrPwzSzTR_EzkXKs7ABWEFZsLWp-r5CWqenVHQEjtVlXimBCh5Eir5_Z6IndI62nNnJ8rdhVMOTMZVVXPrY_xZmXKU5z1DaJPYHXf7FiiGcrcU4MlPqKLAi8d5y8t1XRAyxSdtS" alt="Testsigma" /></figure>



More than 50% of web traffic is now driven by mobile devices. Sooner or later, you will want to support your website on mobile too. Then, you will need a tool that will support your mobile test cases too. 



Testsigma is that tool today. Testsigma lets you automate your test cases for web browsers as well as mobile from the same place.



11. Whenever your test cases fail you can access screenshots, video recording or logs of your failure, making your test debugging very easy and convenient. Where Testsigma ensures that your test creation and maintenance tasks are executed hassle-free, it also ensures that whenever there is a bug you can debug that easily. To support that Testsigma lets you record the execution of all your test cases in the form of screenshots, videos, and logs.



12. If you have already setup CI/CD pipeline, adding Testsigma to it will only be like plug and play.



<figure class="wp-block-image"><img src="https://lh4.googleusercontent.com/H4b-TGfgKb3nKOpSfLk45ylCEUQoxYnPS6uf_0QIP-80i76WXGBbh-7--lMxpKH_NrAj1GtP2nUaPDiRd6qAFTi5G4G_3JJHY-nHEffri948FHcPxgVIn1MVHobqqcdKAzFSv9p6" alt="Testsigma - CI/CD pipeline" /></figure>



If you already have a CI/CD pipeline setup for development, including Testsigma will be very easy. 



13. Supports parallel test execution To save your time on test execution, Testsigma lets you execute your test cases in parallel as well.



14. Can be accessed from anywhere anytime If you have a remote team, then you don’t need to worry at all. Testsigma is built to support all your remote team workflows. You can access all Testsigma tests cases, execution stats reports whenever you need them from anywhere you need to access them at any time.



15. 24&#215;7 support Last but not the least, Testsigma might be built with all edge cases taken care of, but we know your project is unique. There might be times when you might be stuck and that is why the Testsigma support team would be there to help you out every single time. The 24&#215;7 support, as a feature for automated web testing tool Testsigma, will save your precious time that you would otherwise have spent in waiting for a solution on a community or for the testers to figure out.



<div class="bg-primary cta">

Make your automated web testing easy, convenient and efficient with Testsigma
<div class="d-flex mb-1" style="justify-content:space-evenly">
 <button class="btn cta-btn bg-white"><a href="https://testsigma.com/signup" target="_blank" rel="noopener noreferrer">Signup Now</a></button></div>
</div>

What features make Testsigma an ideal tool for automated web testing?

A few years back, “codeless testing” was interchangeably used with the “record-and-replay” functionality of the automation software. Today, the advancements in <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/codeless-testing" target="_blank">codeless testing</a> have <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/blog/selenium-vs-scriptless-test-automation/#:~:text=Scriptless%20test%20automation%20tools%20can,users%20know%20scripting%20and%20programming." target="_blank">widened the gap</a> between the terms and gave them<a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/blog/scriptless-automated-testing-is-not-the-same-as-record-and-playback/" target="_blank"> separate and clear meanings</a> in the IT industry. Therefore, it becomes a confusing question when we talk about these two terms today. 



The thought of when should enterprises choose codeless automation for testing and when to go for other methods still remains a complex question and more cluttered than ever. This post will point out several methods that can help you decide which way to go while starting a project or setting up a whole enterprise. 



<div id="toc_container" class="no_bullets">Table Of Contents<ul class="toc_list"><li><a href="#What_is_Codeless_Testing">1 What is Codeless Testing?</a></li><li><a href="#Advantages_of_Codeless_Testing">2 Advantages of Codeless Testing</a></li><li><a href="#When_Should_You_Choose_Codeless_Automation">3 When Should You Choose Codeless Automation?</a><ul><li><a href="#1_Development_and_testing_are_not_synchronized">3.1 1. Development and testing are not synchronized</a></li><li><a href="#2_Rising_Issues_with_code-based_test_automation">3.2 2. Rising Issues with code-based test automation</a></li><li><a href="#3_Short_on_time">3.3 3. Short on time</a></li><li><a href="#4_Low_on_monetary_resources">3.4 4. Low on monetary resources</a></li><li><a href="#5_UI_tests_are_the_priority">3.5 5. UI tests are the priority</a></li></ul></li><li><a href="#Conclusion">4 Conclusion</a></li><li><a href="#Suggested_Readings">5 Suggested Readings</a></li></ul></div>
<h2 id="h-what-is-codeless-testing">What is Codeless Testing?</h2>



Codeless testing is a type of software testing that requires no code writings from the testers. Instead, it relies on <a aria-label=" (opens in a new tab)" href="https://testsigma.com/blog/natural-language-processing-nlp-based-test-automation/" target="_blank" rel="noreferrer noopener">natural language processing</a>, <a href="https://www.zaptest.com/" target="_blank" rel="noreferrer noopener nofollow">drag-and-drop UI elements</a>, <a aria-label=" (opens in a new tab)" href="https://testsigma.com/blog/best-scriptless-testing-tools-for-angular-based-applications/" target="_blank" rel="noreferrer noopener">artificial intelligence, self-healing capabilities etc</a>. It depends on the <a href="https://testsigma.com/codeless-automation-testing-tools" target="_blank" rel="noreferrer noopener">codeless testing tool</a> you are using. 



For example, instead of writing a selenium script with browser instances, we can directly write navigate to URL to just access the intended web address. 



<h2 id="advantages-of-codeless-testing">Advantages of Codeless Testing</h2>



Codeless testing brings a lot of advantages along with it, some of them are mentioned below:



<ul><li>Saves Time: Codeless testing eliminates the requirement of learning and implementing the code in complex automation testing frameworks. Hence, a lot of time is saved in learning and constructing the test cases with codeless testing.</li><li>Involves People from Diverse Teams: Since there is no coding involved, the test cases are easily understood by non-technical people. They can then contribute in their own way for better quality tests such as suggesting changes or sometimes constructing a few scenarios themselves.</li><li>Extremely low maintenance: Codeless test automation requires very little maintenance work from the test automation engineers. On the contrary, with scripted test automation, they often struggle with the frequent changes done in the software.</li></ul>



And there are a lot more of this. But scripted testing has its own advantages too and therefore deciding when should enterprises choose codeless automation for testing becomes a topic for discussion.



<h2 id="when-should-you-choose-codeless-automation">When Should You Choose Codeless Automation?</h2>



Whether you are a startup, a small enterprise, or a big organization, every project you work on brings its own challenges and careful planning. Therefore, to deal with it, you need to be sure of the top points that will help you decide when to choose codeless automation and when to stay away from it. The following points will help you understand.



<h3 id="1-development-and-testing-are-not-synchronized">1. Development and testing are not synchronized</h3>



Development and testing are two pillars of SDLC and should go hand in hand. With methods allowing faster software development, testing might get a bit unsynchronised with it. 



For example, sometimes testing lags behind one release cycle and sometimes two. This gap might increase in the future if remedial steps are not taken. One such step is to use codeless test automation. With codeless automation for testing, things move faster and the gap is narrowed with faster testing cycles.



<h3 id="2-rising-issues-with-code-based-test-automation">2. Rising Issues with code-based test automation</h3>



Code-based test automation comes with its own challenges. The most popular one being the team’s skills you would require to commit the tasks. Code-based test automation needs a team that knows specific programming languages and framework knowledge on which testing will be done. 



Sometimes, more than one technology is finalized based on the team’s knowledge and experience that are not compatible with each other. Such a situation may take additional time to resolve. When such issues start to arise commonly, codeless testing is the way to go for enterprises.



<h3 id="3-short-on-time">3. Short on time</h3>



Sometimes, you don’t need to go deep into the technicalities while deciding when should you choose codeless automation for testing. Just weighing both the methods on the amount of time they take from the start to end is enough if time is the only factor holding your judgment. 



Codeless testing is faster to write tests and is easier to learn by the engineers. If you are having trouble matching the project deadlines frequently, codeless testing is the best option to choose.&nbsp;



<h3 id="4-low-on-monetary-resources">4. Low on monetary resources</h3>



When time is not the deciding factor, money is. Startups and small enterprises have to spend their money meticulously on each resource. Automation testing is one of the prime factors that can consume a lot of money or time. 



Since automation testers are few (considering the knowledge of programming) and the demand is high, they sometimes aim for higher salaries which costs the company extra money. Sometimes, you need to train the automation testers on a new programming language or framework which can cost extra money to the company too. 



On the contrary, codeless test automation neither requires highly skilled automation testers nor do they require a lot of training. Codeless test automation tools just require monthly or annual subscriptions fees for the maintenance of their infrastructure.&nbsp;



The difference in costs involved in both the situation is also very large. For example, the national average salary for an automation engineer in the United States is 83000 USD. 



Codeless test automation tools such as <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/" target="_blank">Testsigma</a> can satisfy all your testing requirements with advanced analytics and reporting features and run 10 parallel tests for half that price (around 41000 USD). 



Bottom line: when you are short on monetary funds and the project requires testing, codeless test automation should be the call for rescue &#8211; of course, other project requirements for test automation should be met too.



<div class="bg-primary cta">

Save your testing time and costs with codeless test automation with Testsigma
<div class="d-flex mb-1" style="justify-content:space-evenly">
 <button class="btn cta-btn bg-white"><a href="https://testsigma.com/signup" target="_blank" rel="noopener noreferrer">Signup Now</a></button></div>
</div>



<h3 id="5-ui-tests-are-the-priority">5. UI tests are the priority</h3>



The goal of UI testing is to guarantee the correct working of the visual components of the software. Sometimes, that is the utmost priority as you may be releasing software with just the UI changes. 



Codeless test automation therefore would be the best option when such scenarios arise. Although if code-based <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/regression-testing" target="_blank">regression tests</a> are fulfilling the purpose, you can choose to avoid codeless automation. But for a fresh test suite, codeless works best when it comes to the user interface.



<h2 id="conclusion">Conclusion</h2>



Codeless test automation is the new kid in the automation world that is more effective and simplified than its parents. But it still is in the learning phase. Definitely, it comes with certain limitations and is not 100% perfect. This may be one of the reasons that organizations think about when should enterprises choose codeless automation for testing. 



There may be some limitations to the codeless test automation which can make you wonder, if, you as an enterprise,&nbsp; should choose codeless automation for testing. 



For instance, Selenium has an issue with the scalability of the application. Selenium allows the objects to be defined on a single locator only that demands a lot of time when we are maintaining the tests.&nbsp; 



In this post, I tried to clear the air that can help you resolve the confusion. As far as tools are concerned, there are a few <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://testsigma.com/blog/best-codeless-automation-testing-tools-in-2021/" target="_blank">codeless test automation tools</a> available that are different in one thing or another (as most of the tools are). Choosing a tool is not a textbook process. 



As this post highlighted the points that can help you in determining the choice of automation method, the tool that solves that problem is the best choice. 



I hope that by the end of this post, you will have certain parameters in your hand through which it would become a simplified process. For any comments and suggestions, we welcome your comments below.



<h2 id="suggested-readings">Suggested Readings</h2>



<a href="https://testsigma.com/blog/codeless-testing-when-is-testsigma-recommended-tool-for-you/" target="_blank" rel="noreferrer noopener">Codeless Testing: When is Testsigma recommended tool for you</a> 



<a href="https://testsigma.com/blog/best-codeless-automation-testing-tools-in-2021/" target="_blank" rel="noreferrer noopener">Best Codeless Automation Testing Tools in 2023</a> 



<a href="https://testsigma.com/blog/modern-codeless-test-automation-myths-facts/" target="_blank" rel="noreferrer noopener">Modern Codeless Test Automation: Myths And Facts</a> 



<a href="https://testsigma.com/blog/advantages-of-using-codeless-test-automation-tools-an-exhaustive-list/" target="_blank" rel="noreferrer noopener">Benefits of Codeless Test Automation Tools</a>

Codeless testing When should enterprises choose codeless automation for testing

When Should Enterprises Choose Codeless Automation for Testing?

No code automation testing: When to use and when not to use

No Code Automation Testing: When to Use and When Not to Use

<div id="toc_container" class="no_bullets">Table Of Contents<ul class="toc_list"><li><a href="#Introduction">1 Introduction</a></li><li><a href="#How_to_test_2_Factor_Authentication_based_systems">2 How to test 2 Factor Authentication based systems</a></li><li><a href="#Challenges_during_test_automation_for_2_Factor_Authentication">3 Challenges during test automation for 2 Factor Authentication</a></li><li><a href="#The_Questions">4 The Questions</a></li><li><a href="#Use_Cases_8211_How_should_the_2_Factor_Authentication_feature_function">5 Use Cases &#8211; How should the 2 Factor Authentication feature function?</a></li><li><a href="#How_to_break_the_OTP_functionality_for_2FA">6 How to break the OTP functionality for 2FA</a></li><li><a href="#Ways_in_which_a_hacker_can_get_access_to_your_code">7 Ways in which a hacker can get access to your code:</a></li><li><a href="#How_to_test_the_OTP_functionality_for_2FA">8 How to test the OTP functionality for 2FA</a></li><li><a href="#The_Modern_Approach_to_testing_OTP_functionality_using_Testsigma">9 The Modern Approach to testing OTP functionality using Testsigma</a></li></ul></div>
<h2 id="introduction">Introduction</h2>



2 Factor Authentication is a subset of the <a href="https://www.onelogin.com/learn/what-is-mfa" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">multi factor authentication</a> service that we see mainly in FinTech Apps. 



Some financial technology apps ask the user to enter a password, and MPIN, a TPIN, and finally another OTP based authentication to confirm if he/she really wants to withdraw money from their schemes.&nbsp; 



While 2 Factor authentication may have some vulnerabilities, using a multi factor authentication system like the above will result in users fleeing your application in pursuit of simpler systems. The challenge here is to make user transactions secure and easy at the same time. That’s when 2 Factor authentication or <a href="https://testsigma.com/blog/test-automation-for-2fa-enabled-authentication-with-testsigma/" target="_blank" rel="noopener">2FA</a> becomes useful.&nbsp; 



In a 2FA system, a user has to enter a password and an OTP or a code obtained from a different app.&nbsp; 



In this article, we will only discuss testing the OTP based authentication for obvious reasons. We cannot test third-party mobile apps like Twilio Authy or Google Authenticator.&nbsp; 



As a first step, we will understand what 2FA is, how it works, is it vulnerable to attacks?&nbsp;



And then we will move on to learning how to test 2 Factor Authentication. 



Finally, we will also talk about how Testsigma can help you perform <a href="https://testsigma.com/automated-testing" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">automated testing</a> for 2FA.&nbsp; 



<div class="bg-primary cta">

See how Testsigma lets you automate 2FA 
<div class="d-flex mb-1" style="justify-content:space-evenly">
 <button class="btn cta-btn bg-white"><a href="https://testsigma.com/webinars/how-to-automate-two-factor-authentication" target="_blank" rel="noopener noreferrer">Get the webinar recording</a></button></div>
</div>



<h2 id="how-to-test-2-factor-authentication-based-systems">How to test 2 Factor Authentication based systems</h2>



Definition of 2 Factor Authentication: Authentication by means of both &#8211; a password and an OTP.&nbsp; 



Steps



1. User goes to a workflow that requires authentication, the most common example is a login form.2. The user enters the username or provides some other information for authentication to begin.3. The user enters a password corresponding to the information given in step 24. The application prompts for an OTP that is sent to the user’s mobile number. This mobile number is usually stored by an application during user registration.5. The OTP is fetched from an SMS received on the mobile number and is automatically inserted into the OTP input field or user enters it manually.



<h2 id="challenges-during-test-automation-for-2-factor-authentication">Challenges during test automation for 2 Factor Authentication </h2>



<ul class="list_style_disc"><li>For 2 Factor authentication to work, an external phone number is needed to send OTP via SMS. Users also have access to a <a href="https://africastalking.com/ussd" target="_blank" rel="noreferrer noopener">USSD code</a> that&#8217;s unlock hidden actions.</li><li>Integrating an external number to an automated test is usually not feasible, thus picking up the OTP from an end user’s phone becomes a challenge</li><li>Many organizations disable OTP authentication in all servers except production in order to run other tests. Thus, 2FA testing is skipped.</li></ul>



<h2 id="the-questions">The Questions</h2>



Can you really automate the process of OTP based authentication under 2FA? 



Yes 



Using traditional methods, is it easy to scale the automation process for 2FA? 



No



<h2 id="use-cases-how-should-the-2-factor-authentication-feature-function">Use Cases &#8211; How should the 2 Factor Authentication feature function? </h2>



Let us understand a few use cases to test: 



1. A user sends a request for OTP (via the application that requires authentication), the app sends the OTP via SMS, OTP gets verified for successful authentication2. A user sends multiple requests for an OTP over a fixed interval of time, the app sends back the response as &#8211; ‘HTTP 429 error’&nbsp; which translates to “too many requests”3. A user sends repeated requests multiple times and the OTP generated during these successive requests is the same and also they get successfully verified4. The user enters a wrong OTP and the authentication fails5. Users enter the right OTP but later than the specified expiry time, authentication fails6. Users enter the OTP after a long time (expiration time) &#8211; the authentication fails



<h2 id="how-to-break-the-otp-functionality-for-2fa">How to break the OTP functionality for 2FA</h2>



Think like a hacker, first understand how hackers use the 2FA vulnerabilities to get access to applications. Once you know how to break it, you&#8217;ll know how to test it.&nbsp; 



Rate Limit Algorithm &#8211; The rate limit algorithm is used to test whether a user session (or IP address) should be limited in the number or speed of authentication attempts being sent, and under what circumstances this happens. 



<ul class="list_style_disc"><li>&nbsp;If the user has performed too many requests within a certain period of time, the web application can respond with a 429 code (too many requests) or apply a rate limit without showing errors</li></ul>



<ul class="list_style_disc"><li>The absence of a rate limit implies that there are no restrictions on the number of attempts and/or speed — it is allowed to iterate over codes any amount of times (at any speed) within the session / token validity period</li></ul>



It is the responsibility of the QA team to ensure that the development team sets an appropriate rate limit on the number/speed of authentication requests being sent from a user session (or IP address).



<h2 id="ways-in-which-a-hacker-can-get-access-to-your-code">Ways in which a hacker can get access to your code: </h2>



1. A lack of rate limit &#8211; A hacker can send out multiple authentication requests and thus achieve entry into the application2. Rate limits exist but can be bypassed &#8211; Security analysts try to pick up code using 2 or more threads to make an attack faster. With the help of manipulations, they successfully select the required code, leading to Account Takeover.



<ul class="list_style_disc"><li>&nbsp;If the 2FA code doesn’t have a specific expiration date, then a potential hacker or a security analyst is presented with more time to work this through</li></ul>



<ul class="list_style_disc"><li>&nbsp;But if the validity period is present, then the success of the attack is reduced, but the potential danger of vulnerability is still present since there is still a chance of getting in with the right code</li></ul>



3. The same OTP gets generated for some time&nbsp;



If your application sends the same 4 digit code between 0000 to 9999 for around 5 minutes, a hacker can run a brute force algorithm to test out all 4 digit numbers within the 5 minute time period 



4. Bypassing the rate limit by changing the IP Address



Many locks are based on restricting the number of requests from an IP. Thus, when an IP has sent a certain number of attempts when executing a request, the IP is restricted. To overcome this, <a href="https://www.perimeter81.com/resources/remote-access-vpn" target="_blank" rel="noreferrer noopener">change your IP using a VPN</a> or <a href="https://zoogvpn.com/en_us/vpn-downloads/" target="_blank" rel="noreferrer noopener">download VPN </a>and continue sending requests to break the code. 



While hackers continuously find ways to achieve illegal access to applications, we at Testsigma will continue to update this document.



We have learnt about use cases, how to break the system to get illegal access/entry into apps.&nbsp; 



Now let&#8217;s try to understand how to test this functionality.&nbsp; 



<h2 id="how-to-test-the-otp-functionality-for-2fa">How to test the OTP functionality for 2FA</h2>



The primary requirement for testing this functionality is to have an end user’s phone.



While you can connect your own phone for a single test on your computer, you will require a phone which can be accessed by your tests on the cloud to run different tests on different platforms.&nbsp; 



Traditionally these tests have been automated only as a POC(proof of concept). Companies hardly test the OTP functionality because



1. It is time-consuming2. Involves third-party frameworks 3. Involves a cost to the company4. Testers don’t have the required programming knowledge



	It comes with a monthly cost and each SMS received is charged separately.&nbsp; 



Have a look at the code below: 



Using python packages, REST APIs and HTTP calls, these OTPs are read and used in the test.&nbsp;



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/R6pJsAQ_eJQEBhY6wPkKqkNRBPbBXsL9KY-J8gK8KrbuQf-a1tg9Ed-I7igwZjI2pOEKUa-sCfvjEHA_3dK8ym_XYHYc60xnOn6BaxbplSnyFTCndIdwBZ0DcS77_D9BOH1X_Mka" alt=""/></figure>



<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/rcy-31h9QmcGObjeYmSkScjZq77RYpkYMCzPxDARqbfMUOY7JpZJc1E_mliRe-35cWyOSENb38oESJx0N5DIQzKSQOQjui6L860f35fHUjUwHVJKaa9IqWUSwvHmXe_NKFk3tQwt" alt=""/></figure>



Do we expect our QA teams to write this code every time to test OTP functionality?



<h2 id="the-modern-approach-to-testing-otp-functionality-using-testsigma">The Modern Approach to testing OTP functionality using Testsigma</h2>



<a href="https://testsigma.com/" target="_blank" rel="noreferrer noopener" aria-label=" (opens in a new tab)">Testsigma</a> offers a simple interface to test these OTP based authentication methods.&nbsp; 



Testsigma comes inbuilt with mobile numbers spanning across different geographic locations.&nbsp; 



Using a simple NLP based approach, we help you automate the complicated use cases mentioned at the beginning of this discussion.&nbsp; 



Testsigma’s NLP based approach to automating the OTP request retrieval mechanism requires zero knowledge of code. It does not come with any extra costs and a tester can easily automate these functionalities within minutes.&nbsp; 



To read more on how exactly Testsigma does it, check the article here: <a rel="noreferrer noopener" aria-label=" (opens in a new tab)" href="https://support.testsigma.com/support/solutions/articles/32000030503-advanced-test-automation-2-factor-authentication-2fa-" target="_blank">2 Factor Authentication(2FA) with Testsigma</a>&nbsp;



Testsigma’s modern approach also enables users to retrieve codes via emails. 



So why wait, Join the Testsigma testing revolution!



 #Smart Test Automation 



<div class="bg-primary cta">

Automate 2 Factor authentication along with all your end-to-end tests for web and mobile apps with Testsigma
<div class="d-flex mb-1" style="justify-content:space-evenly">
 <button class="btn cta-btn bg-white"><a href="https://testsigma.com/signup" target="_blank" rel="noopener noreferrer">Sign up Now </a></button></div>
</div>

2 Factor Authentication The Tester’s Edition