Data Selectors - Examples

In PHP web applications, session IDs can be embedded in the URL query strings rather than cookies, like in the following example:

You can extract the session ID values using the following data selector:

• Area: Body (RegExp)

• Expression: PHPSESSID\=([A-Za-z0-9,-]*)

• Attributes: $1

You can create this data selector by using the Create Data Selector wizard or by entering the appropriate regular expression in the Expression column.

Some web applications return variable parts (like user IDs) in a response and then you use these IDs in further requests in the scenario. For instance, the response body may contain the following link:

You can extract user ID values using the following data selector:

• Area: Body (RegExp)

• Expression: userId\=(\{[A-Za-z0-9_]*\})

• Attributes: $1

You can create this data selector by using the Create Data Selector wizard or by entering the appropriate regular expression in the Expression column.

A typical example of hidden fields is the ASP.NET ViewState value, which is inserted into responses in the following form:

To extract the ViewState value from the response:

• Area: Body (RegExp)

• Expression: \sname\s*?\=\s*?"__VIEWSTATE"[^^]*?\svalue\s*?\=\s*?"(.*?)"[^^]*?>

• Attributes: $1

You can create a data selector by using the Create Data Selector wizard (choose Get an input field value in the wizard) or by entering the appropriate regular expression in the Expression column.

Suppose, you want to extract the order number from the following HTML element in the response:

To do this, you can define the following data selector:

• Area: Body (RegExp)

• Expression: Your order number is ([A-Z0-9-]+)

  (You can also use the Your\s+order\s+number\s+is\s+([A-Z0-9-]+) pattern to match different types and variable number of whitespace characters between the words in the phrase.)

• Attributes: $1

You can create this data selector by using the Create Data Selector wizard or by entering the appropriate regular expression in the Expression column.

Some web applications use cookies to store user-related or session-related information, for example, a security token. You need to use that token in subsequent requests to get access to the web server resources.

To extract a cookie value from a response:

• Area: Cookie

• Expression: SessionID

  Use the cookie name to specify the data selector’s expression. You can find the list of cookies in the Response Header table.