📱 Mobile Test Automation Framework (Appium + TestNG + Java)

---

🌟 Project Overview

This repository houses an enterprise-grade mobile test automation framework designed for Android native and hybrid applications (tested on the Sauce Labs Android Demo Application). Built on Java 17, Appium, and TestNG, it implements the Page Object Model (POM) design pattern to deliver robust, scalable, and maintainable automated test execution across three vital QA domains:

1. 🛒 End-to-End (E2E) UI Testing: Complete multi-step user purchase workflows, guest-to-authenticated transitions, and order confirmation verification.
2. ⚙️ Functional Testing: Granular feature verification covering authentication, catalog sorting, product customization, cart management, drawer navigation, and app state resets.
3. 🛡️ Mobile Security Testing (OWASP MASVS-Aligned): Proactive vulnerability auditing covering SQL Injection, Cross-Site Scripting (XSS), password field masking attributes, account lockout enforcement, input buffer overflow fuzzing, and Android Logcat sensitive credential leakage checks.

---

🏗️ Framework Architecture

MobileTestAppium/
├── .github/
│   └── workflows/
│       └── ci.yml                      # GitHub Actions CI/CD Pipeline
├── src/
│   └── test/
│       ├── java/
│       │   ├── listeners/
│       │   │   ├── ExtentReportManager.java # ExtentReports 5.x report lifecycle manager
│       │   │   └── TestListener.java        # TestNG listener for status, tags & screenshots
│       │   ├── pages/                       # Page Object Model (POM) encapsulation
│       │   │   ├── BasePage.java            # Fluent waits, scrolling, element helpers
│       │   │   ├── LoginPage.java           # Authentication inputs, error & masking checks
│       │   │   ├── HomePage.java            # Catalog sorting, items list, cart badge
│       │   │   ├── ProductDetailsPage.java  # Item customization, color swatches, qty +/-
│       │   │   ├── CartPage.java            # Item list, remove actions, checkout trigger
│       │   │   ├── CheckoutAddressPage.java # Shipping address form & validation errors
│       │   │   ├── CheckoutPaymentPage.java # Card details form & validation errors
│       │   │   ├── CheckoutReviewPage.java  # Order overview & Place Order trigger
│       │   │   ├── CheckoutCompletePage.java# Order confirmation & dispatch verification
│       │   │   └── MenuPage.java            # Navigation drawer, app reset & logout modal
│       │   ├── tests/
│       │   │   ├── e2e/
│       │   │   │   └── EndToEndCheckoutTest.java       # Full user purchase journeys
│       │   │   ├── functional/
│       │   │   │   ├── AuthenticationTests.java        # Valid/invalid login & logout
│       │   │   │   ├── ProductCatalogTests.java        # Catalog display, sorting & details
│       │   │   │   ├── CartManagementTests.java        # Add/remove items & badge counter
│       │   │   │   ├── NavigationAndMenuTests.java     # Drawer routes & Reset App State
│       │   │   │   └── CheckoutValidationTests.java    # Mandatory form validations
│       │   │   ├── security/
│       │   │   │   ├── AuthenticationSecurityTests.java# SQLi, XSS, masking, lockout, fuzzing
│       │   │   │   ├── InputValidationSecurityTests.java# Form payload injection & Unicode
│       │   │   │   └── DataLeakageSecurityTests.java   # Android Logcat PII leakage audit
│       │   │   └── AppTests.java                       # Smoke & baseline test suite
│       │   └── utils/
│       │       ├── BaseTest.java            # Driver lifecycle & failure screenshots
│       │       ├── ConfigReader.java        # Property loader with CLI override support
│       │       ├── SecurityPayloads.java    # Curated attack vectors (SQLi, XSS, fuzzing)
│       │       └── LogcatHelper.java        # System log scanner for credential leaks
│       └── resources/
│           └── config.properties            # Centralized test configuration
├── pom.xml                                  # Maven dependencies & surefire plugins
├── testng.xml                               # Master TestNG suite configuration
├── testng-e2e.xml                           # Dedicated E2E UI TestNG suite
├── testng-functional.xml                    # Dedicated Functional TestNG suite
├── testng-security.xml                      # Dedicated Security TestNG suite
├── sauce-demo-app.apk                       # Target Android application under test
└── README.md                                # Project documentation

---

🧪 Test Suites & Coverage Matrix

Category	Test Suite Class	Test Cases / Scenarios Covered	TestNG Groups
E2E UI	EndToEndCheckoutTest	• Complete user purchase journey (Login → Catalog → Product Details → Cart → Shipping → Payment → Order Review → Order Complete) • Guest shopping with login enforcement at checkout	e2e, ui, smoke
Functional	AuthenticationTests	• Valid credential authentication (bob@example.com) • Invalid credentials rejection • Locked-out user warning (alice@example.com) • Empty username validation • Empty password validation • Logout flow & session termination	functional, auth, smoke
Functional	ProductCatalogTests	• Catalog load verification • Sort by Name Ascending (A to Z) • Sort by Name Descending (Z to A) • Sort by Price Low to High • Sort by Price High to Low • Product details inspection (title, price, description, rating) • Quantity counter increment/decrement	functional, catalog, smoke
Functional	CartManagementTests	• Initial cart count verification • Single item add & badge increment • Multi-quantity add & badge sync • Item removal & empty cart verification • Continue shopping navigation	functional, cart, smoke
Functional	NavigationAndMenuTests	• Side drawer open/close • Navigation to Webview & About screens • Reset App State (clears cart and restores defaults)	functional, navigation
Functional	CheckoutValidationTests	• Mandatory shipping address field validation (Name, Address, City, Zip, Country) • Payment form required field validation (Card Number, Expiry, CVV)	functional, checkout
Security	AuthenticationSecurityTests	• SQL Injection: Fuzzing login inputs with SQLi vectors (' OR '1'='1, admin' --, UNION SELECT) to prevent auth bypass • XSS Script Injection: Testing script payloads (<script>, <img>, javascript:) in credentials • Password Field Masking: Verifying password="true" attribute to prevent plaintext shoulder surfing • Account Lockout Policy: Enforcing lockout policies for suspicious accounts • Buffer Overflow Fuzzing: Injecting 3,000+ character payloads to prevent application crashes/ANR	security, authentication, injection, fuzzing
Security	InputValidationSecurityTests	• SQL Injection in shipping & checkout forms • XSS script injection in customer address fields • Special character & Unicode/Emoji sanitization	security, input-validation, fuzzing
Security	DataLeakageSecurityTests	• Logcat Credential Leakage Audit: Scanning Android system logs (logcat) to verify plaintext passwords and card data are not leaked • Driver Configuration Security: Verifying secure UiAutomator2 automation engine and capabilities	security, data-leakage
Smoke	AppTests	• Rapid launch verification, login display, catalog header, and cart check	smoke, functional

---

🛡️ Mobile Security Testing Methodology (OWASP MASVS)

The framework aligns with the OWASP Mobile Application Security Verification Standard (MASVS):

1. MASVS-AUTH (Authentication & Session Management):
   • Evaluates input sanitization against SQL Injection and Authentication Bypass vectors.
   • Asserts that locked accounts cannot establish valid sessions.
2. MASVS-STORAGE & PRIVACY (Data Storage & Leakage Prevention):
   • Uses LogcatHelper to scan runtime system logs during authentication and checkout to ensure PII, tokens, and passwords are never dumped into Android Logcat.
3. MASVS-CODE (Code Quality & Input Fuzzing):
   • Validates client-side input field behavior against boundary overflows (3,000+ character strings), format strings (%s%x%n), and Unicode payloads.
4. MASVS-RESILIENCE & ATTRIBUTES:
   • Inspects UI component attributes (password="true", inputType masking) to protect user credentials in transit and on screen.

---

⚙️ Prerequisites & Setup

1. Requirements

• Java Development Kit (JDK): Version 17 or higher (JAVA_HOME set)
• Apache Maven: Version 3.8 or higher (PATH configured)
• Node.js & npm: Node 16+
• Appium 2.x Server: Installed globally:

  npm install -g appium@next
  appium driver install uiautomator2

• Android Studio / Android SDK: Android SDK tools with an emulator (e.g. Android 11+ / API 30+) or a connected physical device with USB Debugging enabled.

2. Configuration (src/test/resources/config.properties)

Adjust parameters in config.properties or override via command line:

appium.server.url=http://127.0.0.1:4723/
appium.device.name=emulator-5554
appium.platform.version=11.0
appium.app.path=sauce-demo-app.apk
appium.auto.grant.permissions=true
appium.implicit.wait.seconds=10
appium.explicit.wait.seconds=15

---

🚀 How to Run Tests

Step 1: Start Appium Server

appium

Step 2: Run Automated Test Suites

🎯 1. Run Master Test Suite (All E2E, Functional & Security Tests)

mvn clean test

🛒 2. Run End-to-End (E2E) UI Tests Only

mvn test -DsuiteXmlFile=testng-e2e.xml

⚙️ 3. Run Functional Tests Only

mvn test -DsuiteXmlFile=testng-functional.xml

🛡️ 4. Run Mobile Security Tests Only

mvn test -DsuiteXmlFile=testng-security.xml

🏷️ 5. Run Tests by TestNG Group

# Run only security tests
mvn test -Dgroups=security

# Run only smoke tests
mvn test -Dgroups=smoke

# Run only E2E tests
mvn test -Dgroups=e2e

# Run only authentication tests
mvn test -Dgroups=auth

📱 6. Override Appium & Device Parameters at Runtime

mvn clean test -Dappium.server.url=http://127.0.0.1:4723/ -Dappium.device.name=Pixel_7_API_33

---

📊 Test Reports & Failure Artifacts

1. Interactive ExtentReports (Dark Theme)

After execution, a report is automatically compiled into the reports/ folder:

• Location: reports/ExecutionReport_YYYYMMDD_HHMMSS.html
• Features: Categorized test breakdowns (E2E UI Tests, Functional Tests, Security Tests), pass/fail badges, execution timestamps, and embedded failure screenshots.

2. Automatic Failure Screenshots

• Location: reports/screenshots/<TestName>_<Timestamp>.png
• Captured automatically via TestListener upon test assertion failures or timeouts.

3. Surefire XML & HTML Reports

• Location: target/surefire-reports/index.html and target/surefire-reports/testng-results.xml.

---

🔄 Continuous Integration (GitHub Actions CI)

The .github/workflows/ci.yml pipeline automatically validates the code on every push and pull request to main or master:

1. Checks out repository and configures Java 17 (Temurin) with dependency caching.
2. Compiles test classes and verifies framework integrity (mvn clean test-compile).
3. Executes the automated test suite with TestNG.
4. Uploads test execution reports and ExtentReports as downloadable GitHub Actions build artifacts.

---

🌿 Git Workflow & Pushing to GitHub

To initialize or push this project to your GitHub repository:

1. Clone or Pull Latest Repository

git clone https://github.com/MHuzaifaAsif/MobileTestAppium.git
cd MobileTestAppium

2. Configure Remote Repository (If not already set)

# Add origin remote
git remote add origin https://github.com/MHuzaifaAsif/MobileTestAppium.git

# Verify remote configuration
git remote -v

3. Push to GitHub

# Ensure branch is main
git branch -M main

# Push changes to GitHub
git push -u origin main

---

👥 Contributors & License

• Framework: Mobile Test Automation with Appium, Selenium, TestNG & ExtentReports
• License: MIT License