In this paper we present an original approach to generate attack scripts aiming at security validation of information systems and applications. The goal is to uncover potential vulnerabilities that an attacker could exploit to cause security failures of the system. We use attack modelling to specify the system flaws and derive the corresponding attack scenarios. The attack scenarios are refined to generic attack scripts using: attack pattern, event- condition-action rule, keyword-driven testing, and UML diagrams. The generic attack scripts are then converted to executable scripts for a testing tool. The generated attack scripts are in a format that is independent of the used tool, i.e., they are reusable. The executable attack scripts are able to simulated real attacks. Examples are provided to show the usage of the approach