Jaanu Jeeva

Banking And Financial Software Testing Methodologies

2011-12-29T15:28:00.007+05:30

The increasing regulatory requirements, raising customer expectations, rapid consolidation, and convergence in the banking and financial sector has created the need for sophisticated IT solutions that operate in real time with continuous availability and reliability.

In a drive to give operational excellence, which is of paramount importance, the banking and financial sector is looking for solutions that could address the challenges they are facing:

Implementing more rigor within risk management and corporate governance from board level downwards
Building on opportunities from market concentration and globalization
Focusing on the need to gain operational synergies from mergers and acquisitions

Responding to regulatory and government changes and leveraging these changes to provide business opportunity
Improving customer service and customer retention
Reducing operating costs across both the business and IT
Implementing technological changes such as Vista and SOA based solutions

The technological advancements, intent to address these challenges, need to be sophisticated, hence the need for a formal quality management and testing approach that will help them deliver enhanced business value with optimized benefits, and above all a defect free solution.

AppLabs' quality management and testing services utilize its many years of banking and finance experience across the globe to support clients who view technology as a business enabler and see the importance of getting implementation right first time. Integration of large, widely distributed systems is more and more complex and AppLabs services are designed to identify and manage these effectively, hence delivering result-oriented and cost-effective services.

Software vendors often focus on software development activities, which leave them with very little time to develop testing competencies. As a bank, you might find that they lack proven processes and methodologies, and ready test teams to execute your testing projects as efficiently as a specialist independent testing partner can.

We have a track record of over 14 years in successfully executing software testing projects for Global 500 banking and financial services clients across the world (translating to over 10 Million person hours of testing experience). Over the years, we have created (and are continuously improving) Test Processes and Methodologies that comprise:

Metrics-driven testing processes
Standardized documentation of test ware
Effective systems of reviews
Optimum usage of automation techniques

Our vast experience with testing projects has helped us to evolve numerous best practises which differentiate us from system integrators who also offer testing services. These form the foundation of our Seven Step Methodology that minimizes project risks and streamlines testing delivery to your satisfaction. Your partnering with us for testing services provides for effective and comprehensive planning and execution of testing projects.

Seven Step Delivery Model

Step 1 - Proposal for Engagement

In this step, we define the terms of reference, customer expectations, project scope & commitments, and the overall project framework.

Step 2 - Knowledge Transfer

In this step, our domain experts/business analysts will ensure that the critical activity of knowledge transfer, both domain-specific as well as project-specific knowledge, takes place smoothly and with the least possible effort.

Step 3 - Test Preparation

In this step, which runs parallel to the software development activity, our team works with you to produce test strategies, test cases, traceability, test scripts, test data guidelines and Run Plans. Parallel preparation helps compress project timelines.

Step 4 - Test Execution

In this step, we carry out actual testing based on the test start and completion criteria. Experienced test teams work together to ensure flawless and timely completion of the project.

Step 5 - Defect Management

In this step, we take care of defect management and track defects systematically to closure. We also produce test logs, defect summaries, status reports and defect analyses.

Step 6 - Test Automation

In this step, we select and deploy appropriate tools for automating regression testing and performance testing. Test execution productivity is considerably enhanced by the use of automatic tools.

Step 7 - Test Maintenance

In this step, we implement a process and a stable framework for handling on-going release testing requirements on a long-term basis

Quality & Testing for Financial Services

2011-12-13T20:53:00.000+05:30

Unparalleled financial services domain expertise to our testing engagements. We have experience testing key applications for the world’s largest banks, insurers and investment firms and have developed a wealth of proprietary tools and accelerators to streamline your testing processes.

For banking, our testing accelerators cover common processes for commercial lending, cards processing and payments. We have an extensive library of test cases, scenarios, use cases and automated scripts including models for VisionPLUS®, SWIFT, and TSYS®
For capital markets, we developed industry-leading tools for FIX protocol testing and Calypso in addition to accelerators to test systems for investment banking, asset and wealth management, brokerage services, custodian operations, and exchanges.
For insurance, we have use cases, test scenarios and automated scripts to handle common tasks for underwriting, policy administration and claims management. Our accelerators for specific insurance applications include model based testing assets for Guidewire. Our Pega Testing Toolkit helps lower testing time for Pega-based business process management applications through automation.

Measurable Results

Capgemini combines world-class testing expertise and global financial services domain experience to streamline testing for customized or commercial off the shelf applications. We have helped our clients:

Optimize quality assurance processes to reduce post production defects by 25% or more
Develop testing management programs that reduce post production defects by 25%, test execution time by 15%, and testing preparation time by 20% with 0% defect leakage to production
Reduce test failures due to unavailable test data by 70%
Achieve 15% overall project savings through the use of defect prediction modeling
Lower testing time for commercial software by as much as 30%

Proven Solutions for Financial Institutions

Model Based Testing Workbench. A tool driven approach to automate test design and accelerate testing for commercial financial services applications. By using pre-defined models, Capgemini helped a European bank increase test coverage by 300% and created over 2,600 test cases in one month.
Quality Blueprint. A customized assessment which measures the maturity level of your test organization against industry benchmarks. Using our proprietary, historical database of assessments, Capgemini benchmarks your company against the financial services industry across 22 dimensions and provides a roadmap with recommendations to move to the next level of maturity.
Managed Testing Services. A collaborative approach to sourcing testing and QA services, managed testing services provide financial services firms with a way to transform their testing function and achieve high-quality systems cost-effectively, without losing overall control or incurring expensive overhead costs.

From Capgemini

Software Testing Practical Tips

2011-09-07T12:50:00.006+05:30

Here are some of the best testing practices I learned by experience:

1) Learn to analyze your test results thoroughly. Do not Ignore the test result. The final test result may be ‘pass’ or ‘fail’ but troubleshooting the root cause of ‘fail’ will lead you to the solution of the problem. Testers will be respected if they not only log the bugs but also provide solutions.

2) Learn to maximize the test coverage every time you test any application. Though 100 percent test coverage might not be possible still you can always try to reach near it.

3) To ensure maximum test coverage break your application under test (AUT) into smaller functional modules. Write test cases on such individual unit modules. Also if possible break these modules into smaller parts.
E.g: Lets assume you have divided your website application in modules and ‘accepting user information’ is one of the modules. You can break this ‘User information’ screen into smaller parts for writing test cases: Parts like UI testing, security testing, functional testing of the ‘User information’ form etc. Apply all form field type and size tests, negative and validation tests on input fields and write all such test cases for maximum coverage.

4) While writing test cases write test cases for intended functionality first i.e. for valid conditions according to requirements. Then write test cases for invalid conditions. This will cover expected as well unexpected behavior of application under test.

5) Think positive. Start testing the application by intend of finding bugs/errors. Don’t think beforehand that there will not be any bugs in the application. If you test the application by intention of finding bugs you will definitely succeed to find those subtle bug also.

6) Write your test cases in requirement analysis and design phase itself. This way you can ensure all the requirements are testable.

7) Make your test cases available to developers prior to coding. Don’t keep your test cases with you waiting to get final application release for testing, thinking that you can log more bugs. Let developers analyze your test cases thoroughly to develop quality application. This will also save the re-work time.

8 ) If possible identify and group your test cases for regression testing. This will ensure quick and effective manual regression testing.

9) Applications requiring critical response time should be thoroughly tested for performance. Performance testing is the critical part of many applications. In manual testing this is mostly ignored part by testers due to lack of required performance testing large data volume. Find out ways to test your application for performance. If not possible to create test data manually then write some basic scripts to create test data for performance test or ask developers to write one for you.

10) Programmers should not test their own code. Basic unit testing of developed application should be enough for developers to release the application for testers. But you (testers) should not force developers to release the product for testing. Let them take their own time. Everyone from lead to manger know when the module/update is released for testing and they can estimate the testing time accordingly. This is a typical situation in agile project environment.

11) Go beyond requirement testing. Test application for what it is not supposed to do.

12) While doing regression testing use previous bug graph (Bug graph – number of bugs found against time for different modules). This module-wise bug graph can be useful to predict the most probable bug part of the application.

13) Note down the new terms, concepts you learn while testing. Keep a text file open while testing an application. Note down the testing progress, observations in it. Use these notepad observations while preparing final test release report. This good habit will help you to provide the complete unambiguous test report and release details.

14) Many times testers or developers make changes in code base for application under test. This is required step in development or testing environment to avoid execution of live transaction processing like in banking projects. Note down all such code changes done for testing purpose and at the time of final release make sure you have removed all these changes from final client side deployment file resources.

15) Keep developers away from test environment. This is required step to detect any configuration changes missing in release or deployment document. Some times developers do some system or application configuration changes but forget to mention those in deployment steps. If developers don’t have access to testing environment they will not do any such changes accidentally on test environment and these missing things can be captured at the right place.

16) It’s a good practice to involve testers right from software requirement and design phase. These way testers can get knowledge of application dependability resulting in detailed test coverage. If you are not being asked to be part of this development cycle then make request to your lead or manager to involve your testing team in all decision making processes or meetings.

17) Testing teams should share best testing practices, experience with other teams in their organization.

18) Increase your conversation with developers to know more about the product. Whenever possible make face-to-face communication for resolving disputes quickly and to avoid any misunderstandings. But also when you understand the requirement or resolve any dispute – make sure to communicate the same over written communication ways like emails. Do not keep any thing verbal.

19) Don’t run out of time to do high priority testing tasks. Prioritize your testing work from high to low priority and plan your work accordingly. Analyze all associated risks to prioritize your work.

20) Write clear, descriptive, unambiguous bug report. Do not only provide the bug symptoms but also provide the effect of the bug and all possible solutions.

Don’t forget testing is a creative and challenging task. Finally it depends on your skill and experience, how you handle this challenge.

All About Web Testing

2011-09-07T12:33:00.003+05:30

While testing a web application you need to consider following Cases:

• Functionality Testing
• Performance Testing
• Usability Testing
• Server Side Interface
• Client Side Compatibility
• Security

Functionality:
In testing the functionality of the web sites the following should be tested:
• Links
i. Internal Links
ii. External Links
iii. Mail Links
iv. Broken Links

• Forms
i. Field validation
ii. Error message for wrong input
iii. Optional and Mandatory fields

• Database
* Testing will be done on the database integrity.

• Cookies
* Testing will be done on the client system side, on the temporary Internet files.

Performance :
Performance testing can be applied to understand the web site’s scalability, or to benchmark the performance in the environment of third party products such as servers and middleware for potential purchase.

Web Site Test Tools and Site Management Tools

2011-09-07T12:24:00.000+05:30

Load and Performance Test Tools

Java Test Tools

Link Checkers

HTML Validators

Free On-the-Web HTML Validators and Link Checkers

PERL and C Programs for Validating and Checking

Web Functional/Regression Test Tools

Web Site Security Test Tools

External Site Monitoring Services

Web Site Management Tools

Log Analysis Tools

Mobile Web/App Testing Tools

Other Web Test Tools

Complete guide on testing web applications

2011-09-07T12:19:00.002+05:30

Considered while testing web applications. Here we will see some more details on web application testing with web testing test cases. Let me tell you one thing that I always like to share practical knowledge, which can be useful to users in their career life. This is a quite long article so sit back and get relaxed to get most out of it.

Let’s have first web testing checklist.
1) Functionality Testing
2) Usability testing
3) Interface testing
4) Compatibility testing
5) Performance testing
6) Security testing

1) Functionality Testing:

Test for – all the links in web pages, database connection, forms used in the web pages for submitting or getting information from user, Cookie testing.

Check all the links:

Test the outgoing links from all the pages from specific domain under test.
Test all internal links.
Test links jumping on the same pages.
Test links used to send the email to admin or other users from web pages.
Test to check if there are any orphan pages.
Lastly in link checking, check for broken links in all above-mentioned links.

Test forms in all pages:
Forms are the integral part of any web site. Forms are used to get information from users and to keep interaction with them. So what should be checked on these forms?

First check all the validations on each field.
Check for the default values of fields.
Wrong inputs to the fields in the forms.
Options to create forms if any, form delete, view or modify the forms.

Let’s take example of the search engine project currently I am working on, In this project we have advertiser and affiliate signup steps. Each sign up step is different but dependent on other steps. So sign up flow should get executed correctly. There are different field validations like email Ids, User financial info validations. All these validations should get checked in manual or automated web testing.

Cookies testing:
Cookies are small files stored on user machine. These are basically used to maintain the session mainly login sessions. Test the application by enabling or disabling the cookies in your browser options. Test if the cookies are encrypted before writing to user machine. If you are testing the session cookies (i.e. cookies expire after the sessions ends) check for login sessions and user stats after session end. Check effect on application security by deleting the cookies. (I will soon write separate article on cookie testing)

Validate your HTML/CSS:
If you are optimizing your site for Search engines then HTML/CSS validation is very important. Mainly validate the site for HTML syntax errors. Check if site is crawlable to different search engines.

Database testing:
Data consistency is very important in web application. Check for data integrity and errors while you edit, delete, modify the forms or do any DB related functionality.
Check if all the database queries are executing correctly, data is retrieved correctly and also updated correctly. More on database testing could be load on DB, we will address this in web load or performance testing below.

2) Usability Testing:

Test for navigation:
Navigation means how the user surfs the web pages, different controls like buttons, boxes or how user using the links on the pages to surf different pages.
Usability testing includes:
Web site should be easy to use. Instructions should be provided clearly. Check if the provided instructions are correct means whether they satisfy purpose.
Main menu should be provided on each page. It should be consistent.

Content checking:
Content should be logical and easy to understand. Check for spelling errors. Use of dark colors annoys users and should not be used in site theme. You can follow some standards that are used for web page and content building. These are common accepted standards like as I mentioned above about annoying colors, fonts, frames etc.
Content should be meaningful. All the anchor text links should be working properly. Images should be placed properly with proper sizes.
These are some basic standards that should be followed in web development. Your task is to validate all for UI testing

Other user information for user help:
Like search option, sitemap, help files etc. Sitemap should be present with all the links in web sites with proper tree view of navigation. Check for all links on the sitemap.
“Search in the site” option will help users to find content pages they are looking for easily and quickly. These are all optional items and if present should be validated.

3) Interface Testing:
The main interfaces are:
Web server and application server interface
Application server and Database server interface.

Check if all the interactions between these servers are executed properly. Errors are handled properly. If database or web server returns any error message for any query by application server then application server should catch and display these error messages appropriately to users. Check what happens if user interrupts any transaction in-between? Check what happens if connection to web server is reset in between?

4) Compatibility Testing:
Compatibility of your web site is very important testing aspect. See which compatibility test to be executed:

Browser compatibility
Operating system compatibility
Mobile browsing
Printing options

Browser compatibility:
In my web-testing career I have experienced this as most influencing part on web site testing.
Some applications are very dependent on browsers. Different browsers have different configurations and settings that your web page should be compatible with. Your web site coding should be cross browser platform compatible. If you are using java scripts or AJAX calls for UI functionality, performing security checks or validations then give more stress on browser compatibility testing of your web application.
Test web application on different browsers like Internet explorer, Firefox, Netscape navigator, AOL, Safari, Opera browsers with different versions.

OS compatibility:
Some functionality in your web application is may not be compatible with all operating systems. All new technologies used in web development like graphics designs, interface calls like different API’s may not be available in all Operating Systems.
Test your web application on different operating systems like Windows, Unix, MAC, Linux, Solaris with different OS flavors.

Mobile browsing:
This is new technology age. So in future Mobile browsing will rock. Test your web pages on mobile browsers. Compatibility issues may be there on mobile.

Printing options:
If you are giving page-printing options then make sure fonts, page alignment, page graphics getting printed properly. Pages should be fit to paper size or as per the size mentioned in printing option.

5) Performance testing:
Web application should sustain to heavy load. Web performance testing should include:
Web Load Testing
Web Stress Testing

Test application performance on different internet connection speed.
In web load testing test if many users are accessing or requesting the same page. Can system sustain in peak load times? Site should handle many simultaneous user requests, large input data from users, Simultaneous connection to DB, heavy load on specific pages etc.

Stress testing: Generally stress means stretching the system beyond its specification limits. Web stress testing is performed to break the site by giving stress and checked how system reacts to stress and how system recovers from crashes.
Stress is generally given on input fields, login and sign up areas.

In web performance testing web site functionality on different operating systems, different hardware platforms is checked for software, hardware memory leakage errors,

6) Security Testing:

Following are some test cases for web security testing:

Test by pasting internal url directly into browser address bar without login. Internal pages should not open.
If you are logged in using username and password and browsing internal pages then try changing url options directly. I.e. If you are checking some publisher site statistics with publisher site ID= 123. Try directly changing the url site ID parameter to different site ID which is not related to logged in user. Access should denied for this user to view others stats.
Try some invalid inputs in input fields like login username, password, input text boxes. Check the system reaction on all invalid inputs.
Web directories or files should not be accessible directly unless given download option.
Test the CAPTCHA for automates scripts logins.
Test if SSL is used for security measures. If used proper message should get displayed when user switch from non-secure http:// pages to secure https:// pages and vice versa.
All transactions, error messages, security breach attempts should get logged in log files somewhere on web server.

I think I have addressed all major web testing methods. I have worked for around 2 years out of my testing career on web testing. There are some experts who have spent their whole career life on web testing. If I missed out addressing some important web testing aspect then let me know in comments below. I will keep on updating the article for latest testing information.

Thanks to Software Testing Help.

On-line Testing Tools

2010-11-16T12:27:00.002+05:30

On-line Testing Tools by FYIcenter.com

FYIcenter.com has prepared some simple but very interesting on-line testing tools that are useful for your programming and testing tasks:

Validators...

Domain Name Format Validator As a software developer or tester of Web applications, you may be required to know what is a valid domain name and what is an invalid domain name. A valid domain name must satisfy a number of requirements. This page allows you to learn and test domain name format again those requirements.
IP (Version 4) Address Format Validator If you are a software developer or tester of communication applications, you need to know what is a valid IP addresses and what is an invalid IP address. This page allows you to learn and test valid version 4 IP addresses.
MAC (IEEE 802) Address Format Validator If you are a software developer or tester of communication applications, you need to know what is a valid MAC (Media Access Control) addresses and what is an invalid MAC address. This page allows you to learn and test valid version MAC addresses defined in IEEE 802 standards.
Email Address Format Validator As a software developer or tester of Web applications, you are required to know what is a valid email address and what is an invalid email address. According the Internet specifications, there are a number of valid email address formats. This page allows you to learn and test email address of all formats.
Show Me My Browser's Identification Information Whenever you are visiting a Website, your activities will be recorded against a client IP address and host name that represent your computer at that time. This simple test page allows you to find out what is your IP address and host name.
Show Me My IP Address and Host Name Every Web browser sends an identification string to the Web server you are visiting. The Web server can dynamically customize Web pages based on the browser identification. This simple test page allows you to find out what is the identification string of your browser.

Regular expressions...

Testing Regular Expression Match Patterns Regular expression started in Perl language. But it is now used everywhere: text editors, programming languages, and software testing tools. Regular expression is powerful, but hard to learn. This page allows you to learn and test regular expression with your own strings, match patterns, sub patterns, and modifiers.
Testing Regular Expression Match Pattern of Multiple Occurrences Regular expression pattern match with multiple occurrences is a very powerful tool in text editing, software programming and software testing. It can used to parse desired values of multiple occurrences out of text files. This page allows you to learn and test regular expression pattern match multiple occurrences.
Testing Regular Expression Match and Replace Regular expressions are commonly used in pattern matches and replacements processes. Many text editors, programming languages, and software testing tools offers pattern match and replacement functions. This page allows you to learn and test regular expression used in match and replacement processes.

PHP functions...

Testing date() PHP Function Date and time are used in every Web applications. But formatting a date and time value into a string presentation requires very programming skills. This page allows you to learn and test the date() function that gives so many ways to format a data and time value.
Testing htmlspecialchars() PHP Function When data needs to be presented in Web pages, HTML special characters must be well protected Otherwise, data well not be presented properly, or the Web will become corrupted. This page allows you to learn and test the htmlspecialchars() function to protect embedded data in Web pages.
Testing htmlentities() PHP Function When data needs to be presented in Web pages, HTML special characters must be well protected Otherwise, data well not be presented properly, or the Web will become corrupted. This page allows you to learn and test the htmlentities() function to protect embedded data in Web pages.
Testing html_entity_decode() PHP Function When data is embedded in HTML documents, special characters are resented in HTML entities to protect them from being interpreted by browsers. If you need them back, you can use the html_entity_decode() to convert them This page allows you to learn and test the html_entity_decode() function to convert HTML entities.
Testing urlencode() PHP Function When non-alphanumeric characters are presented in user data to be included as part of a Web page address, they need to be encoded into the percent (%) sign format as required by the application/x-www-form-urlencoded standard. This page allows you to learn and test the urlencode() function to perform URL encoding.
Testing urldecode() PHP Function When user data received by a Web server, it is presented in URL encoding format. If you retrieve this data from $_SERVER['QUERY_STRING'], you need to decode the data using the urldecode() function. If This page allows you to learn and test the urldecode() function to perform URL decoding.

Data converters...

Base64 Encode Converter When data is communicated over the Internet, it needs to be encoded into printable characters so it can be safely transmitted through communication applications. This page allows you to learn and test the Base64 encoding process.
Base64 Decode Converter When you receive email attachments, they are usually presented in Base64 encoded format. You can decode them yourself without using any email client tools. This page allows you to learn and test the Base64 decoding process.
UUEncode Converter On Unix systems, when data is communicated from one system to another system, it needs to be encoded into printable characters using the UUEncode algorith for safety reasons. This page allows you to learn and test the UUEncode process.
UUDecode Converter If you receive files in UUencode format for transfer protection reasons, you can decode the file yourselt without using any Unix tools. This page allows you to learn and test the UUdecode process.
Binary to HEX Converter Binary to HEX conversion is need if you want to open any non text file into a text editor to inspect issues like, hidden characters, corrupted UTF-8 sequences, corrupted file identifiers. This page allows you to learn and test the binary to HEX conversion process.
HEX to Binary Converter HEX to binary conversion is to reverse the process of binary to HEX conversion. This page allows you to learn and test the HEX to binary conversion process.

Random data generators...

Random Integer Generator If you are software tester, you may need some random integers to be used as part of application input, or test data in a database. This page allows you to generate large amount of integers randomly for your test data need.
Random Real Number/Float Value Generator If you are software tester, you may need some random real numbers or float values to be used as part of application input, or test data in a database. This page allows you to generate large amount of real numbers randomly for your test data need.
Random Price/Currency Value Generator If you are software tester, you may need some random prices or currency values to be used as part of application input, or test data in a database. This page allows you to generate large amount of currency values randomly for your test data need.
Random Date and Time Value Generator If you are software tester, you may need some random date and time values to be used as part of application input, or test data in a database. This page allows you to generate large amount of date and time values randomly for your test data need.
Random String Generator If you are software tester, you may need some random strings to be used as part of application input, or test data in a database. This page allows you to generate large amount of strings randomly for your test data need.

Test data generators...

Test User Full Name Generator Generator If you are software tester, you may need some user full names to be used as part of application input. This page helps you to generate some random first names and last names for your test data need.
Test User Birthday Date Generator If you are software tester, you may need some user birthday data to be used as part of application input. This page helps you to generate some random birthdays for your test data need.
Test Phone Number Generator If you are software tester, you may need some phone numbers to be used as part of application input. This page helps you to generate some random phone numbers for your test data need.
Test Email Address Generator If you are software tester, you may need some email addresses to be used as part of application input. Email addresses have special formatting rules. This page helps you to generate some email address in valid format for your test data need.
Test IP Address Generator If you are software tester, you may need some IP addresses to be used as part of application input. This page helps you to generate some random IP addresses for your test data need.
Test MAC Address Generator If you are software tester, you may need some MAC addresses to be used as part of application input. This page helps you to generate some random MAC addresses for your test data need.
Test Credit Card Number Generator If you are software tester, you may need some credit card numbers to be used as part of application input. Credit card numbers have special prefixes and MOD 10 checks. This page helps you to generate some credit card numbers in valid format for your test data need.
Test Password Generator If you are software tester, you may need some password strings to be used as part of application input. A good password must be at least 6 characters long and must contain a upper-case letter, a lower-case letter, a number and a symbol. This page helps you to generate some password strings for your test data need.

Credit card numbers

2010-11-16T12:25:00.009+05:30

Credit card numbers that conform to the Luhn formula (MOD 10 check). Usefull for testing e-commerce sites (because they should get past any pre-validation you do, and be declined at the card processor or bank stage).

In testing situations any expiry date within the next 3 years should work

Feedback forces me to clarify this: These are NOT valid credit card numbers. You can't buy anything with these. They are random numbers that happen to conform to the MOD 10 algorithm. They are a technical resource for programmers - that's all.
Information about CVV2 / CVC / etc numbers can be found here: CVV numbers. As you can see these would be very hard to calculate without the bank's keys.

A very good article about the credit card number format can be found here: Anatomy of Credit Card Numbers

Mastercard
5143607869060631
5264693543146973
5464443034740001
517587842256 9449
5315759062537642
5336921146731113
5143519425789449
5225594705173581
55 41093561406828
5557374623193104

VISA 16 digit
4916666381349623
4916908383917100
4539218414087890
4024007137035316
4 516014803932805
4556734276209859
4929251409549960
4110105467370991
4556894 881680645
4556441542607284

VISA 13 digit
4532830735625
4916795009425
4929249348331
4916597760837
4539440492091

American Express
378282246310005
379969317749140
372373103554045
373523592800643
343 671607832767
371449635398431
378734493671000

Discover
6011867276225402
6011901864221380
6011075352539262

Di ners Club
30569309025904
38520000023237

enRoute
201462129749882
21 4923420412798
201417061234863

JCB 15 digit
180063561414749
180053171103808
210003342003738

JCB 16 digit
3158400990432243
3158382627928290
3096373773774104

Voyager
8699450632 91567
869935617638918
869978655076716

Capture Screen

2010-11-16T12:20:00.001+05:30

Depends on the object you want to record...

a. For windows-application such as browsers, other windows and so on I prefer SnagIt or CamStudio (afaik requires license, but not sure about it)For games and other directX-based or OpenGL applications my choice is Fraps (requires additional encoding though, I use fraps to record and virtualDub to encode - pretty easy process). Trial fraps allows to record only 30s of video (which is enough in most cases) and placed a "trial version" watermark on video (but who cares :P ) As mentioned above, Fireshot as an addon for FF is also cool.

b. BB FlashBack Express

Top Open Source E-Commerce Applications

2010-05-14T13:51:00.011+05:30

E commerce has grown into one of the most feasible ways to establish a market presence. For those already reining the market it’s a channel for cheaper and more efficient distribution chain for products services. There are a good number of firms who have tasted success with eCommerce. Especially the Open source ecommerce applications are being largely used to fillip businesses. The whole game is how to fit the ecommerce app to your benefit.

1. Zen Cart

It’s a free and compatible open source shopping cart software. Developed by a group of shop owners, programmers, designers and consultants Zen Cart seems to be more user friendly.

2. Ubercart

This is a feature packed app installed as a module to Drupal, combining it with best CMS application. It serves in selling physical goods; file downloads as well as site access/membership with auto renewal. It works with a number of payment systems like Cyber Source, Authorize.net, PayPal & more.

3. Magneto

For user as well as admin, this software has some strong features to support e-commerce. It allows multiple stores to be managed from a single admin interface. It has some appealing marketing/promotional options like buy 1 get 1 free or multi-tier pricing for quantity discounts.

4. Apache OFBiz

This open source automation software is largely used for e commerce. It includes advanced features for e-commerce.

5. dasCommerce

It’s a multilingual and fully customizable app. dasCommerce offers theming support with unlimited categories and unlimited images to be added to the product.

6. Simplecart(js)

As the name suggest, it’s a simple and easy to use shopping cart. The products are displayed in a single page with an outstanding interface. For the check update and checkout it has the PayPal.

7. osCommerce

It is one of the oldest free e-commerce apps that offer several marketing options and supports most of the payment system. This multilingual and SEO friendly app works with PHP/MySQL.

8. Prestashop

What attracts most is it’s sleek interface. With this open source you can create special deals such as gift vouchers, price reductions, tag products, sell virtual goods and service.

9. Wordpress

It’s a plugin that includes all the vital features of wordpress for managing content. The app has can be used for social networking support. Those who are acquainted with wordpress themeing can do lot for their store.

10. OXID esales

The app encloses most of the essential ecommerce features as well as other additions such as powerful marketing integration, B2C, B2B and social commerce scenarios, integrated CMS, SEO friendly URLs etc.

11. VirtueMart

This is an ecommerce system for Mambo and Joomla. Those in the currency market can take advantage of its functional features that ranges from stock management to instant currency conversion.

12. Substruct

Essentially a Ruby on Rails e-commerce system, it supports Authorize.net & PayPal as payment processors. Apart from being an e-commerce app it also offers an integrated CMS feature for content.

13. Freeway

This app has some innovative ideas for selling. It’s can be used to sell a guitar lesson or rent a tennis court on a given date and time. Moreover it has some exciting selling features like get3x product and get 2 y products free.

14. Spree

Another ecommerce platform using Ruby on Rails. Spree allows improvement and customization. With the Active Merchant plugin it supports most of the payment processors.

15. Ecommr

This app offers the website presenting interface and design elements of e-commerce websites in a categorized way. It includes vivid collection of elements that includes cart buttons, banners, product detail pages and shopping arts and much more.

15. Digistore

This is developed from the osCommerce engine with improvements in front end and admin of app. It provides a platform for selling physical & virtual goods. The app supports several gateways for payment. Further it offers a newsletter support for promotional features.

16. Satchmo

That’s an popular ecommerce app developed with Django. It supports a number of payment processes and its integrated with popular shipping providers. This offers a platform for selling downloadable products, subscriptions or gift certificates.

17. Rail

Open Source Rails is a social gallery application that allows a community to manage a list of applications, with ratings, bookmarks, and social wiki-like ...
www.opensourcerails.com/

18. Flex

A complete Flex store solution for Flex shopping cart, RIA ecommerce shopping cart development, Flex ecommerce application development, Rich B2B solution, ...
flexcart.rightwaysolution.com

Testing of non functional software

2010-02-02T16:02:00.003+05:30

Non functional test is the test of a program application for its non-functional requirements. The names of the a large number of functional tests are used interchangeably, because of overlap between the fields of different non-functional requirements. For example, program performance is a broad term that includes plenty of specific requirements such as reliability & scalability.
Non-functional testing includes:
• Baseline testing
• Compatibility testing
• Compliance testing
• Documentation testing
• Endurance testing
• Load testing
• Localization testing and Internationalization testing
• Performance testing
• Resilience testing
• Security testing
• Scalability testing
• Stress testing
• Usability testing
• Volume testing
• Failover testing

Software performance testing:
In application engineering, performance testing is the check that is completed, with a view to select how rapid some aspect of a technique performs under a particular workload. It may also serve to validate and verify other technique quality attributes such as scalability, reliability and resource usage. Performance testing is a subset of Performance engineering, an emerging practice of computer science that strives to improve performance in the design of and the architecture of a technique before the onset of actual coding work.Performance testing can serve different purposes. It can be shown that the technique meets performance criteria. It can compare one systems to find what works best. Or you can measure what parts of the technique or workload cause the technique to malfunction. For diagnosis, the application engineers use tools such as profiling to measure which parts of a tool or application contribute most to the poor performance or for levels of performance (and thresholds) to maintain acceptable response time. It is critical to the performance cost of a new technique that the performance check efforts start at the beginning of the development project and extend through to deployment. The later detects a malfunction, the greater the cost of rehabilitation. This is true of tests,But more so with performance testing, due to the nature of the tip finish of its scope.

Purposes:
In S/w engineering, performance testing is the check that is completed, with a view to select how rapid some aspect of a technique performs under a particular workload. It may also serve to validate and verify other technique quality attributes such as scalability, reliability and resource usage. Performance testing is a subset of Performance engineering, an emerging practice of computer science that strives to improve performance in the design of
and the architecture of a technique before the onset of actual coding work.Performance testing can serve different purposes. It can be shown that the technique meets performance criteria. It can compare one systems to find what works best. Or you can measure what parts of the technique or workload
cause the technique to malfunction. For diagnosis, the application engineers use tools such as profiling to measure which parts of a tool or application contribute most to the poor performance or for levels of performance (and thresholds) to maintain acceptable response time. It is critical to the performance cost of a new technique that the performance check efforts start at the beginning of the development project and extend through to deployment. The
later detects a malfunction, the greater the cost of rehabilitation. This is true of tests,But more so with performance testing, due to the nature of the tip finish of its scope.

Setting performance goals:
Many performance tests are conducted without due regard to setting realistic performance targets. The Query from a business point of view should always be "why are they benchmark?". Performance goals vary depending on the application technology & purpose however, must always include a quantity of the
following:

Concurrency / Throughput:
If an application identifies the finish users with some kind of login procedure, then the audience is a very desirable aim.By definition, this is the largest number of simultaneous users of the application that the application is expected to support at any given time. The work flow of your transaction with script can affect concurrency application if the iterative part contains the login and log off activity.If the application has no concept of finish users, their objective is likely performance based on a maximum of throughput or transaction fee. A common example would be grounds for navigation of a web-site.

Server response time:
This refers to the time needed for a node application in response to a request from another. A simple example would be an HTTP 'GET' request from client browser to web server. In terms of response time is what all the load tests actually measuring tools. It may be relevant to establish the objectives of server response time among all nodes in the implementation of landscape.

Render response time:
One thing difficult for load testing tools to deal with what they generally have no idea what happens inside a node In addition to recognizing a period where no activity "on the wire '. To measure the response time to render is generally necessary to include functional check scripts as part of performance check scenario which is a feature that does not offer plenty of load testing tools.

Performance Testing Sub-Genres:
• load
• stress
• endurance
• spike
• configuration
• isolation

Load Testing:
This is the simplest form of performance tests. A load check is usually completed to understand the behavior of the application provided under a specific load. This load can be the expected number of concurrent users in the application that performs a specific number of transaction within the set period. This check will give the answer times of all transactions of the major criticism. If the server database, applications, etc. are also monitored, then this simple check can itself point to any bottlenecks in the application program.

Stress Testing:
This test is normally used to understand the upper limits of capacity in the application environment. This type of test is performed to decide the strength of the application in times of extreme load and helps application administrators whether the application is made sufficiently if the load current is well above the maximum allowed.

Endurance Testing (Soak Testing):
This check is performed to choose if the application can sustain the continuous expected load. During the resistance tests, memory usage is monitored to detect leaks. It is also important but often overlooked is the performance degradation. That is, to ensure that the performance and / or response times after a long period of sustained activity are as lovely or better than at the beginning of the check.

Spike Testing:
Spike test, as its name suggests is made by nailing the number of users and understanding the behavior of the
demand if it disappears or is going to be able to handle extreme changes in the load.

Configuration Testing:
Configuration testing is another variation on the traditional performance testing. In lieu of performance tests from the point of view of the burden that is testing the effects of configuration changes in the application environment in the application performance and behavior. A common example would be experimenting with different methods load balancing.

Isolation Testing:
It is not exclusive performance tests, but a term used to describe the repetition of a check run that resulted in a implementation problem. They are often used to isolate and confirm the dominance of the blame.

Anbullam Konda

2010-01-24T11:55:00.000+05:30

Testing Cookies in Web Applications

2009-12-19T11:24:00.002+05:30

A "cookie" is a small piece of information sent by a web server to store on a web browser so it can later be read back from that browser. This is useful for having the browser remember some specific information. These are small data files which act as unique identifiers and allow our site to remember a particular user. Cookies do not harm computer. Certain areas of our web site, such as our forums use cookies. Some times user’s personal information is stored in cookies and if someone hacks the cookie then hacker can get access to your personal information. Even corrupted cookies can be read by different domains and lead to security issues. This is why testing of website cookies is very important.

In this white paper, we will focus on basics of cookies world and also how to test the website cookies.
INTRODUCTION

In today’s world we use websites for numerous activities, like shopping, travel ticket booking. And here comes an important word “cookie” in the picture. Almost, everywhere cookies are used to store the information sent by web servers.

So, we will first focus on what exactly cookies are and how they work. What are cookies?

Cookie is small information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve information from that machine. Generally cookie contains personalized user data or information that is used to communicate between different web pages. An example is when a browser stores your passwords and user ID's. They are also used to store preferences of start pages, both Microsoft and Netscape use cookies to create personal start pages.

Cookies are nothing but the user’s identity and used to track where the user navigated throughout the web site pages.Why Cookie?

The communication between web browser and web server is stateless. For example if you are accessing domain http://www.example.com/1.html then web browser will simply query to example.com web server for the page 1.html. Next time if you type page as http://www.example.com/2.html then new request is send to example.com web server for sending 2.html page and web server don’t know anything about to whom the previous page 1.html served.

What if you want the previous history of this user communication with the web server? You need to maintain the user state and interaction between web browser and web server somewhere. This is where cookie comes into picture. Cookies serve the purpose of maintaining the user interactions with web server.
How cookies work?

To exchange information files on the web, the HTTP protocol is used. There are two types of HTTP protocol: Stateless HTTP and Stateful HTTP protocol.
Stateless system

A stateless system has no record of previous interactions and each interaction request has to be handled based entirely on the information comes with it. For eg, if we enter http://www.example.com/sample.html into our web browser’s address bar and press Enter, then conversation between the browser and the example.com web server goes like this : Web browser will simply query to example.com web server for the page sample.html.

Once the browser receives the last byte of information using HTTP, the example.com web server essentially forgets about the request data. If now, we send some other request to the web server, it will execute upon the request, without memory of the earlier request. It does not need to remember the earlier request for the response of the new request. This isn’t bad for example.com website; no harm, no foul.
Stateful system
Stateful system

Are there are cases where state does matter for a web based system? The answer is YES, and here comes the Stateful system. Stateful HTTP protocols do keep some history of previous web browser and web server interactions and this protocol is used by cookies to maintain the user interactions.

Whenever user visits the site or page that is using cookie, small code inside that HTML page writes a text file on users machine called cookie. When user visits the same page or domain later time this cookie is read from disk and used to identify the second visit of the same user on that domain. Expiration time is set while writing the cookie. This time is decided by the application that is going to use the cookie.
Applications where cookies are used

* Online Ordering Systems: An online ordering system could be developed using cookies that would remember what a person wants to buy, this way if a person spends three hours ordering CDs at your site and suddenly has to get off the net they could quit the browser and return weeks or even years later and still have those items in their shopping basket.

* Website Tracking: Site tracking can show you places in your website that people go to and then wander off because they don't have any more interesting links to hit. It can also give you more accurate counts of how many people have been to pages on your site.

* Shopping: Cookies are used for maintaining online ordering system. Cookies remember what user wants to buy. What if user adds some products in their shopping cart and closes the browser window? When next time same user visits the purchase page he can see all the products he added in shopping cart in his last visit.

* Marketing: Some companies use cookies to display advertisements on user machines. Cookies control these advertisements.

* UserIds: Cookies can track user sessions to particular domain using user ID and password.

Death of a cookie!

When a web server sets a cookie into the system, it was optionally give it a “death” expiration date. When the date reaches, then the cookie gets deleted from the system.

If the web server does not give an expiration date to a cookie, then the cookie is a per-session cookie. Per-session cookies are deleted as soon as you close the current session of the browser. So, if the cookie is not having any death date, then as soon as the browser is closed, the cookie is no longer into your system.
Browser Cookie Settings

Listed below are examples of the steps taken to view your browser's cookies settings:
Changing cookie settings for Mozilla Firefox 1.5 (Adapted from the Firefox 1.5 integrated help system)

By default Firefox 1.5 accepts all cookies, including cookies which would allow a site to recognize you effectively forever. If you want to grant sites you trust the ability to store cookies permanently

Click Exceptions

Enter the site address (In this case it would be americanadoptions.com)

Click Allow.
Changing cookie settings for Internet Explorer 7

Click on the Tools menu and then click Internet Options

Click the Privacy tab, and then click Sites.

Type americanadoptions.com in the Address of Web site field.

Click Allow to always allow cookies from americanadoptions.com
Changing cookie settings for Internet Explorer 6

Click on the Tools menu and then click Internet Options

Click the Privacy tab, and then click Sites.

Type americanadoptions.com in the Address of Web site field.

Click Allow to always allow cookies from americanadoptions.com
Changing cookie settings for Netscape 6

Click Edit Menu

Click Preferences

Select Privacy & Security

Select Cookies

To view your cookie settings on a browser not listed above, refer to your browser's documentation.
Drawbacks of cookies

* Loss of site traffic: Site containing cookie will be completely disabled and can not perform any operation, if user has set browser options to warn before writing any cookie or disabled the cookies completely. And this results in loss of site traffic.

* Loads of cookies: If too many cookies are present on every page navigation and user has turned on option to warn before writing cookie, in that case this could turn away user from the web site and this could result in loss of site traffic and eventually loss of business.

* Valuable hard drive space: Cookies take up valuable hard drive space, so it may be to your advantage to delete a few on occasion, especially third-party cookies. Third-party cookies are placed on your computer by sites you haven’t visited. They usually come from companies who place ads on sites you have visited. Luckily, most browsers give you the option of rejecting only third-party cookies.

* Security: Some times user’s personal information is stored in cookies and if someone hacks the cookie then hacker can get access to your personal information. Even corrupted cookies can be read by different domains and lead to security issues. Some sites may write and store your sensitive information in cookies, which should not be allowed due to privacy concerns.

Cookie Testing

Now when we know the basics of cookie world, let’s address how to test sites that use cookies.
Disabling Cookies

This is probably the easiest way of cookie testing. What happens when all cookies are disabled? Start like this: Close all browsers delete all cookies from PC.

Now, open the website which uses cookies for actions. Now, perform the major functions in the website. Most of the time, these will not work because cookies are disabled. This isn’t a bug: disabling cookies on a site that requires cookies, disables the site’s functionality.

Is it obvious to the website user that he must have the cookies enables? Web servers are recognizing that attempts are made with disabled cookies, so, does it send a page with a normal message that cookies needs to be enabled before working?

There should not be any page crash due to disabling the cookies.
Selectively rejecting cookies

What happens when some of the cookies are accepted and some are rejected? If there are 10 cookies in web application then randomly accept some cookies say accept 5 and reject 5 cookies. For executing this test case you can set browser options to prompt whenever cookie is being written to disk, delete all previously saved cookies, close all open browsers and then start the test. Try to access major functionality of web site. On the prompt window you can either accept or reject cookie. What’s happening: pages are getting crashed or data is getting corrupted?
Corrupting cookies

This is the test which will test the site! For this, we need to know the cookies the web site is saving and the information that is stored in the text files. Manually edit the cookie in notepad and change the parameters to some vague values. For eg, change the content of the cookie, change the name of the cookie, and then perform actions in the website. In some cases corrupted cookies allow to read the data inside it for any other domain. This should not happen in case of your web site cookies. Note that the cookies written by one domain say rediff.com can’t be accessed by other domain say yahoo.com.
Cookie Encryption

There are websites, where we have no option other than saving sensitive data in cookie. Here it needs to be tested that the data stored in cookie is also getting stored in encrypted format.
Deletion of cookies

Access a website and allow it to write cookie. Now close all the browsers and manually delete the cookies. Again open the same website and try to work on it. Is it crashing?

Some times cookie written by domain say ABC.com may be deleted by same domain but by different page under that domain. This is the common case if you are testing some ‘action tracking’ web portal. Action tracking or purchase tracking is placed on the action web page and when any action or purchase occurs by user the cookie written on disk get deleted to avoid multiple action logging from same cookie. Check if reaching to your action or purchase page deletes the cookie properly and no more invalid actions or purchase get logged from same user.
Multi Browser testing

This is an important case to check if web application page is writing the cookies properly on different browsers and also the web site works properly using these stored cookies.
CONCLUSION

Cookies shouldn’t be put in the same category as the viruses, spam, or spyware that are often created to wreak havoc and chaos on computers. They are mostly benign tools to help you manage your time more efficiently on the Web. Plus, you have totally control over them if you think your secrecy is being violated. Therefore, accept or reject cookies as you want. And the testing should be done properly to check that website is working with different cookie setting. For demo Amazon.com is a very good website for good quality cookie usage.

- by Anamika

Open Source Link Checking Tools

2009-11-04T13:43:00.000+05:30

It is very important to make sure that there are no broken links on your site. A link may be active when your first added it but as the days, months, years go by the link may end up being broken.

Below are some open source tools that can help you find those broken links.

Bugkilla – J2EE Functional Test Suite: Bugkilla will be a set of java tools for the functional test of J2EE Web Applications. Specification and execution of tests will be automated for web front end and business logic layer.
DLC (Dead Link Check): It can generate an HTML output for easy checking of the results, and can process a link cache file to hasten multiple requests (links life is time stamp enforced). Written in Perl
ht://Check: Outputs a simple report. It can retrieve information through HTTP/1.1 and store them in a MySQL database. Most of the information is given by the PHP interface which comes with the package and that is able to query the database built by the htcheck program. Requirement: You need a Web server to use it, and PHP with the MySQL connectivity module.
InSite: A site management tool written in Perl. Requirement: Linux. Requires libwww and MIME::Lite (available at any CPAN mirror).
Jenu: A multithreaded, Java 1.3 (swing) based Web site URL Link checker. It’s a copy of a nice multi-threaded link checker for the PC called Xenu. Requirement: Java 2 (1.3) runtime.
JSpider: A Web spider engine. It is a robot that will generate web traffic, just like you would do when you are browsing the internet. You can control and configure the robot’s behaviour to adapt it to your needs. On it’s way through sites, it will gather all kinds of information you might be interested in. You can use a web spider for different purposes: searching dead links (404 errors) on your website, testing your site’s performance under havy load, copying an entire site to your harddisk, etc … Requirement: Linux, Solaris, Windows, and other Java-enabled Operating Systems.
LinkChecker: A link management solution integrated into Plone. Requirement: Plone 2.0.5, 2.1, and 2.5 beta
Linklint: Perl program that has the ability to check local-file and HTTP site checking. Creates a report of which URLs have changed since the last check.
Link Page Generator: Automatic link management program with -check option for marking/eliminating bad links (in cron job). Written in Perl.
LinkVerify: Checks a set of hypertext files whether all references to external resources are valid. In HTML this applies mostly to hyperlinks and embedded images. Style sheets will be checked too. Requirement: Java 1.1 is required
SourceForge – LinkChecker: With LinkChecker you can check your HTML documents for broken links Requirement: Python 2.2.1. For HTTPS support you need to compile Python with the SSL _socket module.
W3C Link Checker: Checks that all the links in your HTML document are valid. There is a command-line interface and an online version. The Link Checker can easily be installed on one’s server
Xenu’s Link Sleuth: checks Web sites for broken links. Link verification is done on “normal” links, images, frames, plug-ins, backgrounds, local image maps, style sheets, scripts and java applets. NOTE: This one is free but NOT Open Source

Please comment below on your thoughts about any of the tools listed above and/or if you know of any other tools that should be added.

Open Source Tracking Database Tools

2009-10-26T13:41:00.000+05:30

No matter how good you think your code is there is always going to be a bug/defect of some kind. Defect numbers may range from 1 to thousands so it’s important to have a very good tracking tool. There are commercial tools out there but I figured I’d focus on the open source tools.

Below are some open source tracking tools that you can use for your projects to track bugs/defects, issues, enhancements and much more.

Abuky: Abuky stands for the Aoo BUg tracKing sYstem, while AOO stands for Art Of Open Source. Abuky is a system for tracking bugs and aiding the developer to fix them, written in Java with JSP as web interface. Requirement: Linux, Windows, Solaris
Anthill Bug Manager: A tool that aids code development by keeping track of bugs in a multi-project, multi-developer environment. It accomplishes this with a clean, simple, and fast interface that contains all the essential features
but avoids the enormous complexity associated with most other projects of this type. Requirement: OS Independent
BTsys: A lightweight desktop bug tracking system, written using C# and ADO.NET for small developer teams. Easy to install and learn how to use. Requirement:All 32-bit MS Windows (95/98/NT/2000/XP)
Bug-A-Boo: A web based bug reporting system for Linux. It runs on any web server providing CGI
functionality. Bug-A-Boo does not need any database server but brings along its own local tables it accesses with tdbengine.Requirement: Linux
BugBye: A web-based bugtracking system developed using ASP.NET technology and C# as scripting language. It offers all the features needed to manage improvement, bugs, and so on. It also provide statistics help-desk management, and further options which allow the user to simplify all the stage of project development and maintainance. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP)
Bugfree: A lightweight and simple web-based bug tracking system available in Chinese and English. Requirement: Windows
Buglog: Allows you to easily record bugs into a database along with description and screenshots of the bugs (file upload feature). The BLT allows tracking of all bugs on a project-wise basis thus making it a bug logging and tracking solution. BuglogV2 incorporates a powerful search feature allowing developers to locate bugs effortlessly. Requirement: All 32-bit MS Windows(95/98/NT/2000/XP)
BugNet: A web based bug / issue tracking application programmed in C# and asp.net. The main goals are to keep the codebase simple, well documented, easy to deploy and scalable. Major features include: Generic DAL / XHTML and CSS layout. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP)
BugRat: Java software that provides a sophisticated, flexible bug reporting and tracking system.
BUGS – The Bug Genie: A web-based bug tracking tool, designed with ease of use as it’s foremost goal, but also features a high level of flexibility for developers and administrators. Requirement: PHP4 (or later) and MySQL.
Bugs Online: Originally developed in 1997 to serve as the primary bug and issue tracking system to be utilized during a large development oriented project. The Bugs Online system is a very flexible and capable system for bug and issue tracking. Requirement: Windows NT 4.0 SP3+, MS IIS 3 w/ ASP
BugtrackWeb based bug tracking system written in Perl/DBI. Supports multiple users, projects, components, versions and email notification. Requirement: Linux, Solaris, Windows
BugTracker.NET: Web-based bug or issue tracker written using ASP.NET, C#, and Microsoft SQL Server/MSDE. It is in daily use by hundreds (maybe thousands) of development and support teams around the world. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP)
Bugzilla: Features include: integrated, product-based granular security schema, inter-bug dependencies and dependency graphing, advanced reporting capabilities, a robust, stable RDBMS back-end, extensive configurability, a very well-understood and well-thought-out natural bug resolution protocol, email, XML, console, and HTTP APIs, available integration with automated software configuration management systems, including Perforce and CVS (through the Bugzilla email interface and checkin/checkout scripts), too many more features to list.
CodeTrack: Bug database with a friendly web front end aimed at medium and small development shops. Particularly suited for intranet and extranet environments, CodeTrack includes built-in strong authentication, and allows custom access control to individual projects. No database is required as bug data and developer notes are stored using simple XML text files. Requirement: Apache and PHP
Debian bug tracking software: The Debian bug tracking system is a set of scripts which maintain a database of problem reports. Requirement: Unix
DITrack (Distributed Issue Tracker): Implemented in Python and runs in UNIX (*BSD, Linux, MacOS X) and Windows environment.
Ditz: Open source distributed issue tracker designed to work with distributed version control systems written in Ruby
eTraxis: A web-based bug tracking system with unlimited number of custom workflow templates. Some of the main features are: fully custom templates, advanced filters, LDAP support, email notifications, subscriptions, reminders, flexible permissions management, graphical project metrics, etc. Requirement: OS independent
Eventum: A user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs. Requirement: PHP, MySQL
Flyspray: Originally developed for the Psi project, Flyspray is an easy to use bug tracking system for those who do not require all the complexities of something like Bugzilla. It supports multiple users, file attachments, and Jabber notifications. Requirement: Web Environment
FOSSology: Started out as an internal development effort at Hewlett Packard Company (HP).
Gjallar: Highly customizable issue tracker with advanced email integration and ability to work offline and synchronize with server. Requirement: Windows
GNATS: A portable incident/bug report/help request-tracking system which runs on UNIX-like
operating systems. It easily handles thousands of problem reports, has been in wide use since the early 90s, and can do most of its operations over e-mail. Several front end interfaces exist, including command line, emacs, and Tcl/Tk interfaces. There are also a number of Web (CGI) interfaces written in scripting languages like Perl and Python. Requirement: OS Independent
Helis: Iincludes the main features of most bug tracking systems. Requirement:Linux web server (php 4/mysql + cgi)
Issue Tracker: by ASP.NET. Issues can be tracked, related issues can be displayed & more. Issue Tracker supports MS Access & MSSQL for storing the data.
Issue Tracker Product: A straight forward and user friendly web application built on top of the Zope application server. Requirement: OS Independent, Zope
itracker: An issue tracking system designed to support projects with independent user bases. Features include multiple versions and components, detailed issue histories and email notifications. Soon based on Java Spring 2.0 and Hibernate. Requirement: OS Independent
JitterBug: A web based bug tracking system. JitterBug operates by receiving bug reports via email or a web form. Authenticated users can then reply to the message, move it between different categories or add notes to it. In some ways JitterBug is like a communal web based email system. This web page is itself a JitterBug page.
jTrac: A generic issue-tracking web-application that can be easily customized by adding custom fields and drop-downs. Features include customizable workflow, field level permissions, e-mail integration, file attachments and a detailed history view. Requirement: OS Independent
Kwok Information Server: IT web application, providing a centralized application for managing IT assets, software licenses, service contracts, issues, and contacts. Additional modules include portal, RSS, and blogs.
Lighthouse Pro: ColdFusion bug tracking application. It lets you easily track bugs and issues for a project. With Lighthouse Pro, you can monitor the complete life cycle of an issue, from creation to QA to closure.
Mantis: A php/MySQL/web based bugtracking system. Requirement: Windows, MacOS, OS/2, and a variety of Unix operating systems. Any web browser should be able to function as a clientWindows, MacOS, OS/2
Ohloh: Is more than just a tracking database
oops-easytrack: A Bug Tracking System, implemented as a LAN-based and a web-based version. Bugs are created, modified, logged or searched. Users, projects,components and releases can be administered. Reports of 4 types may be generated. Requirement: OS Independent
Open Track: A problem tracking(PR) system that is table driven and easily
configurable/customizable for a variety of PR applications. Project defect tracking, help desk tracking, and requirements gathering can be easily handled by OpenTrack.
PEST: A bug tracking system written especially for a web enviroment. It supports good testing and bug tracking processes, as well as notification.
phpBugTracker: Provides a codebase that is independent of the database and presentation layers. Requirement: webserver with PHP 4.1.0+
Project Dune: Mostly a web-based issue tracker with integrated modules: Cocomo II estimates, Scrum tasks, timesheet, simple customer management and a browser-based document writer. Requirement: OS Independent
Project Open: Web-based ERP/Project Management software for organizations with 2-2000 users
RadTracker: A MYSQL-PHP web based issue tracking system built for healthcare but generic enough for most needs. Designed to ease the support of multiple idiosyncratic information systems needing their own knowledge base and support mechanism.
Redmine: Flexible project management web application. Written using Ruby on Rails framework, it is cross-platform and cross-database. Requirement: Ruby and Ruby on Rails must be installed.
Request Tracker: RT is an industrial-grade ticketing system. It lets a
group of people intelligently and efficiently manage requests submitted by a community of users. RT is used by systems administrators, customer support staffs, NOCs, developers and even marketing departments at over a thousand sites around the world. Requirement: Written in object-oriented Perl, RT
is a high-level, portable, platform independent system
Roundup Issue Tracker: Roundup is a simple-to-use and -install issue-tracking system with command-line, web and e-mail interfaces. It is based on the winning design from Ka-Ping Yee in the Software Carpentry “Track” design competition.
Scarab: The goal of the Scarab project is to build an Issue / Defect tracking system that has the following features: A full feature set similar to those found in other Issue / Defect tracking systems: data entry, queries, reports, notifications to interested parties, collaborative accumulation of comments, dependency tracking In addition to the standard features, Scarab has fully customizable and unlimited numbers of Modules (your various projects), Issue types (Defect, Enhancement, etc), Attributes (Operating System, Status, Priority, etc), Attribute options (P1, P2, P3) which can all be defined on a per Module basis so that each of your modules is configured for your specific tracking requirements. Built using Java Servlet technology for speed, scalability, maintainability, and ease of installation. Import/Export ability via XML allowing for easy migration from other systems (like Bugzilla). Modular code design that allows manageable modifications of existing and new features over time. Fully customizable through a set of administrative pages. Easily modified UI look and feel. Can be integrated into larger systems by re-implementing key interfaces.
Stabilizer: The Stabilizer bugtracking system aims to quickly stabilize buggy GUI applications so that people can get real work done with them. Users collaboratively and quickly stabilize a buggy GUI application simply by using the application normally and reporting any bugs that they encounter. As soon as a few people report the same bug, warnings will be issued to all users whenever they are about to trigger that bug and they will be given the opportunity to abort the input event — thus avoiding the bug altogether and keeping the application stable. Requirement: All POSIX (Linux/BSD/UNIX-like OSes), Linux
The Bug Genie: Built with PHP, has multilanguage support & provides an easy to use interface.
Trac: An enhanced wiki and issue tracking system for software development projects. Trac allows wiki markup in issue descriptions and commit messages, creating links and seamless references between bugs, tasks, changesets, files and wiki pages. A timeline shows all project events in order, making getting an overview of the project and tracking progress very easy. Requirement:Python, CGI-capable web server
Track+: A web based issue tracking and project management application targeted at medium to large commercial development projects. Track+ can be used instantly, yet it is flexible and configurable. Track+ is easy to use, provides user centric as well as project centric views, has configurable workflows, supports e-mail submission of issues, and has a comprehensive time and cost tracking module. Track+ is free to academic institutions, open source projects, and charities, and generally free to anybody up to 10 active users in the database. Track+ comes with the complete source code. Requirement: OS Independent (Written in an interpreted language)
TrackIt: A Web-based project tracking tool that incorporates defect tracking functionality. It is designed from the ground up to provide maximum flexibility, customization, and most importantly, usefulness to the developer. It has built-in support for various Extreme Programming constructs, as well as full CVS and Subversion integration. It also supports simple listings via HQL and advanced reporting via SQL. Requirement: JRE 1.5
WebIssues is an open source, multi-platform system for issue tracking and team collaboration. The server can be installed on any host with PHP and MySQL, PostgreSQL, Firebird or SQL Server. The client is a native desktop application for both Windows and Linux.
WREQ: Designed to be a distributed request/problem tracking system with builtin knowledge database to help systems personnel to stay on top of requests and to prompt knowledge sharing among all local support groups. Requirement: To use wreq, first you must have perl version 5 with GDBM support installed on your web server.
zenTrack: Highly configurable bug tracking, project management, and help desk solution. Project focus is on configurability, usability, and clean code. Requirement: OS Independent

Please comment below on your thoughts about any of the tools listed above and/or if you know of any other tools that should be added.

Open Source Free Functional Testing Tools

2009-10-25T13:50:00.000+05:30

It is very important to make sure that your application functions as expected. There may be times that you add one little piece of code and all of a sudden other parts of the application no longer works. You may not have time/capacity to manually go back and regression test all the pieces of your application to make sure they are up to par. Companies use a variety of different testing tools for regression testing. There are lots of tools out there from very expensive to open source.

Below is a list of some open source/free tools that may come in handy.

Please keep in mind that every application is different so the tool you pick from one application may not be the same tool that you pick for another. My advice would be to pick a tool that can meet most of your current and near future needs.

Abbot Java GUI Test Framework: The Abbot framework provides automated event generation and validation of Java GUI components, improving upon the very rudimentary functions provided by the java.awt.Robot class (A Better ‘Bot). The framework may be invoked directly from Java code or accessed without programming through the use of scripts. It is suitable for use both by developers for unit tests and QA for functional testing.
actiWate: Java-based Web application testing environment from Actimind Inc. Advanced framework for writing test scripts in Java (similar to open-source frameworks like HttpUnit, HtmlUnit etc. but with extended API), and Test Writing Assistant – Web browser plug-in module to assist the test writing process. Freeware.
Anteater: A testing framework designed around Ant, from the Apache Jakarta Project. It provides an easy way to write tests for checking the functionality of a Web application or of an XML Web service.
Apodora: A framework/tool for automating functional testing of web applications. It provides the user with programmatic control of the web browser allowing them to interact directly with the browser’s user interface. It uses a database backend in order to remember how to find your html elements. This also makes your scripts easier to maintain. Requirement: Windows, IE6
Arbiter: Document based acceptance tester. Similar to FIT in goal. Manages requirements documents in Word or RTF format that are created jointly by customer and developer. Requirements are parsed to extract a glossary and test suite.
Autonet:Autonet is a GUI network
test platform, internally it’s based on CLI to communicate with devices. It can help you to arrange test cases, setup commands to devices,run commands to check results and record test results. Requirement: windows, linux and any other platform which support tcl
AutoTestFlash: Allows the recording and playback of tests written in Flash and Flex. The tool website provides a live sample. Requirement: Windows / Flash
Avignon: An acceptance test system that allows you to write executable tests in a language that you define. It uses XML to define the syntax of the language but, if you choose to extend the language, leaves the semantics of the tests up to you. Avignon includes modules for testing HTML applications (through either IE or FireFox), Swing and .NET WinForm applications. Requirement: Java (MS Windows only for .NET testing)
Blerby Test Runner: Ajax test runner for php. Currently supports simpletest and phpunit 3.x. Allows developers to refactor code while being able to receive instant feedback on their changes. Tracks test dependencies and automatically re-runs appropriate tests upon source changes. Requirement: Windows, *nix, apache
Canoo WebTest: Used for functional testing of web pages, WebTest is an open source testing framework built on top of HttpUnit. It allows tests to be defined in XML as Ant targets. Requirement: JDK 1.2 and ANT v1.3
Celerity: a JRuby wrapper around HtmlUnit – a headless Java browser with JavaScript support. It provides a simple API for programmatic navigation through web applications. Celerity aims at being API compatible with Watir.
Concordion: Framework for Java that lets you turn a plain English description of a requirement into an automated test. Concordion specifications are active. Behind the scenes, they are linked to the system under test and therefore do not go out-of-date. If a change is made to the system’s behaviour then the tests associated with the relevant specification will fail and let you know.Requirement: Java 1.5 or above
Crosscheck: Framework for verifying your in-browser javascript. It helps you ensure that your code will run in many different browsers such as Internet Explorer and Firefox, but without needing installations of those browsers. The only thing you need is a Java Virtual Machine.Requirement: Java Virtual Machine
csvdiff: A Perl script for comparing two files of comma-separated values with each other. In contrast to standard diff, it will show the number of the record where the difference occurs, the column number, and (if provided) the fieldname which is different. The separator can be set to any value you want, not just a comma. It also provides support for multiple column keys, the ability to ignore case and trim leading/tailing spaces, and the ability to ignore selected columns such as timestamps. Requirement: Everywhere you can install perl
CubicTest: A graphical Eclipse plug-in for writing Selenium and Watir tests. It makes web tests faster and easier to write, and provides abstractions to make tests more robust and reusable. CubicTest’s test editor is centered around pages/states and transitions between these pages/states. The model is intuitive for both Ajax and traditional web applications and supports most user interaction types. CubicTest features an innovative test recorder and test runner based on Selenium RC which are fully integrated with the graphical test editor. Tests can also run standalone from Maven 2. Requirement: Eclipse plug-in
DBFeeder: With DBFeeder you can automatically generate testdata for Oracle Databases which fits primary and foreign keys of tables. A file-based configuration system allows in-depth customization of the generated data.
DbFit: Extension to FIT/FitNesse for test-driven database development. Enables developers to manipulate database objects in a relational/ tabular form, making database testing and management much easier then with xUnit-style tools. Requirement: Java/.NET
DejaGnu: Framework for testing applications such as Tcl, C, C++, Java and network applications and cross testing of embedded systems. Its purpose is to provide a single front end for all tests. Think of it as a custom library of Tcl procedures crafted to support writing a test harness. Requirement: MacOS, Windows, POSIX
Dogtail: A GUI test tool and automation framework written in Python. It uses accessibility technologies to communicate with desktop applications. Dogtail scripts are written in Python and executed like any other Python program. Requirement: Python 2.3 or higher
Doit: Simple Web Application Testing: Scripting tool and language for testing web applications that use forms. Doit can generate random or sequenced form fill-in information, report results (into a database, file, or
stdout), filter HTML results, and compare results to previous results, without having to manually use a web browser. It uses a console-based web client tool (like Curl or Wget) to send and receive HTTP requests and responses respectively. Requirement: You must have Perl 5 or greater and the appropriate Perl modules (detailed in Doit manual) installed on your system before you can use SPL.
Eclipse TPTP: The Eclipse test and performance tools platform (TPTP) provides support for three types of testing: Performance testing of HTTP applications, JUnit testing and manual testing. Although each of these areas of testing has its own unique set of tasks and concepts, two sets of topics are common to all three types: creation and use of datapools, and creation of test deployments. Requirement: Eclipse
EMOS Framework: A simple yet powerful environment for development of automated WinRunner? tests. Like most frameworks of this sort EMOS Framework separates test data from the test code in order to simplify and speed up test development, increase robustness of the produced solution, and empower non-programmers towards test automation. It is almost completely written in WinRunner’s own scripting language, TSL.Requirement: Mercury WinRunner, All 32-bit MS Windows (95/98/NT/2000/XP)
Enterprise Web Test: Allows Java programmers to write re-usable tests for web applications that, unlike HttpUnit, “drive” the actual web browser on the actual platform they intend to support. Tests can be leveraged for functional, stress, reliability. Requirement: Microsoft, OS Independent, Linux
Expect: A Unix automation and testing tool, for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, ssh, tip, etc. And by adding Tk, you can also wrap interactive applications in X11 GUIs. Requirement: Windows / UNIX
Frankenstein: A Functional Testing tool for Swing applications. Frankenstein’s focus is on readable, simple, fast functional tests that can be shared and run by everyone on a team. Apart from automating your functional tests, you could also use Frankenstein for recording bugs so that they may be easily reproduced later. Requirement: JDK 1.4+
FireWatir: Has a similar API to Watir, though accesses the DOM by invoking JavaScript by using the JSSh XPI to telnet into the browser. While Watir works with MSIE, FireWatir is compatible with Firefox 1.5 and above. FireWatir allows Watir scripts written for IE to work with Firefox as well, usually requiring either no change or very small changes to existing scripts. It is planned for FireWatir and Watir to be merged. The wiki includes info on compatibility issues between Watir and Firewatir.
Funkload: Web functional testing and load testing tool written in Python and distributed as free software under the GNU GPL. Emulates a web browser (single-threaded) using webunit; https support; produces detailed reports in ReST, HTML, or PDF. Functional tests are pure Python scripts using the pyUnit framework.
FWPTT: is a web application tester program for load testing web applications which can record normal and Ajax requests
GITAK: TIBCO General Interface Test Automation Kit (GITAK) is a test-automation tool for Ajax applications. GITAK extends the Selenium Core test tool for Web applications. It lets developers create automated test cases and run scenarios to validate that an application is performing properly. Once a library of test cases has been built, the Ajax applications and changes to them can be tested with the push of a button. Requirement: IE 6, IE7, Firefox 2, Firefox 1.5.x
GNU/Linux Desktop Testing Project: Aimed at producing high quality test automation framework and cutting-edge tools that can be used to test GNU/Linux Desktop and improve it. It uses the “Accessibility” libraries to poke through the application’s user interface. The framework has tools to generate “AppMap” by reading through the user interface components of an application. The framework also has tools to record test-cases based on user-selection on the application. GNU/LDTP can test any GNOME application which are accessibility enabled, Mozilla, OpenOffice.org, any Java application (should have a UI based on swing) and KDE 4.0 applications based on QT 4.0 (based on the press releases by KDE). Requirement: Linux
Harness: An open source Java API for creating Java test software
HtmlUnit: Java unit testing framework for testing web based applications. (Similar in concept to httpunit but is very different in implementation) HtmlUnit models the returned document so that you can deal with pages, forms and tables.
httest: Scriptable HTTP Test Tool for testing and benchmarking web application and HTTP server development. Can act as client (requesting) and server (back-end for reverse proxys). Pattern matching answers (both server(s)and client(s)) to test validity. Has a very simple but powerful syntax. Can execute and stream shell commands into the HTTP stream and vice versa. Requirement: linux, solaris
HTTPUnit: Java API for testing web sites without a browser.
IdMUnit: Leading xUnit automated testing framework for Identity Management that simplifies and accelerates the functional testing of the solution. Test cases are defined and implemented in spreadsheet format. This product plugs into Eclipse. Requirement: Cross-platform
IeUnit: A simple framework to test logical behaviors of web pages, released under IBM’s Common Public License. It helps users to create, organize and execute functional unit tests. Includes a test runner with GUI interface. Implemented in JavaScript for the Windows XP platform with Internet Explorer.
iMacros for Firefox: Free Firefox add-on to record and automate web interactions. Can use variables inside the macros, and import data from CSV files. Includes user agent switcher, PDF download and Flash, ad and image blocking functions. The recorded macros can be combined and controlled with Javascript, so complex tasks can be scripted. The EXTRACT command enables reading of data from a website and exporting it to CSV files. Full Unicode support and works with all languages including multi-byte languages such as Chinese. STOPWATCH command enables capturing of web page response times
Imprimatur: A web application functional testing tool. The tests are described in a simple XML file. Imprimatur handles HTTP methods, authentication and file uploads. The responses can be validated using regular expressions. Requirement: Java
ItIN – Infopath testing in .Net: A framework for the testing of InfoPath forms. It is derived from the WatiN testing framework which is used for testing web applications. ItiN needs Visual Studio 2005 and InfoPath 2003 with the .Net programability support installed to work. You may have some trouble with the references, but it should be OK. Requirement: Windows
ITP: Lightweight, yet powerful web application test harness. Test scripts written in XML. No programming required and no changes required to your web application. Supports sessions/cookies, POST form data. Command line based for integration into other tools. Also useful for regression and smoke testing.
ItsNat, Natural AJAX: A Java AJAX web framework with functional web test built-in. Simulates a Universal Java W3C Browser in the server, the client DOM tree is basically a clone of the server and is updated automatically when the server changes usually as the response of an AJAX event. The server can fire W3C DOM events and send them to the browser simulating user actions. These are received again by the server as in a normal AJAX app. As the test code is in the server too, can check the expected GUI changes (checking the server DOM tree) or the expected business behavior (added/removed/updated data). Requirement: Any supported platform by Java VM 1.4 or upper
ivalidator: Regression testing framework written in java but by no means restricted to java testing. Test suites are declared in XML. Especially designed for complex testing scenarios and integration testing. Requirement: JDK 1.3
Jacobie: A Java API for use with Internet Explorer. Based on the JACOB project (Java to Com Bridge) and the IE COM Object, it directly controls IE from java. This API can be used as a true end-user web browser test with IE and not a Http-Based test such as HttpUnit. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP)
Jameleon: A plug-in driven automated testing tool that separates applications into features and allows those features to be tied together independently, creating test cases. Test cases can be data-driven and executed against different environments and test case docs are generated from the test cases. The goal is to create an automated testing tool that can be used for the enterprise. A UI that ties a series of features to a test case, generating both the test script and the test case documentation is in the works. Requirement: OS Independent, JDK 1.4 or higher
jDiffChaser: A GUI comparison tool that automates diffs detection between versions. You can record and play scenarios on two different releases of the same Swing application (in sequential or parallel mode); jDiffChaser compares both screens, shows you the differences and list them in a report with images highlighting the diffs. Requirement: Linux, OS X, WinXP
Jemmy: A tool allowing you to create automated tests for Java GUI applications. Tests are written on Java, using Jemmy as a regular Java library. No recording (yet), no GUI, no XML, no bells and whistles – all the work being done in Jemmy is dedicated to test stability, so it could be used for big, complicated and “dynamic” Java GUI applications. Requirement: Java 1.2 or above
JFunc: JUnit Functional Testing Extension: An extension to the JUnit testing framework to make it easier for use with functional tests. Functional testing (also called integration testing) significantly differs from unit testing in a number of respects. Part of this project is dedicated towards putting together code to address these differences; the other part of this project is putting together methodologies for functional testing. Requirement: JUnit
JSystem: An open source framework for writing and running automated system testing. JSystem includes: 1. Services Java API – exposes JSystem services 2. JSystem Drivers- Java modules used to interfaces with the system under test. 3. JRunner – GUI application interface used for creating and running tests scenarios. 4. JSystem Agent – Execution engine used to run scenarios on a distributed setup. 5. JSystem Eclipse plug-in – accelerates the development environment setup and enforces JSystem conventions. JSystem is based on JUnit (tests and steps) and Ant (execution engine).
jWebUnit: A Java framework that facilitates creation of acceptance tests for web applications. jWebUnit provides a high-level API for navigating a web application combined with a set of assertions to verify the application’s correctness. This includes navigation via links, form entry and submission, validation of table contents, and other typical business web application features. This code utilizes HttpUnit behind the scenes. The simple navigation methods and ready-to-use assertions allow for more rapid test creation than using only JUnit and HttpUnit. Requirement: OS Independent
Latka: A functional (end-to-end) testing tool. It is implemented in Java, and uses an XML syntax to define a series of HTTP (or HTTPS) requests and a set of validations used to verify that the request was processed correctly. Requirement: JDK 1.3 or better.
Linux Test Project: A collection of tools for testing the Linux kernel and related features. Our goal is to improve the Linux kernel by bringing test automation to the kernel testing effort. Requirement: Linux
LogiTest: The core application in the LogiTest suite. The LogiTest application provides a simple graphical user interface for creating and playing back tests for testing Internet-based applications. Requirement:JDK 1.2 or higher
LReport: Command line tools for comparing csv files and databases (on the level of particular selects). The tools also support test documentation by nice formatting of selects’ results. Requirement: Tested on Win32 but should work on other platforms
Mactor: An extensible tool for system integration testing. It can facilitate tests of any XML-based integration regardless of the type of message transfer protocol used (HTTP, SOAP, file-system and IBM MQ series are currently supplied with the tool)
Marathon: A general purpose tool for both running and authoring acceptance tests geared at the Java Platform Version 1.3 or later. Included with marathon is a rich suite of components to help you interact with your application at the User Interface Level (GUI). To aid with the regression testing of existing applications, Marathon comes bundled with a recorder to capture events as you use and interact with your application. These events are then converted into a valid Marathon test which can subsequently be played back. Requirement: Java 1.3 or later
MaxQ: A free web functional testing tool. It includes an HTTP proxy that records your test script, and a command line utility that can be used to playback tests. The paradigm of MaxQ is similar to commercial web testing tools like Astra QuickTest or Empirix e-Test. These products are quite expensive. MaxQ hopes to provide the essential features: HTTP test recording, scripting, and playback without the huge cost.Requirement: Java 1.2 or later
Mechanize: Ruby library for automating interaction with websites; automatically stores and sends cookies, follows redirects, can follow links, and submit forms. Form fields can be populated and submitted. Also keeps track of the sites visited. NOTE: does not handle javascript.
Mockito: Java mocking is dominated by expect-run-verify libraries like EasyMock or jMock. Mockito offers simpler and more intuitive approach: you ask questions about interactions after execution. Using mockito, you can verify what you want. Using expect-run-verify libraries you are often forced to look after irrelevant interactions. Mockito has very slim API, almost no time is needed to start mocking. There is only one kind of mock, there is only one way of creating mocks. Just remember that stubbing goes before execution, verifications of interactions go afterwards. Requirement: Java
MozUnit: Develop test-first style or just test against regressions: MozUnit provides framework, test runner, source browser, and API hooks for personalized reports. MozUnit is part of MozLab, a suite of tools and libraries for developers of AJAX and Mozilla applications, packaged as a Firefox extension.Requirement: Firefox
OLVER – Open Linux VERification: A test suite for automated conformance and functional testing of various Linux distributions against LSB standard requirements on base system interfaces behavior. The tests are being developed at the Linux Verification Center of Russia. Requirement:Linux
org.tigris.mbt: An implementation of Model-based testing built in Java. It allows you to generate test sequences from a finite-state machine (graph). The test sequences can be created statically, or run dynamically.Requirement: Any platform that runs Java 1.4.2
Ottomate: Suite of six Mac OS X Automator Actions that contains everything needed to graphically configure automated, repeatable user-acceptance tests for web-based applications. Requirement: Safari
PAMIE: ‘Python Automated Module For Internet Explorer’ Allows control of an instance of MSIE and access to it’s methods though OLE automation . Utilizes Collections, Methods, Events and Properties exposed by the DHTML Object Mode Requirement:Windows NT/2000
Pounder: A utility for testing Java GUIs. It allows developers to dynamically load components, record scripts, and then use those scripts in JUnit. It supports custom components, drag and drop, and the examination of test runs in source. This project is no longer being actively developed. For similar tools under active development, the Pounder team recommend considering Abbot, Marathon, jfcunit and others. Requirement: OS Independent
PureTest: From Minq Software AB, includes an HTTP Recorder and Web Crawler. Create scenarios using the point and click interface. Includes a scenario debugger including single step, break points and response introspection. Supports HTTPS/SSL, dynamic Web applications, data driven scenarios, and parsing of response codes or parsing page content for expected or unexpected strings. Includes a Task API for building custom test tasks. The Web Crawler is useful for verifying consistency of a static web structure, reporting various metrics, broken links and the structure of the crawled web. Multi-platform – written in Java.
pywinauto: A python package that allows you to automate the windows GUI. Very easy to get started, and quite powerful. Requirement:Windows 2000, XP, +
QAT (Quality Assurance Tests): Developed to ease the issues encountered by having to perform Quality Assurance tests across a variety of hardware and software combinations. The QAT tool can be divided into two main sections, the Agent, responsible for actually running each test or group of tests, and the Harness, which is responsible for test selection, management, result and agent co-ordination. Requirement:Java 2
QMTest: CodeSourcery’s QMTest provides a cost-effective general purpose testing solution that allows an organization to implement a robust, easy-to-use testing program tailored to its needs. QMTest’s extensible architecture allows it to handle a wide range of application domains: everything from compilers to graphical user interfaces to web-based applications. Requirement: QMTest works with most varieties of UNIX, including GNU/Linux, and with Microsoft Windows.
Rasta: A keyword-driven test framework using spreadsheets to drive testing. It’s loosely based on FIT, where data tables define parameters and expected results. The spreadsheet can then be parsed using your test fixtures.Requirement:Windows, Ruby
Robot Framework: Robot Framework is a Python-based keyword-driven test automation framework for acceptance level testing and acceptance test-driven development (ATDD). It has an easy-to-use tabular syntax for creating test cases and its testing capabilities can be extended by test libraries implemented either with Python or Java. Users can also create new keywords from existing ones using the same simple syntax that is used for creating test cases.
safariwatir: The original Watir (Web Application Testing in Ruby) project supports only IE on Windows. This project aims at adding Watir support for Safari on the Mac. Requirement: OS X running Safari
Sahi: An automation and testing tool for web applications, with the facility to record and playback scripts. Developed in Java and JavaScript, it uses simple JavaScript to execute events on the browser. Features include in-browser controls, text based scripts, Ant support for playback of suites of tests, and multi-threaded playback. It supports HTTP and HTTPS. Sahi runs as a proxy server and the browser needs to use the Sahi server as its proxy. Sahi then injects JavaScript so that it can access elements in the webpage. This makes the tool independant of the website/ web application. Requirement:Needs Java 1.4+
Samie: S.A.M. for I.E. is a Perl module (SAM.pm) that allows a user to run automated tests for their browser applications. Requirement: Windows NT/2000
Scalable Test Platform: STP is a system for automating the QA testing process for the Linux Kernel, as well as automating benchmarking and regression testing on diverse hardware systems. Requirement: Linux
Siege: http regression testing and benchmarking utility. It was designed to let web developers measure the performance of their code under duress, to see how it will stand up to load on the internet. Siege supports basic authentication, cookies, HTTP and HTTPS protocols. It allows the user hit a web server with a configurable number of concurrent simulated users. Those users place the webserver “under siege.”
Selenium: Testing tool for browser-based testing of web applications. It can be used both for functional, compatability (it has extensive cross-browser support) and regression testing Requirement: Windows, Linux or Mac
Selenium Grid: An open source web functional testing tool that can transparently distribute your tests on multiple machines to enable running tests in parallel, cutting down the time required for running in-browser test suites. This enables speed-up of in-browser web testing. Selenium tests interact with a ‘Selenium Hub’ instead of Selenium Remote Control. The Hub allocates Selenium Remote Controls to each test. The Hub is also in charge of routing the Selenium requests from the tests to the appropriate Remote Control as well as keeping track of testing sessions. Requires Java 5+ JDK, Ant 1.7.x
SharpRobo: A Functional Testing and Recording tool for WinForm applications written in C#. It supports all the standard WinForm controls. SharpRobo records the tests in FIT format which can be played back using Fit (File or Directory Runner). Requirement:Windows NT/2000/XP
SimpleTest: Unit testing framework which aims to be a complete PHP developer test solution. Includes all of the typical functions that would be expected from JUnit and the PHPUnit ports, but also adds mock objects; has some JWebUnit functionality as well. This includes web page navigation, cookie testing and form submission.
soapui: A java-swing based desktop application for inspecting, invoking and functional testing of webservices over HTTP. It is mainly aimed at developers/testers providing and/or consuming webservices (java, .net, etc). Functional testing can be done interactively in soapui or within a CI-process using the soapui maven plugin.Requirement: Java 1.5
Software Automation Framework Support (SAFS): Provides for the implementation of compatible keyword-driven test automation frameworks. Currently, developing independent, multi-platform, Java-based Driver. Will be followed by independent, multi-platform Engines. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP)
Software Testing Automation Framework (STAF): An open source, multi-platform, multi-language framework designed around the idea of reusable components, called services (such as process invocation, resource management, logging, and monitoring). STAF removes the tedium of building an automation infrastructure, thus enabling you to focus on building your automation solution. STAX is an execution engine which can help you thoroughly automate the distribution, execution, and results analysis of your testcases. STAX builds on top of three existing technologies, STAF, XML, and Python, to place great automation power in the hands of testers. STAX also provides a powerful GUI monitoring application which allows you to interact with and monitor the progress of your jobs. Requirement:Windows, Linux, Solaris, AS/400, AIX, HP-UX, Irix
Solex: This project is a set of Eclipse plugins providing non regression and stress tests of Web application servers. Test scripts are recorded from internet browser thanks to a built in web proxy. Requirement: Eclipse 2.1 or above
SWAT (Simple Web Automation Toolkit): A library written in C# designed to provide an interface to interact with several different web browsers. SWAT also includes components to integrate with Fitnesse allowing Q/A engineers to automate web application testing. Requirement: Windows (IE and FireFox)
SWTBot: A functional testing tool for SWT and Eclipse applications. The focus of SWTBot is to provide a simple, readable and fast way to write tests. The API is simple which means that everyone on a team can use SWTBot to write functional tests. It is also very flexible when it comes to extensibility. Requirement: SWT/Eclipse
Systin: Systin stands for System Testing in .Net and allows you to write system-level tests in a “domain language”. This is a port of the popular Systir program. Systin will allow for an abstraction of Test Case specification and Test Case automation execution. Requirement: .Net Windows
tclwebtest: A tool for writing automated tests on web applications in tcl. It implements some basic html parsing functionality to provide comfortable commands for operations on the html elements (most importantly forms) of the result pages.
TestGen4Web: A capture-replay tool which can record user actions on Firefox, saving the recording to an XML file, and replaying the saved recording. The output of the recorder can also be translated into automatic testing scripts such as httpunit, selenium, simple-test, etc. Requirement: Firefox 1.5 alpha1 +
TextTest: An application-independent tool for text-based functional testing. This means running a batch-mode binary in lots of different ways, and using the text output produced as a means of controlling the behaviour of that application.Requirement: Most UNIX flavours + Windows XP (not Windows 9x)
Tomato: (the Automation Tool Abstraction Project) An abstraction layer for automation engines. Its design allows automation scripts or tests to be written in one language, against one library, and remain portable across different architectures, OS platforms, and even widely different automation engines (e.g. HP Mercury Interactive WinRunner or the Linux Desktop Test Project). Requirement: Windows/Linux
Toster – The Object-oriented Sofware Testing Environment: A system for sharing a set of tools that allow you to implement methods for object-oriented testing. Any method based on UML diagrams and on the software source code can easily be implemented as a TOSTER module. The environment itself makes a number of mechanisms available, such as information transfer from UML diagrams, mapping this information to source code, introducing modifications to the source code, launching the tested application, or presenting the results.
Watij: (pronounced wattage) stands for Web Application Testing in Java. Based on the simplicity of Watir and enhanced by the power of Java, Watij automates funtional testing of web applications through the real browser. There is a Google group at http://groups.google.com/group/watij Requirement:Windows
WatiN: WatiN stands for Web Application Testing in dotNet. Inspired by Watir, WatiN enables web application testing, through Internet Explorer on a Windows platform, expressed in any .Net language.Requirement: Windows
Watir: Watir (Web Application Testing in Ruby) is a functional testing tool for web applications. It supports tests executed at the web browser layer by driving a web browser and interacting with objects on a web page. It uses the Ruby scripting language. Requirement: Windows (currently only supports Internet Explorer)
WebCorder: Free GUI web testing tool from Crimson Solutions, developed in VB. Designed for end users who are doing web based software testing, as a simple tool to record test scenarios, and play them back and generate log files. The user may also check for text or images on the screen or save screenshots.
Web Form Flooder: A Java console utility that will analyze a Web page, complete any forms present on the page with reasonable data, and submit the data. The utility will also crawl links within the site in order to identify and flood additional forms that may be present.
WebDriver: A developer focused tool for automated testing of webapps: WebDriver has a simple API designed to be easy to work with and can drive both real browsers, for testing javascript heavy applications, and a pure “in memory” solution for faster testing of simpler applications. Requirement: Any java-compatible platform
WebInject: A free tool for automated testing of web applications and services. It can be used to test any individual system component with an HTTP interface, and as a test harness to create a suite of automated functional and regression tests. Requirement: Windows, OS Independent, Linux
Webrat: Ruby-based utility to enable quick development of web app acceptance tests. Open source by Bryan Helmkamp. Leverages the DOM to run tests similarly to in-browser test tools like Watir or Selenium without the associated performance hit and browser dependency. Best for web apps that do NOT utilize Javascript; apps using Javascript in-browser tools may be more appropriate.
WebTst: AWeb development test infrastructure. It aims to simplify testing by implementing a capture engine: a Web proxy which records a tester’s actions using a real browser, and then replays them during testing. It comes with support for digital certificates, and a number of simple tests, such as cookie setting, pattern matching, response status, and many others. It features an extensible plug-in system. Requirement: POSIX, Linux
WET: An opensource web automation testing tool which uses Watir as the library to drive web pages. You don’t have to download / install Watir separately or know anything about Watir. WET drives an IE Browser directly and so the automated testing done using WET is equivalent to how a user would drive the web pages. WET allows you to perform various checks as a part of the testing process by using Checkpoints. Requirement: Windows 98/ME/2000 SP3/XP SP2/Server 2003
Win32::IEAutomation: A Perl module which automates functional testing of web applications. It can be used to automate any complex web application including dynamic frames and popup windows. It is an object oriented module and all methods are like user actions on web browser. Requirement: Windows (only Internet Explorer is supported)
XML Test Suite: Provides a powerful way to test web applications. Writing tests requires only a knowledge of HTML and XML. We want XmlTestSuite to be adopted by testers, business analysts, and web developers who don’t have a java background. Requirement: Windows 95/98/2000, Windows NT/2000, Linux, SunOS/Solaris
Yawet: Visual web test tool from InforMatrix GmbH enables graphical creation of web app tests. Create, run and debug functional and regression tests for web applications. Can verify HTML, XML, and PDF’ ability to do report generation, reusable step libraires and parameterization. Freeware; download jar file and start by double-click or with command javaw -jar yawet.jar

Please comment below on your thoughts/experience on any of the tools listed above and/or if you know of any other tools that should be added.

Open Source Test Management tools

2009-10-22T11:39:00.001+05:30

Test Management tools are very important to any test team. Test teams use these tools to help capture requirements, design test cases, map test cases to requirements, test execution reports and much more. Companies may use one to many tools for this, which range from very expensive to open source. My advice would be to pick a tool that can meet most of your current and near future needs.

Below is a list of some open source/free tools that may come in handy.

Bugzilla Testopia: A test case management extension for Bugzilla. It is designed to be a generic tool for tracking test cases, allowing for testing organizations to integrate bug reporting with their test case run results. Though it is designed with software testing in mind, it can be used to track testing on virtually anything in the engineering process. Requirement: Bugzilla
Data Generator: The Data Generator is a free, open source script written in JavaScript, PHP and MySQL that lets you quickly generate large volumes of custom data in a variety of formats for use in testing software, populating databases and more.
Fitnesse: A collaborative testing and documentation tool. It provides a very simple way for teams to collaboratively create documents, specify tests, and run those tests. Requirement: Mac, Windows, POSIX
Kineo Open Source: Advises on the best open source tools tailored for a specific group of users
Mantis: Can be used for bug tracking as well.
MTS: Multi-TeSTer: A simple domain-specific language for maintaining tests that supports two desirable properties: – single source: the command, input, and expected output are all in one file. – controlled experimentation: multiple slightly different tests can be generated from the same source with different expected outputs. Requirement: Unix command line tool; written in Perl
qaManager: A web based application used for keeping track of engineering and customer releases of Software Projects, Resource allocations and related information. It helps QA Managers to keep track of releases
effectively.Powered by OpenXava and Java.
QATraq: Covers everything from defining test plans to writing test cases and recording results. Requirement: Windows, BSD, Linux, SunOS/Solaris
Radi: Radi-testdir is a lightweight test director. Radi supports test director features like configuring the test plan, updating (create/edit) the test results for the test image/build stores in the image results set. Requirement: All POSIX (Linux/BSD/UNIX-like OSes)
rth: web-based tool designed to manage requirements, tests, test results, and defects throughout the application life cycle. The tool provides a structured approach to software testing and increases the visibility of the testing process by creating a common repository for all test assets including requirements, test cases, test plans, and test results. Requirement: All 32-bit MS Windows (95/98/NT/2000/XP), All POSIX (Linux/BSD/UNIX-like OSes), IBM AIX
RTH-Turbo: Optimized version of RTH, a testing management tool, that allows: requirement management; test case management; defect tracking; create test plans; analyze your test results. This project was originally created from RTH version 1.2, and this new branch and version is more powerful and optimized. Requirement: PHP, MySql and Apache
Salome-TMF: An independent Test Management Tool, which helps you to manage your entire testing process by creating tests, executing manual or automatic tests, tracking results, managing requirements and defects and producing HTML documentation. Salome-TMF is compatible with Junit, Abbot and Beanshell to define your automatic tests, and with Bugzilla and Mantis to manage your defects. Salome-TMF can also be extended by plug-in according to your requirements. Requirement: Java
TCW: Test Case Web (TCW) is an online TCM system built with PHP and a SQL backend. It provides an efficient means for generation, organization, and execution reporting of test cases among projects and by multiple testers and versions. It provides various at-a-glance views of the test suite for easy status determination and test suite navigation. TCW also provides basic reporting capabilities and per-project access control. Requirement:Any (PHP/SQL/Apache)
Tesly: Tesly is a Web application written in PHP that helps you create, execute, and report on test plans. QA leaders can track the progress of testing as testers use the interface to report completion of test cases. Requirement: OS Independent
Test Environment Toolkit: Open source version of TETware, a proprietary multi-platform test framework for test suite management (administration, reporting and sequencing of tests). This open-source version is for Linux and UNIX system users only. The differences between the open source version and the other version for which a commercial support offering is available is in platform support (WIN32 and Java) rather than functionality. Requirement: Linux or Unix
Testitool: A Web-based application for QA test planning. It creates a test plan and populates it with test cases, maps test cases to functional requirements, instantiates a test plan, begins executing test cases and marks them as successful or failed, generates reports on your test plans, copies test plans and test cases, and tailors test plan instances by adding and removing test cases from them.Requirement: Apache, PHP, MySQL
TestLink: Web-based test management and test execution system allowing QA teams to create, manage, execute and track test cases and organize them into test plans. Requirement: Apache, MySQL, PHP
TestMaster: A testcase management, logging, reporting and test automation tool, similar to the commercial product Test Director. Features: Progress stats, reports, test case import from CSV,doc,web or SQL, STAF plugin. Requirement: Linux, Apache, PostgreSQL
WebTst: Tool aimed at creating and managing user-centric testing
XQual Studio (XStudio): A free 100% graphical and modular in design test management application that handles the complete life-cycle of your QA/testing projects from end to end: users, requirements, specifications, development projects (scrum oriented), SUTs, tests, tesplans, test reports and test campaigns

Please comment below on your thoughts/experience on any of the tools listed above and/or if you know of any other tools that should be added.

Open Source and Free Security Tools

2009-10-22T11:30:00.001+05:30

Security testing is a process to determine that an IS (Information System) protects data and maintains functionality as intended.

The six concepts that need to be covered by security testing are: confidentiality, integrity, authentication, authorization, availability, and non-repudiation.

Confidentiality: A security measure which protects against the disclosure of information to parties other than the intended recipient(s). Often ensured by means of encoding, using a defined algorithm and some secret information known only to the originator of the information and the intended recipient(s) (a process known as cryptography) but that is by no means the only way of ensuring confidentiality.

Integrity: A measure intended to allow the receiver to determine that the information which it receives has not been altered in transit or by other than the originator of the information. Integrity schemes often use some of the same underlying technologies as confidentiality schemes, but they usually involve adding additional information to a communication to form the basis of an algorithmic check rather than encoding all of the communication.

Authentication: A measure designed to establish the validity of a transmission, message, or originator. It allows a receiver to have confidence that the information it receives originated from a specific known source.

Authorization: The process of determining that a requester is allowed to receive a service or perform an operation.

Availability: Assuring information and communications services will be ready for use when expected. Information must be kept available to authorized persons when they need it.

Non-repudiation: A measure intended to prevent the later denial that an action happened, or a communication took place, etc. In communication terms, this often involves the interchange of authentication information combined with some form of provable time stamp.

Below are some open source/free tools that can help you with security testing as well as tools that will keep your system secure. Please use these tools ONLY for good.

Aircrack: A suite of tools for 802.11a/b/g WEP and WPA cracking. It can recover a 40 through 512-bit WEP key once enough encrypted packets have been gathered. It can also attack WPA 1 or 2 networks using advanced cryptographic methods or by brute force. The suite includes airodump (an 802.11 packet capture program), aireplay (an 802.11 packet injection program), aircrack (static WEP and WPA-PSK cracking), and airdecap (decrypts WEP/WPA capture files).
AirSnort: A wireless LAN (WLAN) tool that recovers encryption keys. Operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered
Angry IP Scanner: A small open source Java application which performs host discovery (”ping scan”) and port scans. The old 2.x release was Windows-only, but the new 3.X series runs on Linux, Mac, or Windows as long as Java is installed. Version 3.X omits the vampire zebra logo. As with all connect()-based scanners, performance on Windows XP SP2 and Vista can be poor due to limitations added to tcpip.sys. The Angry FAQ provides details and workarounds. A short review was posted to nmap-dev
Audit Record Generation and Utilization System (Argus): A fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions seen in a data network traffic stream. Argus provides a common data format for reporting flow metrics such as connectivity, capacity, demand, loss, delay, and jitter on a per transaction basis. The record format that Argus uses is flexible and extensible, supporting generic flow identifiers and metrics, as well as application/protocol specific information
Babel Enterprise: Manages the risk, dividing it by domains (groups or organizations), assets and policies. With all this, it can be checked, point by point the fully compliance of a security regulation, such as UNE-ISO/IEC 27001 or other ones that depend on this such as LOPD, SOX, etc. Requirement: Linux, Solaris, WinXP, HP-UX, IBM AIX
Basic Analysis and Security Engine (BASE): A PHP-based analysis engine to search and process a database of security events generated by various IDSs, firewalls, and network monitoring tools. Its features include a query-builder and search interface for finding alerts matching different patterns, a packet viewer/decoder, and charts and statistics based on time, sensor, signature, protocol, IP address, etc.
Bastille: Program “locks down” an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system’s current state of hardening, granularity reporting on each of the security settings with which it works. Bastille currently supports the Red Hat (Fedora Core, Enterprise, and Numbered/Classic), SUSE, Debian, Gentoo, and Mandrake distributions, along with HP-UX and Mac OS X. Bastille’s focuses on letting the system’s user/administrator choose exactly how to harden the operating system. In its default hardening mode, it interactively asks the user questions, explains the topics of those questions, and builds a policy based on the user’s answers. It then applies the policy to the system. In its assessment mode, it builds a report intended to teach the user about available security settings as well as inform the user as to which settings have been tightened
Brute Force Binary Tester (BFBTester): Good for doing quick, proactive security checks of binary programs. BFBTester will perform checks of single and multiple argument command line overflows and environment variable overflows. It can also watch for tempfile creation activity to alert the user of any programs using unsafe tempfile names.Requirement: POSIX, BSD, FreeBSD, OpenBSD, Linux
Burp Suite: An integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, downstream proxies, logging, alerting and extensibility. Allows you to combine manual and automated techniques to enumerate, analyze, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another
Cain & Abel: This Windows-only password recovery tool handles an enormous variety of tasks. It can recover passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
Cheops-ng: A Network management tool for mapping and monitoring your network. It has host/network discovery functionality as well as OS detection of hosts. Cheops-ng has the ability to probe hosts to see what services they are running. On some services, cheops-ng is actually able to see what program is running for a service and the version number of that program
chkrootkit: A flexible, portable tool that can check for many signs of rootkit intrusion on Unix-based systems. Its features include detecting binary modification, utmp/wtmp/lastlog modifications, promiscuous interfaces, and malicious kernel modules. Requirements: Linux, Mac OS X
Clam AntiVirus (ClamAV): An open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates
Codenomicon Robust Open Source Software (CROSS): Program is designed to help open source projects fix critical flaws in their code. Codenomicon’s CROSS program provides open source projects with full access to its award-winning DEFENSICS testing solutions, helping the projects find and fix a large number of critical flaws very rapidly. Requirement: 130 protocol interfaces and formats

Dsniff: A suite of powerful network auditing and penetration-testing tools. Includes many tools. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected ssh and https sessions by exploiting weak bindings in ad-hoc PKI. It handles pretty much all of your password sniffing needs.
EtherApe: A graphical network monitor for Unix modeled after etherman. Features link layer, IP and TCP modes, EtherApe displays network activity graphically with a color coded protocols display. Hosts and links change in size with traffic. It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network
Ettercap: A terminal-based network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like ssh and https). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN. Requirement: Windows/Linux/Mac OS X
Flawfinder: Program that scans C/C++ source code and reports potential security flaws. By default, it sorts its reports by risk level (the riskiest operations in the code are listed first). Requirement: Python 1.5 or greater
fping: A ping(1) like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up. fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. Instead of trying one host until it timeouts or replies, fping will send out a ping packet and move on to the next host in a round-robin fashion. If a host replies, it is noted and removed from the list of hosts to check. If a host does not respond within a certain time limit and/or retry limit it will be considered unreachable.
fragroute: Features a simple ruleset language to delay, duplicate, drop, fragment, overlap, print, reorder, segment, source-route, or otherwise monkey with all outbound packets destined for a target host, with minimal support for randomized or probabilistic behaviour.
Fragrouter: A one-way fragmenting router – IP packets get sent from the attacker to the Fragrouter, which transforms them into a fragmented data stream to forward to the victim
Gendarme: An extensible rule-based tool to find problems in .NET applications and libraries. Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET) and looks for common problems with the code, problems that compilers do not typically check or have not historically checked. Requirement: .NET (Mono or MS runtime)
GnuPG: GnuPG allows to encrypt and sign your data and communication, features a versatile key managment system as well as access modules for all kind of public key directories. GnuPG, also known as GPG, is a command line tool with features for easy integration with other applications.
Helix: A customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized Linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics. Helix has been designed very carefully to NOT touch the host computer in any way and it is forensically sound. Helix will not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics
Honeyd: A small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their TCP personality can be adapted so that they appear to be running certain versions of operating systems. Honeyd enables a single host to claim multiple addresses on a LAN for network simulation. It is possible to ping the virtual machines, or to traceroute them. Any type of service on the virtual machine can be simulated according to a simple configuration file. It is also possible to proxy services to another machine rather than simulating them
Hping2: Handy little utility assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It was inspired by the ping command, but offers far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation. This tool is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities. This often allows you to map out firewall rulesets. It is also great for learning more about TCP/IP and experimenting with IP protocols. Requirement: Windows/Linux/Mac OS X
ike-scan: Exploits transport characteristics in the Internet Key Exchange (IKE) service, the mechanism used by VPNs to establish a connection between a server and a remote client. It scans IP addresses for VPN servers by sending a specially crafted IKE packet to each host within a network. Most hosts running IKE will respond, identifying their presence. The tool then remains silent and monitors retransmission packets. These retransmission responses are recorded, displayed and matched against a known set of VPN product fingerprints. Ike-scan can VPNs from manufacturers including Checkpoint, Cisco, Microsoft, Nortel, and Watchguard
IP Filter: Portable UNIX Packet Filter. Software package that can be used to provide network address translation (NAT) or firewall services. It can either be used as a loadable kernel module or incorporated into your UNIX kernel; use as a loadable kernel module where possible is highly recommended. Scripts are provided to install and patch system files, as required. IP Filter is distributed with FreeBSD, NetBSD, and Solaris.
John the Ripper: A fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. It supports several crypt(3) password hash types which are most commonly found on various Unix flavors, as well as Kerberos AFS and Windows NT/2000/XP LM hashes
Kismet: A console (ncurses) based 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. It identifies networks by passively sniffing (as opposed to more active tools such as NetStumbler), and can even decloak hidden (non-beaconing) networks if they are in use. It can automatically detect network IP blocks by sniffing TCP, UDP, ARP, and DHCP packets, log traffic in Wireshark/TCPDump compatible format, and even plot detected networks and estimated ranges on downloaded maps. Requirements: Windows/Linux/Mac OS X
Knoppix: Consists of a representative collection of GNU/Linux software, automatic hardware detection, and support for many graphics cards, sound cards, SCSI and USB devices and other peripherals. KNOPPIX can be used as a productive Linux system for the desktop, educational CD, rescue system, or as many nmap survey takers attest, a portable security tool.
Libwhisker: A Perl module geared geared towards HTTP testing. It provides functions for testing HTTP servers for many known security holes, particularly the presence of dangerous CGIs
Metasploit: The framework is an advanced open-source platform for developing, testing, and using exploit code. This project initially started off as a portable network game and has evolved into a powerful tool for penetration testing, exploit development, and vulnerability research. Requirement: Win32 / UNIX
Microsoft Baseline Security Analyzer (MBSA): Tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems.
Nagios: An open source host, service and network monitoring program. It watches hosts and services that you specify, alerting you when things go bad and when they get better. Some of its many features include monitoring of network services (smtp, pop3, http, nntp, ping, etc.), monitoring of host resources (processor load, disk usage, etc.), and contact notifications when service or host problems occur and get resolved (via email, pager, or user-defined method)
NBTscan: A program for scanning IP networks for NetBIOS name information. It sends NetBIOS status query to each address in supplied range and lists received information in human readable form. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.
Netfilter: A powerful packet filter implemented in the standard Linux kernel. The userspace iptables tool is used for configuration. It now supports packet filtering (stateless or stateful), all kinds of network address and port translation (NAT/NAPT), and multiple API layers for 3rd party extensions. It includes many different modules for handling unruly protocols such as FTP
NetStumbler: A Free Windows 802.11 Sniffer. Known for finding open wireless access points (”wardriving”). They also distribute a WinCE version for PDAs and such named Ministumbler.
Nikto: Web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers.Requirement: Windows/UNIX
Ntop: Shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user’s terminal. In Web mode, it acts as a Web server, creating an HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics.

Oedipus: A web application security analysis and testing suite written in Ruby. It is capable of parsing different types of log files off-line and identifying security vulnerabilities. Using the analyzed information, Oedipus can dynamically test web sites for application and web server vulnerabilities. Requirement: OS Independent
OllyDbg: A 32-bit assembler level analyzing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg features an intuitive user interface, advanced code analysis capable of recognizing procedures, loops, API calls, switches, tables, constants and strings, an ability to attach to a running program, and good multi-thread support. OllyDbg is free to download and use but no source code is provided
OpenBSD: Produces a free, multi-platform 4.4BSD-based UNIX-like operating system. Our efforts emphasize portability, standardization, correctness, proactive security and integrated cryptography. OpenBSD supports binary emulation of most programs from SVR4 (Solaris), FreeBSD, Linux, BSD/OS, SunOS and HP-UX
OpenBSD Packet Filter (OpenBSD PF): Handles network address translation, normalizing TCP/IP traffic, providing bandwidth control, and packet prioritization. It also offers some eccentric features, such as passive OS detection.
OpenSSH: A FREE version of the SSH connectivity tools that technical users of the Internet rely on. Users of telnet, rlogin, and ftp may not realize that their password is transmitted across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions. The OpenSSH suite replaces rlogin and telnet with the ssh program, rcp with scp, and ftp with sftp. Also included is sshd (the server side of the package), and the other utilities like ssh-add, ssh-agent, ssh-keysign, ssh-keyscan, ssh-keygen and sftp-server
Open Source Security Testing Methodology Manual (OSSTMM): This manual is to set forth a standard for Internet security testing.
OSSEC HIDS: An Open Source Host-based Intrusion Detection System.
OSSEC HIDS performs log analysis, integrity checking, rootkit detection, time-based alerting and active response. In addition to its IDS functionality, it is commonly used as a SEM/SIM solution. Because of its powerful log analysis engine, ISPs, universities and data centers are running OSSEC HIDS to monitor and analyze their firewalls, IDSs, web servers and authentication logs
Paros: This is for people who need to evaluate the security of their web applications. It is completely written in Java. All HTTP and HTTPS data between server and client, including cookies and form fields, can be intercepted and modified. Requirement: Cross-platform, Java JRE/JDK 1.4.2 or above
P0f: A versatile passive OS fingerprinting tool. Able to identify the operating system of a target host simply by examining captured packets even when the device in question is behind an overzealous packet firewall. P0f does not generate ANY additional network traffic, direct or indirect. No name lookups, no mysterious probes, no ARIN queries, nothing. In the hands of advanced users, P0f can detect firewall presence, NAT use, existence of load balancers, and more!
PuTTY: A free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. Use of PuTTY, PSCP, PSFTP and Plink is illegal in countries where encryption is outlawed.
Root Kit Hunter: A Unix scanning tool that checks for signs of various pieces of nasty software on your system like rootkits, backdoors and local exploits. It runs many tests, including MD5 hash comparisons, default filenames used by rootkits, wrong file permissions for binaries, and suspicious strings in LKM and KLD modules
Sam Spade: Provides a consistent GUI and implementation for many handy network query tasks. It was designed with tracking down spammers in mind, but can be useful for many other network exploration, administration, and security tasks. It includes tools such as ping, nslookup, whois, dig, traceroute, finger, raw HTTP web browser, DNS zone transfer, SMTP relay check, website search, and more. Non-Windows users can enjoy online versions of many of their tools
Scapy: A powerful interactive packet manipulation tool, packet generator, network scanner, network discovery tool, and packet sniffer. It provides classes to interactively create packets or sets of packets, manipulate them, send them over the wire, sniff other packets from the wire, match answers and replies, and more. Interaction is provided by the Python interpreter, so Python programming structures can be used (such as variables, loops, and functions). Report modules are possible and easy to make.
Socat: A utility similar to the venerable Netcat that works over a number of protocols and through a files, pipes, devices (terminal or modem, etc.), sockets (Unix, IP4, IP6 – raw, UDP, TCP), a client for SOCKS4, proxy CONNECT, or SSL, etc. It provides forking, logging, and dumping, different modes for interprocess communication, and many more options. It can be used, for example, as a TCP relay (one-shot or daemon), as a daemon-based socksifier, as a shell interface to Unix sockets, as an IP6 relay, for redirecting TCP-oriented programs to a serial line, or to establish a relatively secure environment (su and chroot) for running client or server shell scripts with network connections
SPIKE Proxy: An open source HTTP proxy for finding security flaws in web sites. It is part of the Spike Application Testing Suite and supports automated SQL injection detection, web site crawling, login form brute forcing, overflow detection, and directory traversal detection Requirement: Python and pyOpenSSL
Sguil: (pronounced sgweel) Built by network security analysts for network security analysts. Sguil’s main component is an intuitive GUI that provides realtime events from Snort/barnyard. It also includes other components which facilitate the practice of Network Security Monitoring and event driven analysis of IDS alerts
Stunnel: Designed to work as an SSL encryption wrapper between remote client and local (inetd-startable) or remote server. It can be used to add SSL functionality to commonly used inetd daemons like POP2, POP3, and IMAP servers without any changes in the programs’ code. It will negotiate an SSL connection using the OpenSSL or SSLeay libraries
SuperScan: A free Windows-only closed-source TCP/UDP port scanner by Foundstone. It includes a variety of additional networking tools such as ping, traceroute, http head, and whois
Sysinternals: Provides many small windows utilities that are quite useful for low-level windows hacking. Some are free of cost and/or include source code, while others are proprietary.
Tcpdump: This is the IP sniffer we all used before Ethereal (Wireshark) came on the scene, and many of us continue to use it frequently. It may not have the bells and whistles (such as a pretty GUI or parsing logic for hundreds of application protocols) that Wireshark has, but it does the job well and with fewer security holes. It also requires fewer system resources. While it doesn’t receive new features often, it is actively maintained to fix bugs and portability problems. It is great for tracking down network problems or monitoring activity. Requirement: Windows/Linux/ Mac OS X
THC Hydra: A Fast network authentication cracker which supports many different services. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more.
Tor: A toolset for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, irc, ssh, and other applications that use the TCP protocol. Tor also provides a platform on which software developers can build new applications with built-in anonymity, safety, and privacy features.
TrueCrypt: An open source disk encryption system. Users can encrypt entire filesystems, which are then on-the-fly encrypted/decrypted as needed without user intervention beyond entering their passphrase intially. A clever hidden volume feature allows you to hide a 2nd layer of particularly sensitive content with plausible deniability about whether it exists. Then if you are forced to give up your passphrase, you give them the first-level secret. Even with that, attackers cannot prove that a second level key even exists.
Unicornscan: A User-land Distributed TCP/IP stack for information gathering and correlation. It is intended to provide a researcher a superior interface for introducing a stimulus into and measuring a response from a TCP/IP enabled device or network. Some of its features include asynchronous stateless TCP scanning with all variations of TCP flags, asynchronous stateless TCP banner grabbing, and active/passive remote OS, application, and component identification by analyzing responses
WebScarab: A loose suite of web application security assessment tools written entirely in Java. It is a tool primarily designed to be used by developers who can write code themselves. Requirement: OS Indpendent
Wikto: Tool that checks for flaws in webservers. It provides much the same functionality as Nikto but adds various interesting pieces of functionality, such as a Back-End miner and close Google integration. Wikto is written for the MS .NET environment and registration is required to download the binary and/or source code.
Wireshark: Wireshark, formerly known as Ethereal, is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. Requirement: Unix, Linux, and Windows
Yersinia: A multi-protocol low-level attack tool useful for penetration testing. It is capable of many diverse attacks over multiple protocols, such as becoming the root role in the Spanning Tree (Spanning Tree Protocol), creating virtual CDP (Cisco Discovery Protocol) neighbors, becoming the active router in a HSRP (Hot Standby Router Protocol) scenario, faking DHCP replies, and other low-level attacks

Note: Most of the product descriptions were taken from the applications site. Applications were listed in alphabetical order so there are no favorites since the tool you pick is based on need.

What are your thoughts on these tools? Do you know of any others that I may have missed?

Change Your Browser Homepage and See Something New Everyday

2009-07-23T17:59:00.003+05:30

When it comes to choosing a homepage for the browser, we all have different preferences. Some people prefer a blank start page (as it loads immediately), some may be using a search engine for the home page while others may have set multiple homepages as it helps them check all their favorites sites in one go.

The only problem is that these are all static start page so you will always see the same website every time you open the browser. If you find this setting boring or monotonous, here are some web addresses that will show you something new and interesting each time you open the browser.

1. Flickr Photos - This will load a random set of most interesting pictures from Flickr, the photo sharing website.

2. Wikipedia - This will open some random article from the Wikipedia Encyclopedia - replace "en" in the URL to see articles in your own language - de for Deutsch, es for Español, it for Italiano and so on.

3. Digg - This will load a random web page that was also popular on Digg. This will work even if you hide the Diggbar.

4. Delicious - This will open a web page that has recently gone popular on Delicious, the social bookmarking website. You can also tweak the delicious URL to load web pages related to your own interests. For instance, delicious.com/popular/cricket?random=1 will only show cricket related websites in the start page.

5. Dictionary - Learn the meaning of some new English word every time you load the browser. Available for most other popular languages as well including Arabic, Hindi, Chinese, Persian (Farsi), etc.

6. StumbleUpon - This will open a random website that is popular among members of the StumbleUpon community. You can also add topics or URLs to the StumbleUpon bookmark to limit the level of randomness.

For instance, stumbleupon.com/toolbar/#stumblethru=flickr.com will only display pictures from Flickr.com while stumbleupon.com/toolbar/#topic=Business will show web pages that are under the "business" category.

Just drag any of these URLs to the browser’s home icon and prepare yourself to see something unexpected each time you open the web browser.

Surf the Web Faster on Slow Internet

2009-07-23T17:56:00.001+05:30

1. Turn off web images, the Adobe Flash plug-in, Java Applets and JavaScript from your browser settings as these files are often the bulkiest elements of any web page.

2. Increase the size of your browser cache. If the static parts of a site (like background graphics, CSS, etc) are stored in the local cache, your browser can safely skip downloading these files when you re-visit the site in future thus improving speed.

3. Sometimes the slow DNS server of your ISP can be a bottleneck so switch to OpenDNS as it can resolve website URLs into IP addresses more quickly. If you aren’t too happy about OpenDNS redirecting your Google queries, follow this simple hack.

4. Finch can serve a light-weight version of any website in real-time that is free of all bells and whistles. For instance, the New York Times homepage with all external resources can weigh more than a MB but Finch trims down the size by 90% so the site loads more quickly on a slow web connection.

5. Flinch (mentioned at #4) is good for reading regular websites but if you just need to check the latest articles published on your favorite blogs, use BareSite. This service will automatically detect the associated feed of a website and render content quickly inside a minimalist interface.

6. The Google Transcoder service at google.com/gwt/n can split large web pages into smaller chunks that will download more quickly on your computer (or mobile phone).

7. Monitor your Internet speed to determine hours when you get the maximum download speed from the ISP. Maybe you can then change your surfing schedule a bit and browse more during these "off peak" hours.

8. You can use a text browser like Lynx or Elinks for even faster browsing. It downloads only the HTML version of web pages thus reducing the overall bandwidth required to render websites.

9. When searching for web pages on Google, you can click the "Cache" link to view the text version of a web page stored in the Google Cache. Alternatively, install this GM script as it adds a "cached text only" link near every "Cached" link on Google Search pages.

10. Move your web activities offline as far as possible. You can send & receive emails, write blogs and even read feeds in an offline environment. Also see: Save Web Pages for offline reading.

11. You can interact with websites like Flickr, Google Docs, Slideshare, etc. using simple email messages. Uploading a new document to Google Docs via email would require less bandwidth than doing it in the browser because you are avoiding a trip to the Google Docs website.

12. Applying the same logic, you may also consider using tools like Web In Mail or Email The Web as they help you browse websites via email. Just put the URL of a page (e.g., cnn.com) in the subject field of your email message and these services will send you the actual page in the reply.

13. Bookmarklets are like shortcuts to your favorite web services. You neither have to open the Gmail Inbox for composing a new email message nor do you have to visit Google Translate for translating a paragraph of text. Add relevant bookmarklets to your browser bar and reduce the number of steps required to accomplish a task.

14. Use the netstat command to determine processes, other than web browsers, that may be secretly connecting to Internet in the background. Some of these processes could be consuming precious bandwidth but you can block them using the Firewall.

15. Use URL Snooper to determine non-essential host names that a website is trying to connect while downloading a web page. You may block them in future via the hosts file or use Adblock Plus to filter out advertising banners on web pages.

16. If you don’t want to spoil your web surfing experience by stripping images and other graphic elements from a web page, get Opera Turbo. It will first fetch the requested web page on to its own server and then send it to your machine in a compressed format. Opera Turbo won’t change the layout of a web site but can lower the image resolution so that they load faster on slow Internet.

17. Change the user agent of your desktop browser to that of a mobile phone like Apple’s iPhone or Windows Mobile. This will help you browse certain web sites like Google News, WSJ, etc. much faster because they’ll serve you a light-weight and less cluttered mobile version of their sites thinking you’re on a mobile phone.

Top 10 Negative Test Cases

2009-07-02T15:38:00.003+05:30

Negative test cases are designed to test the software in ways it was not intended to be used, and should be a part of your testing effort. Below are the top 10 negative test cases you should consider when designing your test effort:

1. Embedded Single Quote - Most SQL based database systems have issues when users store information that contain a single quote (e.g. John's car). For each screen that accepts alphanumeric data entry, try entering text that contains one or more single quotes.

2. Required Data Entry - Your functional specification should clearly indicate fields that require data entry on screens. Test each field on the screen that has been indicated as being required to ensure it forces you to enter data in the field.

3. Field Type Test - Your functional specification should clearly indicate fields that require specific data entry requirements (date fields, numeric fields, phone numbers, zip codes, etc). Test each field on the screen that has been indicated as having special types to ensure it forces you to enter data in the correct format based on the field type (numeric fields should not allow alphabetic or special characters, date fields should require a valid date, etc).

4. Field Size Test - Your functional specification should clearly indicate the number of characters you can enter into a field (for example, the first name must be 50 or less characters). Write test cases to ensure that you can only enter the specified number of characters. Preventing the user from entering more characters than is allowed is more elegant than giving an error message after they have already entered too many characters.

5. Numeric Bounds Test - For numeric fields, it is important to test for lower and upper bounds. For example, if you are calculating interest charged to an account, you would never have a negative interest amount applied to an account that earns interest, therefore, you should try testing it with a negative number. Likewise, if your functional specification requires that a field be in a specific range (e.g. from 10 to 50), you should try entering 9 or 51, it should fail with a graceful message.

6. Numeric Limits Test - Most database systems and programming languages allow numeric items to be identified as integers or long integers. Normally, an integer has a range of -32,767 to 32,767 and long integers can range from
-2,147,483,648 to 2,147,483,647. For numeric data entry that do not have specified bounds limits, work with these limits to ensure that it does not get an numeric overflow error.

7. Date Bounds Test - For date fields, it is important to test for lower and upper bounds. For example, if you are checking a birth date field, it is probably a good bet that the person's birth date is no older than 150 years ago. Likewise, their birth date should not be a date in the future.

8. Date Validity - For date fields, it is important
to ensure that invalid dates are not allowed (04/31/2009 is an invalid date). Your test cases should also check for leap years (every 4th and 400th year is a leap year).

9. Web Session Testing - Many web applications rely on the browser session to keep track of the person logged in, settings for the application, etc. Most screens in a web application are not designed to be launched without first logging in. Create test cases to launch web pages within the application without first logging in. The web application should ensure it has a valid logged in session before rendering pages within the application.

10. Performance Changes - As you release new versions of your product, you should have a set of performance tests that you run that identify the speed of your screens (screens that list information, screens that add/update/delete data, etc). Your test suite should include test cases that compare the prior release performance statistics to the current release. This can aid in identifying potential performance problems that will be manifested with code changes to the current release.

Software Testing Tutorial Guide Help Documentation

2009-06-12T15:41:00.002+05:30

Software Testing - Testing Tutorials, Testing Tools, Testing Softwares, Testing Jobs, Testing Techniques - Software Testing Information - Different Types of Software Testing, Software Testing Tools - Winrunner, Loadrunner. Software Testing Jobs & Interview Questions Software Testing - Testing Tutorials, Testing Tools, Testing Softwares, Testing Jobs, Testing Techniques
Free software testing tutorial - I believe I can help you - free software testing tutorial
Software testing - Wikipedia, the free encyclopedia - Details will be fleshed out Software testing - Wikipedia, the free encyclopedia
Software Testing Guide Book - This is geeky, boring and clunky, though occasionally - Software Testing Guide Book
Software Testing - An Introduction! - For past couple of years, testing has become one of most important parts of software development process. It is necessary to test software in order to develop and deliver a good, reliable and bug free software solution. Software Testing - An Introduction!. Software Testing - An Introduction!
The Software Test Management Guide - Let’s look at each one of these features - The Software Test Management Guide
Manual software testing - Overview of QaTraq Test case management tool features and settings - manual software testing techniques and strategies; learn how to better manage your software tests. Manual software testing
Introduction to Software Testing - As you already can see, Introduction to Software Testing
Introduction to Software Testing, Ammann and Offutt - No more confusion - in plain english - Introduction to Software Testing, Ammann and Offutt
Software Testing Automation Framework (STAF) - It was about this time that I re-discovered Software Testing Automation Framework (STAF)
Software Testing Guide. Blogs-Collection.com - Your perfect guide for Software Testing FAQ’s. Software Testing Guide. Blogs-Collection.com
Software testing/Introduction - Wikiversity - Whatever you’d like to do with Software testing/Introduction - Wikiversity
IBM : developerWorks : Site maintenance - There’s absolutely nothing wrong with visiting IBM : developerWorks : Site maintenance
Software Testing Guide - Wish to know more about Software Testing Guide
Testing Basics Interview Questions - - Testing Common Questions Interview Questions Get Career Tips, Career advice, Learn about the interview procedures in Major companies, Discuss each question in detail, learn from the experts and gain Confidence Testing Basics Interview Questions
Software Testing Documentation - Software Test Documentation. Types include test case specification, Software test incident report, test log, Software test plan, Software test procedure, Software test report. Software Testing Documentation
Basics of Software Testing - This tutorial covers the basics of software testing with accents on white and black box techniques that are mandatory knowledge for certifications. Basics of Software Testing
Software testing Help - There’s light at the end of the tunnel, but before you can see it, you must address the following aspects : Software testing Help

Guide: Testing Mobile Applications with HP QTP

2009-05-23T13:20:00.000+05:30

Can we test mobile applications using QTP?

windows_pocket_pc_qtp_testing

Yes. Jamo Solution’s, M-eux test provides scripting environment to test certain mobile Operating Systems using QTP.
What are the mobile operating systems supported by M-eux test for QTP?

1. Windows Mobile 6.x Professional edition.
2. Windows Mobile 6.x Classic edition.
3. Windows Mobile 5.0 Pocket PC edition.

Which versions of QTP supports mobile OS testing?

According to M-eux product datasheet, QTP 9.2 and QTP 9.5 supports mobile OS testing.
What are the salient features of M-eux?

The scripts created using M-eux are independent from the device hardware characteristics. Here is an extract from their product data sheet.

Supported Mobile OS:

* Windows Mobile 6.x Professional Edition
* Windows Mobile 6.x Classic Edition
* Windows Mobile 5.0 Pocket PC
edition

Supported GUI Objects:

* Microsoft Foundation Classes for Windows Mobile.
* Microsoft Compact Framework GUI objects
* HTML Web classes (through web addon)

Supported version:

QuickTest Professional Versions 9.2 and 9.5

Extended support CF .Net GUI objects:

* Access from the script to .Net source code class attributes and methods.
* Identification by internal .Net name

Manufacturer independent:
Supports Windows Mobile
independent from hardware
manufacturer

Pocket Internet Explorer support:

* Supports automation of web/WAP access.
* Supports HTML objects.

System functions:

* Access to process information
* Access to system information
* Access to radio cell information
* Access to network information
* Access to application information

Monitor functions:

* Concurrent execution on multiple devices.
* Pre-defined functions to measure voice call, SMS, e-mail and others.

Where can we find more information on Jamo Solution’s M-eux test?

Following links can be of interest:

* Official Jamo Solution website.
* M-eux test overview.
* M-eux product datasheet. (pdf)
* M-eux evaluation version.
* M-eux Demo

Google Testing Blog

2009-05-22T17:32:00.002+05:30

New Definitions

2009-05-22T17:30:00.000+05:30

Performance Testing

What
"Testing conducted to evaluate the compliance of a system or component with specified performance requirements." [IEEE]
BS 7925-1.British Computer Society Specialist Interest Group in Software Testing (BCS SIGIST)

Performance testing is a sub-set of non-functional requirements testing. Other techniques that appear in this area include: conformance testing, conversion testing, documentation testing, penetration testing, recovery testing, serviceability testing, storage testing.

However as with most things, one mans performance test is another mans stress test.

Test techniques that I would include in performance testing are load testing and stress testing. The reason I choose to include these as part of performance testing, is that they evaluate how the behaviour is modified at under various levels of usage.

Why?
To establish that the system or component under test will behave as we expect, under the conditions we expect. Note that we are not setting out to blindly "hammer" to system into submission or destruction. The end result should that management can have confidence in the software. Additionally they will have enough information to base business related decisions on.

Who?
Usually done within the developing organisation. Although, it may be contracted out to a specialist test lab or consultancy. Contracting out is popular due to the heavy investment required in tools and training.

In terms testing roles, performance testing can be split. Typically this is split between a test analysis and test automation. Thus the test analyst will decide which tests are to be run. Test automators or engineers will actually create the scripts and configure the tools. In addition, more junior staff may act as technicians to execute them. Technicians are used because, once the test suite is written it can become a mundane task to automate them.

Where?
At the developing site or a specialist facility.

When?
The timing of performance testing depends on the model or methodologies being used. In the case of the Waterfall, perfomance testing will take place at the very end of the development lifecycle. In the worst case scenario, imagine a system that has tested without fault in functional testing with a single user. When a load of 3 concurrent users is simulated, it crashes with due to continous data locks etc. Huge amounts of time are required to fix high profile defects, at or near release time.

In incremental testing, the system is built up by adding components or sub-systems one at a time. As each component is added, the system can be tested to see if it meets requirements. Of course the individual components or sub-systems can be tested for performance by themselves.

In the case of the Rational Unified Process (RUP), performance may take place during the very earliest phase of Inception. It is Inception that the business risk is mitigated. Also one possible core architecture is put forward. Simple performance testing might be done to confirm that the architecture is suitable (in a very coarse grained manner.) This would be the case for such systems generating large numbers of transactions.

How?
Performance testing requires huge numbers: of users, data and transactions. Such requirements mean that manual testing is unfeasible. Automated testing is really the only way to go. Of course there are many tools available on the market, for instance Loadrunner.

Types of tools include, data preparation, execution. They are generally known as Computer Aided Software Testing Tools (CAST)

The difficulty with performance testing is replicating the real world environment, especially the randomness of individual events, whilst maintaining the predictability of the big picture. Various statistical methods are available to help in this process. My particular favourite is Monte Carlo scenario modelling. In a Monte Carlo simulation, we follow the rules of the casino. Thus if we shake a dice once, we do not know if it will be a 1 through to a 6. However if we roll it 6 million times, we will get a million ones, a million twos, etc.

Load Testing

In load testing the software under test in subjected to various levels of "load", to test its behaviour.

Load testing is not defined in BS7925-1. It can mean different things depending on whom you are speaking. It is most definitely a non-functional test. The aspect of behaviour that concerned is that of performance.

The testing has to be conducted within a structured framework otherwise its results are open to question.

Various elements need to be considered before engaging in Load Testing.

Plannning Load Testing is like any other activity. Good quality is the result of planning and foresight, enabling the test to be ran over and over again.

Objectives What do we hope to achieve? This question has to be answered in relation to the specified requirements of the Software Under Test (SUT). The tester needs to know how the SUT a) should be behave under, b) a given load.

For example for a large site it may be accepted as a business risk that the SUT will run slower at high loads. However, this needs confirming, otherwise the business runs the risk of the SUT due to underestimating the effect of higher loads.

On what? Which aspect of the system is to bear the specified load? The answer ranges from a single component to a Web Services system made up of many third party applications. As the SUT becomes larger, it becomes more complex. Consequently the load testing suite becomes more complex.

For example it is decided a website checkout facililty needs testing. This can be tested in isolation as a component or as part of the system. If it can only be tested once the integration has taken place and a fault occurs, was the problem with the cart or somewhere else in the system.

Iterative development styles suit load testing, as they successively build up a full system. The RUP with its inception etc phases, gives many opportunities. During the Inception and Elaboration phases the core architecture can be assessed. In construction smaller components can be tested as they added incrementally and then as an integrated whole system.

The Sequential or Waterfal method is less suited, due to its single big bang approach to integration. Thus after months or even years of development, can the system as a whole be load tested. The problem is that it is difficult to establish what you are testing and the causes of failure.

Which Load? How is the load on the SUT to be generated? Multiple users or a small number of users generating large numbers of transactions? The important factor is to replicate the situation the SUT will meet in the real world. For example a bank system, processing payments will have one user processing a lot of data. Whereas a consumer website may have millions of users conducting one or two transactions a day.

Should the data be increased as the test progresses, or at a steady sustained level for a long period?

Should the load be of a single type or multiple? For example in our checkout example, a certain percentage of the transactions should be of the user dropping out of the transaction. Again this mirrors the real world.

Testers looking at load testing may want to consider using Monte Carlo simulations. Here data is randomly generated according to a set of rules. I.e. we do not know which transaction is coming next, but it has a 1 in 5 chance of being a drop out from the checkout.

An important point, often overlooked is that the load may spike. Advertising may make the SUT suddenly very attractive to users. The classic example of failure to realise this, was the Victoria's Secrets affair. Here a fashion show of lingerie, during the half time break in the Super Bowl was heavily promoted. Consequently millions of Americans logged on, and lo and behold the servers crashed under the strain.

Expected Outcomes The tester has to be aware of what to expect. Should this not be the case, then raise it with the analyst. Just because load testing is non-functional, we still need to know what to expect.

Logging As the test progresses we need to know what exactly a) the load being applied and b) the behaviour exibhited. This has two benefits, firstly we can keep track of any deterioration of performance as the load increases.

Tools Due to the large amount of transactions, many Load Testing can only realistically be undertaken with Computer Aided Software Tools (CAST). LoadRunner and Rational Robot are the front runners for this type of testing.

Security Testing

What
"Testing whether the system meets its specified security objectives."
BS 7925-1.British Computer Society Specialist Interest Group in Software Testing (BCS SIGIST)

The latest fashionable technique is penetration testing., where the tester tries to simulate attempts to break system security as a real intruder would.

In most cases security is a non-functional requirement. The exception of course is where the purpose of the software is security itself.

Why?
We all hope that unfriendly people or organisations will not be able to abuse our software or the data that is held or generated by it. Depending on the type of people or organisation our customers are, and the uses to which they are going to put the software should dictate the amount of security testing we do.

Three events, I believe have put security testing into the spotlight:- September 11th, moving business online and large virus attacks. Notwithstanding the the events mentioned every system has will have some level of security requirement, and will therefore need testing.

Thus a military communications system will require stringent security testing. At a more personal level, any system that will hold delicate personal information, should for privacy reasons be secure.

Even fairly inoccous software can be exploited to either do something it should not or be used to break into another system. A good example is the humble Excel product. Many viruses take advantage of buffer overruns to spread themselves or use it as a gateway to the operating system and ultimately take over the users machine.

Who?
The definition above only mentions the system. However I believe awareness of security should begin even earlier in component testing. It is at this stage many of the chinks in armour defects will be found. For example buffer overruns. Websites may find the potential for hot sql injection intrusions. The growing use of web services, with the reliance on opening individual components or sub-systems up for all to use, will make this level of testing even more crucial. Thus we can start our list of with developers or whoever is conducting unit testing.

Especially in high risk systems, analysts need to be ensuring, security, is built into the system design and processes. Additionaly testability needs to be high in this particular area.

Ideally the software though is tested by an independent test team of system testers. In the case of penetration testing, an outside consultancy is brought in to try simulate an attack. However constraints on resources mean that, independence in many cases suffers.

Where?
Testing that software is secure can take place anywhere, including the developers own site. At the other extreme is for the penetration tester or "intruder" to be sitting on a different continent using the telecoms network and internet to try and break into an online transaction site.

When?
Throughout the whole software development lifecycle for the developing organisation and accepting customer. In addition regular security testing should be undertaken to make sure the software is still secure.

How
Perhaps more than any other form, security testing is associated with risk. Thus if security is of such importance, i.e. to the police or military, then awareness and practice has to be pervasive amongst the stakeholders. If the organisation has a mature development culture and are at level 3 or above in the CMMI they should have a strategy for risk mitigation. (For more on risk management)

Data Flow Testing

Testing in which test cases are designed based on variable usage within the code.
BS 7925-1.British Computer Society Specialist Interest Group in Software Testing (BCS SIGIST)

complete path testing

What
A test case design technique in which test cases are designed to execute all the paths of a component.

Testing paths through a component is largely a white box test technique. This is because the tester needs access to the code. Typically path testing would be conducted towards component testing. In addition if complete path testing is done, this will contribute to exhaustive testing

Why?
Components are the building blocks of software. If we can not be sure about their internal workings how can we expect to trust a system that is built from them?

Only by identifying and executing the different paths or routes through the component, can we be sure that all the behaviour the component will exhibit has been tested. For some software failure is simply not an option, typically these are safety critical systems such as medical software. So unlike normal path testing, all the paths through the software are tested.

Who?
Ideally someone with independence from the person who designed and/or coded the component. However this is quite rare and it usually ends up with the developer who did the coding. Not satisfactory, but this is the real world.

Where?
Invariabliy at the developing organisations home site.

When?
Execution of the tests should be as close as possible to the completion of the code.

How?

dynamic analysis where the code is actually exercised is the method here.

Tests can be either manual or automated. Various tools are available including static analyzers and run time analysis tools.

The tester needs to be aware of the various paths through the component. From this he can decide the paths to be tested. This figure is then used to calculate the target for path coverage. of 100%.

All the paths required to ensure the components behaviour is functionally correct. In addition as many alternative paths should be tested. Commonly the first paths not to be tested are those useful in negative testing. This however runs the risk of not exposing serious defects, when the user takes a path that he should not.

The more life or business critical the component or software, the more paths will be tested. Thus a component for the Space Shuttle will probably have path coverage of 100%

In the long run, though path testing has to be part of a wider culture of testability. Analysts and designers need to be aware of complexity. If they continue to demand complex objects, then path testing becomes ineffective due to the number of paths a tester is required to traverse.