It's all about Software Testing

Curtis Stuehrenberg • Ethically this is an interesting question and one I've had to frequently face myself. I don't think there is a standard answer applicable to all situations, unfortunately. The only thing you cannot do is change their behavior for them.

Since you cannot change their behavior, let me ask you a quick question. Why do you care? You know you are doing the work. You know you are building out your skills and experience. Even if your lead is taking credit for your work, so what? Eventually he or she will say something ridiculous or commit to something impossible and they will be found out. Until then all you can do is perform with dignity and professionalism. If you do so no matter what happens you can feel morally, ethically, and professionally justified. Even if this lead decides to blame everything on you and you are fired (worst case scenario), you can walk into the interview for a new job with the confidence and assurance that comes from correct and moral actions. Your lead, on the other hand, will have to explain why their own work has suddenly stopped.

However if you feel enough frustration and indignation at your lead where you feel like you cannot conduct yourself as a professional ... then quit. Find a position with a lead and a management team more in alignment with your justifiably high commitment to personal accountability and honesty. It is infinitely easier to simply find a new job than navigating the mine field of office politics and official action on your part would immediately trigger. People who do this sort of thing and become leads or managers are ALWAYS consummate office politicians. The fact they cannot do the work and yet are expected to be a lead for others should tell you they are either very good at lying and confusing upper management with their webs or they are somehow connected to a high-ranking person in an inappropriate manner. Neither of these possibilities grant you much chance or winning in the battle soon to follow if you take official action and complain up the company ladder.

So my advice is to find a new job and then quit. If you do not want to quit, then approach your lead and tell them directly you do not appreciate what they are doing and find it ethically reprehensible. Then quietly sit still while they continue to steal your work.

8 hours ago• Like

Follow Earl

Earl Willis • That's cold Bhava! Automating his job? I find being in a technical leadership position, your best bet and best approach is to have actual STRONG technical knowledge that puts you in a position to lead from the front and not from behind.

It seems the Test Lead is leading from behind w/out actual knowledge. Due to this person's lack of knowledge they are probably fearful of taking risks, overly concerned with their reputations, making tough decisions, etc., the list goes on. This will eventually set the tone for the group. Upper management will eventually find out as this tone usually invariably filters it's way through the entire team making effective action impossible.

I'd say stick to your guns, keep producing Quality work, don't sacrifice your integrity, and document tasks that you have been doing successfully. When the above-mentioned happens, you will have a stronger case with senior management. You may also have the support of your other team members, as they are probably going through the same.

On the other hand, from what Curtis said, this may be a losing battle if they are well-trained in 'confusing upper management with their webs' or connected to a high-ranking person. In that case, I'd try to find another job.

8 hours ago• Like

Curtis Stuehrenberg • It's also possible they don't know they're doing something wrong and might need to be told their actions are not welcomed. If the lead is very inexperienced they might think what they're doing is standard or at least not that big of a deal. If you don't tell them, they won't know and be able to correct it.

8 hours ago• Like

Freddy Vega • @Diva, please do not quit your job! :)

Someone on this thread said "The fact they cannot do the work and yet are expected to be a lead for others should tell you they are either very good at lying and confusing upper management with their webs or they are somehow connected to a high-ranking person in an inappropriate manner."

Those are not the ONLY two things this lead can be. It can also mean that he is required to present the work that others perform (this is a normal process in any lead's job). It can also mean that, while he does not have experience in test, he may be a company or industry veteran that truly understands the business and was placed in the position, with trusted QA folks below him, to run a tight ship.

The best way to deal with this situation IMO, is communication, communication, communication. Be it via suggesting new processes, tools, etc or talking, emailing the lead directly. Just do not quit your job and do not automate his job!!! :)

If you can't beat them, join them. Become his ally and watch yourself rise to the top! ;)

7 hours ago• Like

Curtis Stuehrenberg • @Freddy - So you think that if she finds the situation completely unbearable and cannot conduct herself as a professional then she should just suck it up and keep working, perhaps even align herself with this person in order to further her own career? I ask because that's the situation I outlined when I suggested quitting as an extreme reaction.

If Diva truly finds the situation too horrible to bear, then she should find a new job a quit. If however she is simply looking to vent a little pressure, she has other options. You should NEVER approach some one with an accusation like this without full realization of where it might lead. If her lead is a reasonable person and truly does not know his or her behavior is professionally unethical, then communication is truly the most beneficial option. However if her lead is fully aware of the situation and either does not care or sees no other option for personal advancement, then confronting him or her about it will only cause problems. The truth of the situation probably lies somewhere in between these two extremes but it does not remove them completely. You should never gamble with money you cannot afford to lose. You should also never stand up for principles you are not willing to sacrifice other things to maintain.

7 hours ago• Like

Freddy Vega • @Curtis, NO, I do not think she should "suck it up and keep working"

I am suggesting that she should "align herself" with this Lead. Once they are both going in the same direction; sparks will fly!

You do this, with COMMUNICATION! and that, Curtis, is what I am suggesting.

7 hours ago• Like

Freddy Vega • And yes, once they (Diva and Lead) are aligned, they will both be at the relative* top (from a work/career perspective).

*relative: meaning from the current situation (i.e. bad, stealing work, etc).

7 hours ago• Like

Follow William "Bill"

William "Bill" Malik, CISA • The risk with aligning your career with a fraud is that when they go down, you will too. Why take that risk? If I see my boss stealing anything from anyone, I'll report it to the appropriate leader. If the organization's culture is to accept the malfeasance, then best to get out of there. Do you want to have Enron on your resume?

The point is that eventually bad behavior comes to light. Maybe not soon enough, maybe not fully enough, but it will. In the meantime, as Kurt Vonnegut said, "Your are who you pretend to be, so be careful about who you pretend to be." If you choose to stand with a known crook, then the premise that you don't like crooked behavior is rendered meaningless. Actions > words, and words > ideas.

7 hours ago• Like

Freddy Vega • @William, that is assuming the work is being "stolen". This is all a perception thing. We cannot assume the worst without more information first. This is why COMMUNICATION is the right answer.

7 hours ago• Like

Freddy Vega • Oh and William... I concur... "Actions speak louder than words" ;)

7 hours ago• Like

DivaUnfollow

Diva Samanta • Hmm.... it is interesting to read so many different views on the subject.

Let me give you all some specifics:

1. The first thing this person did is become best frineds with the QA manager.... getting into the personal life, calling, chatting.... in one word 'buttering' is an everyday thing.
2. The communication skill is world famous, I mean, office famous.... horrible English and sentence construction.... hard to figure out the meanings of the emails sent.
3. This person would ask the testers to create documents or pull excel reports from Quality Center for the Sign Offs or other related documents he/she is supposed to create. If these documents are sent to him/her and the manager is copied in the email, this person will call the tester and RAISE HELL.
4. Since the communication skill is not good enough, this person would forward the same email to the manager that the tester had sent, changing the name at the bottom of the email. The way we discovered this is via Live Meeting when his/her desktop was shared by many.

These are just a few examples....

BTW, I like the quitting option.... does any of you have a position open for me ? ;)

6 hours ago• Like

Freddy Vega • Well, all I can say is that there are two sides to every coin ;)

Diva, I'm not saying that you are wrong. I'm just saying that all of the issues you raise can be fixed with COMMUNICATION.

6 hours ago• Like

Curtis Stuehrenberg • @Diva - It sounds like you have a good sense of humor about this, so I would just let it go. You and the rest of the team should conduct yourselves as professionals and let this person slowly dig their own grave. Personal relationships are great and can help you advance your career in ways you'd never quite suspect, but they do not pay bills. At the end of the day it is the person who can do the work that will be in high demand, not the person with whom it is fun to hang around.

If your management team is not aware they are simply signing their names to documents and communications produced by several people, then your upper management are fools. However I suspect they know and simply don't care ... so long as the work is being done. Sooner rather than later this person will run into a problem they cannot steal or flatter their way out of. Their inexperience, lack of communication, and tendency to take credit for other people's ideas and work will then NOT be ignored.

6 hours ago• Like

Follow Earl

Earl Willis • @Diva,
Changing names raises a red flag in my book. Sounds to me like this person knows exactly what they are doing. The more I read of your circumstances, the more I have to agree with Curtis's first comment when he says 'It is infinitely easier to simply find a new job than navigating the mine field of office politics and official action on your part would immediately trigger'. Especially one in which the team you are going to shares the same beliefs about integrity as you.

Of course, this is easier said than done but you are in a better position as you can look for another opportunity while you have a job which allows you to feel everything out before making a commitment just for the sake of leaving your current situation.

The more you explore alternative opportunities the more empowerment you will feel over your situation, and this will also give you an idea of what you will lose if you leave, and what you can lose if you don't leave.

6 hours ago• Like

Follow William "Bill"

William "Bill" Malik, CISA • @Freddy

The only reason I said that something was stolen was that Diva said something was being stolen. It would be great to see an example of the specific communication - what would be said, and to whom, that would resolve all of these issues.

Here are a couple of parameters: 1) Let's assume that D has a professional reputation and a level of personal integrity that she does not want to sacrifice. 2) Let's assume that D doesn't want to be bullied at work. 3) Let's assume that L is devious.

So D goes to L and asks for something to change, and L responds by making life more difficult for D.

Or, D goes to QA Mgr to report L's behavior. QA Mgr and L make life more difficult for D.

Or, D goes to VP/CIO to report L and QA Mgr's harassment. VP investigates and makes life more difficult for D.

So, what's your plan?

6 hours ago• Like

Freddy Vega • @Diva, note that a lot of folks are encouraging you to quit your job rather than face the issues, communicate, and come out the other end, in the least, a bigger person.

Working through problems is any engineers dream! Work through IT! Communicate! Take action, all positive and constructive. Even if it means looking at yourself critically. :)

6 hours ago• Like

Freddy Vega • But @William,

My plan is not to assume or guess. Its just to communicate and take appropriate action as the "unknown" becomes "known".

6 hours ago• Like

DivaUnfollow

Diva Samanta • @ Curtis, @ Earl, @ William.... I agree with you ....

I have decided to give it my best shot and see how far I can go with my skills and how far this person can go with deceit. There is a saying "Winners never quit. Quitters never win". I have faith in my capabilities. At the end of the day, I am not the one who asks for help to get things done. For the time being, I am just being a silent observer and a team player.

@ Freddy, how do you communicate with a fraud?

5 hours ago• Like

Freddy Vega • @Diva, I realize what I am telling you may not be what you want to hear (like Curtis, Earl, William, etc). I also realize that the advice I am giving you is much harder to execute (easier said than done, right?) but you said it yourself "Winners never quit. Quitters never win".

So if you follow that quote it is saying exactly what I am recommending you do ;)

How do you communicate with a Fraud? The same way you communicate with anybody.
However, the first thing I would do is get the word "fraud" or "steal" or anything that sounds negative or destructive out of my vocabulary when I either reference or talk to this individual. I know, I know, easier said than done. But IT CAN be done...

5 hours ago• Like

Follow Jan

Jan De Wael • @Diva, as listed above, you have multiple options. Key is that YOU stay in control of YOUR life. Your lead may steal credits from your work, but should not touch your self-respect.

From the options I read you may:
- quit the team, why should you spent energy for that boss?
- focus on your own objective, rather than looking from fair treatment from your lead, you may find rewards from the job you do, the things you learn, the rewards from peers...
- change the relationship with your lead (you may change your way in communication with your lead and change the way you think about him/her (e.g. where is she/he good in, what do I appreciate from her/him)? As long as you see only negative attitudes, it will be difficult to communicate openly
- go for the power battle, as a direct confrontation or after looking for support by senior management.
- maybe more options...

All options have there advantages and disadvantages, may cost you more energy or look easy. It's finally your game. Good luck.

5 hours ago• Like

Follow Earl

Earl Willis • @Diva,
The things is, your skill might just take you to another position where you will have a lead with more integrity or even be inline to be a lead yourself and have that opportunity for advancement. The way it sounds, due to the lack of technical knowledge, this resource does not sound like they are willing to let this fact be known on a wide-scale level. At the same time, there is a risk that this is all known, and no one will take action because the work keeps getting done. Nobody will try to fix what is broken if projects are still getting completed. It's only broken on your end. With that said, deceit can go very far and that is something to take into consideration in figuring out next steps, instead of letting the chips fall where they may.

As Jan said, YOU stay in control of YOUR life, and YOUR career.

Contrary to what Freddie is saying, and I respect his opinion, but I don't think we're telling what you want to hear. I think we're telling you what you don't want to hear. Staying on the job is the easy option as that is your current comfort zone. Exploring the unknown is much more challenging and daunting.

Isn't it crazy to think that you are trying to work out a situation that only isn't working out for you. We're not saying leave or quit, we're just saying explore your options while morale is still somewhat high and you are feeling confident about your testing abilities, while trying to work out your current situation. Being proactive never hurt anyone.

When the dust clears you will have a few options in your hand, instead of one.

4 hours ago• Like

Follow Nasera

Nasera H. • Dear you told me so late about this .... :-)
So here are my points, if you think them “useful” use it...! lol
* Now I can’t suggest this as I am so late here... LOL --- Before posting this topic, check whether he /she is here on LinkedIn or not...

* Don’t get even more DISTURBED OR CONFUSED by the arguments going on here .... hahahaha

* I agree with Freddy, you SHOULD NOT quit the job... why should you? Why not that person?

* I know it is very frustrating and it is difficult to handle too, but dear, you are strong enough to handle such people. Almost everybody faces this type of problem at least once in life or even more times.... so nothing new about this.... So whatever you will do or create any document, do keep others in CC or BCC.... Make it a habit, so they will be aware about this fact that you are the original creator of it.... :-)

* Whenever you will do any good work, go and tell your friends and seniors immediately... either by phone, IM or personally.

* Never disclose your ideas and suggestions in front of that person who is going to take benefit of that and put it as if it is his or her idea.... Disclose your ideas and points in front of others and directly in front of your seniors in the meetings... So nobody will get any chance to copy it... or take credit for it...!

* See even though he or she is pleasing your boss by chatting and calling etc... EVERY BOSS IS SMART ENOUGH to identify the REAL talent and even though boss is not admitting it openly, due to that person’s favour, he/she knows very well about the capabilities of all the employees so don’t bother about it...

* Just IGNORE this cheater.... because like you even others are also aware about his or her habits... So even if you are feeling that only you know that he or she is taking undue credit, it is NOT true, others from your office are also AWARE about his/her such shallow activities... LOL

* Now if that person is available on LinkedIn then OMG..... (SORRY FOR BEING UNPROFESSIONAL HERE and writing in this manner : p lol) you have already made him or her realize that whatever he or she is doing is NOT GOOD...!!! But hey now my points are NOT the secrets anymore to make his or her plan fail....hahahaha

10) By the way, I am declaring here that I am NOT your LEAD and seriously I don’t know your LEAD.... ahahahaha.... I hope now you will NOT QUIT your job at all and hey contact me privately I do have more secrets to tell you how to deal with it .... ;) But NEVER FORGET TO SMILE.... We will sort it out this yaar, don’t worry at all...!!! Cheers.... ;-)

4 hours ago• Like

Follow Nasera

Nasera H. • Yup.... again an ESSAY, as you had said, you like it...! ;)

4 hours ago• Like

Curtis Stuehrenberg • @Diva - I think you are taking a path of correct actions both ethically and professionally. It is difficult to imagine a situation where some one is removing a document author entry and substituting their own name without being very aware they are plagiarizing some one else's work. Confronting them about doing this sort of thing will not open their eyes to a sudden realization it is wrong to take credit for some one else's ideas and work.

The best course is to stay where you are and simply do your work. Gain actual knowledge and experience you can use no matter where you end up. If this person wants to advance through personal relationships coupled with theft, then let them. They may be found out at some point, and they may end up CEO of a large corporation. It really doesn't matter. What matters is how you feel about your work and how you've conducted yourself.

3 hours ago• Like

DianeUnfollow

Diane Miller • Frankly guys, I've seen a lot of unqualified people get promoted and rewarded for bad behavior in life (if you haven't noted it in your career, just look at the celebrities of reality tv)

@Diva, I don't know the environment you are in, but I understand and have been in quite a few 'good old boy' environments over the past 14 years. I've been told by a past manager that once a tester, always a tester and that as a female I'd never move beyond a tester. I don't have a solution, just words of advice. Hang in there, the lead will either get found out for their incompetence or move on to another job or area. Continue to do your job and build your skills, look at training, certifications, etc. if necessary.

And things will turn around. If they don't you will have the experience and skillset to go elsewhere, where you will be appreciated more.

Web Site Test Tools and Site Management Tools

2011-12-28T07:04:00.000-08:00

More than 550 tools listed in 14 categories

Organization of Web Test Tools Listing - this tools listing has been loosely organized into the following categories:

Load and Performance Test Tools

Java Test Tools

Link Checkers

HTML Validators

Free On-the-Web HTML Validators and Link Checkers

PERL and C Programs for Validating and Checking

Cross-browser testing tools/services

Web Functional/Regression Test Tools

Web Site Security Test Tools

External Site Monitoring Services

Web Site Management Tools

Log Analysis Tools

Mobile Web/App Testing Tools

Other Web Test Tools

Load and Performance Test Tools

Tsung - Free open-source multi-protocol distributed load testing tool supported by Process-One. Can be used to stress HTTP, WebDAV, SOAP, PostgreSQL, MySQL, LDAP and Jabber/XMPP servers. SSL is also supported. OS monitoring (CPU, memory and network traffic) using SNMP, Munin or Erlang agents on remote servers. XML configuration system; several sessions can be used to simulate different type of users. Dynamic sessions can be described in XML. User think-times and the arrival rate can be randomized using a probability distribution. HTML reports can be generated during the load to view response times measurement, server CPU, etc. Developed in Erlang.

PerformanceXpert - Performance and load-testing solution available as a service over the Internet. Includes unlimited hardware and software already pre-configured and ready to run on-demand. Can realistically simulate thousands of virtual users and execute various load scenarios from multiple geographic locations (North America, Europe, and Asia). Includes web-based test management, archiving, repository, cloud-based monitoring, rich scripting language, and supports HTTP, HTTPS, web-services, XML, TCP, SQL, Login and more. Utilizes JMeter and Selenium. Lite and Pro versions.

LoadUI - Free open source cross-platform load testing tool from Eviwear/SmartBear Software. Using the soapUI Runner component (also from Eviwear/SmartBear), can leverage pre-existing functional soapUI TestCases and run them in loadUI. This integration enables support for HTTP(S), HTML, SOAP/WSDL and REST to AMF, JDBC, JMS and POX. Using loadUI Agents, can distribute loadUI TestCases to any number of Agents locally and remotely. Comprehensive analystics/reporting capabilities.

AppViewWeb - Cloud-based performance testing service from AppNeta that provides visibility into the network performance of web applications. Especially useful for QA test engineers conducting application pre-deployment testing on WAN networks. When testing web-based applications for CRM, VoIP, Video, Citrix, VMware and database management applications it's helpful to understand the performance of these applications from the perspective out to remote site end users; AppViewWeb provides such insight.

Sandstorm - Load testing tool from Impetus Technologies Inc., supports Web, Mobile and Email protocols. Supports Flex and Ajax, protocols such as Http, Https, Web Services, POP3, SMTP, DNS, SIP, WAP, Applets, and Java serialized objects. Rich and extensible framework for runtime modification of test case using JavaScript and core Java APIs. Integrated resource monitoring for most of the popular web, app and db servers.

Multi-Mechanize - Multi-Mechanize is an open source framework by Corey Goldberg for web performance and load testing. It allows you to run simultaneous python scripts to generate load (synthetic transactions) against a web site or web service. Results can be saved in CSV format along with an HTML report containing stats and graphs. Proficiency with Python, HTTP, and performance/load testing is recommended to use Multi-Mechanize successfully.

Load2Test - Performance/load/stress/high availability testing tool from Enteros Inc. Can capture real production workload for playback simulating thousands of users for top down testing or back-end testing at the component layer. Also available in the Amazon EC2, RackSpace or PlatForm Labs cloud environments. Integrated performance management and root cause analysis system automatically collects performance metrics across load test infrastructure and applies cross-component correlation to identify performance degradations and bottlenecks. Targeted platforms/OS's: Load2Test Controller: Windows, Linux; Load2Test Test Nodes: Windows, Linux. Load2Test performance monitors and root cause analysis data collectors - OS: Windows, Linux, HP/UX, SUN Solaris, IBM AIX Databases: Oracle, DB2, SQL Server, Sybase, MySQL, PostgreSQL; App: .NET, JBoss, WebLogic, WebSphere, Oracle Application Server (OAS), GlassFish, Tomcat, JettyStorage: NetApp Filers, IBM DS8300

Xceptance LoadTest - Load testing and regression tool from Xceptance Software Technologies, Inc for web and Java and other app load testing. Includes recording capabilities. XLT Cloud Service available. Tests implemented as JUnit 4 test cases. For web-based tests, the framework provides a (headless) browser that can emulate Internet Explorer or Firefox behaviour. Can execute client-side JavaScript in the emulated web browsers and that way it simplifies the creation of test cases for Web 2.0 applications. Platform independent due to tool being implemented in Java; test scripting in Java or Ruby. Free for up to five virtual users.

SiteBlaster - Web site load and stress testing tool; shareware. Can be used to rapidly submit requests to a site, or can pause a random amount of time between submissions, approximating user behavior. During testing the pages being tested will be displayed. Reports created on test completion. Designed to be very easy to use; intended for software developers and architects who want some early indication about performance characteristics of the web sites they create. Simulates MS IE web browsing functionality; a web page that is well behaved in IE should be well behaved in SiteBlaster. Best used to test those sites that use URL query strings to pass data to its web page(s). PDF user guide available. For Windows.

Load-Intelligence - Affordable load-testing ?Software as a Service? from Cloud-Intelligence. Software and unlimited hardware all included. JMeter users can execute their test-scripts in an unlimited, pre-configure, distributed environment. Neither setup nor installation are required. Immediate access to JMeter logs, reports, test script, CSV files and more.

LoadStorm - A web-based load testing tool/service as a distributed application that leverages the power of Amazon Web Services to scale on demand with processing power and bandwidth as needed. As the test loads increase to hundreds or thousands of virtual users, LoadStorm automatically adds machines from Amazon's server farm to handle the processing. Tests can be built using the tool in such a way as to simulate a large number of different users with unique logins and different tasks.

BrowserMob - On-demand, self-service, low-cost, pay-as-you-go service from Neustar enables simulation of large volumes of real browsers hitting a website. Utilizes Amazon Web Services, Selenium. Uses real browsers for each virtual user so that traffic is realistic, AJAX & Flash support is automatic. Browser screen shots of errors included in reports.

Load Impact - Online load testing service from Gatorhole/loadimpact.com for load- and stress- testing of your website over the Internet; access to our distributed network of load generator nodes - server clusters with very fast connections to enable simulation of tens of thousands of users accessing your website concurrently. Free low level load tests for 1-50 simulated users; higher levels have monthly fees.

Pylot - Open source tool by Corey Goldberg for generating concurrent http loads. Define test cases in an XML file - specify requests - url, method, body/payload, etc - and verifications. Verification is by matching content to regular expressions and with HTTP status codes. HTTP and HTTPS (SSL) support. Monitor and execute test suites from GUI (wxPython), and adjust load, number of agents, request intervals, ramp-up time, test duration. Real-time stats and error reporting are displayed.

AppLoader - Load testing app from NRG Global for web and other applications accessible from a Windows desktop; generates load from the end user's perspective. Protocol independent and supports a wide variety of enterprise class applications. Integrates with their Chroniker monitoring suite so results of load testing can be correlated with system behavior as load is increased. Runs from Win platforms.

fwptt - Open source tool by Bogdan Damian for load testing web applications. Capabilities include handling of Ajax. Generates tests in C#. For Windows platforms

JCrawler - An open-source stress-testing tool for web apps; includes crawling/exploratory features. User can give JCrawler a set of starting URLs and it will begin crawling from that point onwards, going through any URLs it can find on its way and generating load on the web application. Load parameters (hits/sec) are configurable via central XML file; fires up as many threads as needed to keep load constant; includes self-testing unit tests. Handles http redirects and cookies; platform independent.

vPerformer - Performance and load testing tool from Verisium Inc. to assess the performance and scalability of web apps. Use recorded scripts or customized scripts using Javascript. Targeted platforms: Windows

Curl-Loader - Open-source tool written in 'C', simulating application load and behavior of tens of thousand HTTP/HTTPS and FTP/FTPS clients, each with its own source IP-address. In contrast to other tools curl-loader is using real C-written client protocol stacks, namely, HTTP and FTP stacks of libcurl and TLS/SSL of openssl. Activities of each virtual client are logged and collected statistics include information about: resolving, connection establishment, sending of requests, receiving responses, headers and data received/sent, errors from network, TLS/SSL and application (HTTP, FTP) level events and errors.

Gomez Web Load Testing - An on-demand load testing service from Gomez.com/Compuware. Utilizes Gomez?s Active Network providing on-demand active monitoring from 150+ enterprise-grade servers running in world-class, high-bandwidth data centers around the globe, and Gomez?s Active Last Mile which provides on-demand active monitoring from 150,000+ real, consumer-grade desktops in 168+ countries.

StressTester - Enterprise load and performance testing tool for web applications from Reflective Solutions Ltd. Advanced user journey modeling, scalable load, system resources monitors and results analysis. No scripting required. Suitable for any Web, JMS, IP or SQL Application. OS independent.

The Grinder - A Java-based load-testing framework freely available under a BSD-style open-source license. Orchestrate activities of a test script in many processes across many machines, using a graphical console application. Test scripts make use of client code embodied in Java plug-ins. Most users do not write plug-ins themselves, instead using one of the supplied plug-ins. Comes with a mature plug-in for testing HTTP services, as well as a tool which allows HTTP scripts to be automatically recorded.

Proxy Sniffer - Web load and stress testing tool from from Ingenieurb?ro David Fischer GmbH Capabilities include: HTTP/S Web Session Recorder that can be used with any web browser; recordings can then be used to automatically create optimized Java-based load test programs; automatic protection from "false positive" results by examining actual web page content; detailed Error Analysis using saved error snapshots; real-time statistics.

Testing Master - Load test tool from Novosoft, capabilities include IP spoofing, multiple simultaneous test cases and website testing features for sites with dynamic content and secure HTTPS pages.

JKool Online - Performance measurement and monitoring service from Nastel Inc. for web-based J2EE and SOA applications; start and stop live data monitoring whenever needed; drills down to JMS, JDBC, method calls, servlets and sessions with simple one-click option to view live session details; built-in support for jBoss, WebLogic and IBM WebSphere Application Server.

Funkload - Free web load testing, stress testing, and functional testing tool by Benoit Delbosc written in Python and distributed as free software under the GNU GPL. Emulates a web browser (single-threaded) using webunit; https support; produces detailed reports in ReST, HTML, or PDF.

Avalanche - Load-testing appliance from Spirent Communications, designed to stress-test security, network, and Web application infrastructures by generating large quantities of user and network traffic. Simulates as many as two million concurrently-connected users with unique IP addresses, emulates multiple Web browsers, supports Web Services testing Supports HTTP 1.0/1.1, SSL, FTP, RTSP/ RTP, MS Win Media, SMTP, POP3, DNS, Telnet, and Video on Demand over Multicast protocols.

Loadea - Stress testing tool runs on WinXP; free evaluation version for two virtual users. Capture module provides a development environment, utilizes C# scripting and XML based data. Control module defines, schedules, and deploys tests, defines number of virtual users, etc. Analysis module analyzes results and provides reporting capabilities.

LoadManager - Load, Stress, Stability and Performance testing tool from Alvicom. Runs on all platforms supported by Eclipse and Java.

QEngine Performance Tester - Automated testing tool from Zoho Corp. for performance testing (load and stress testing) of web applications and web services; J2EE, .NET, AJAX, PHP, Ruby on Rails, SOAP Web Services etc. Supports multiple browsers on Linux and Windows.

NeoLoad - Load testing tool from Neotys for web and mobile apps, with clear and intuitive graphical interface, no scripting/fast learning curve (Javascript for most advanced cases). Can design complex scenarios to handle real world applications. Clear and comprehensive reports and test results. Supports latest technologies, including AJAX, FLEX, GWT, Java Serialization, and more. Load test from the private lab and from the cloud. Compatibility with mobile applications. Multi-platform.

LoadComplete - Automated web load test tool from SmartBear Software.

QTest - Web load testing tool from Quotium Technologies SA. Capabilities include: cookies managed natively, making the script modelling phase shorter; HTML and XML parser, allowing display and retrieval of any element from a HTML page or an XML flux in test scripts; option of developing custom monitors using supplied APIs; more.

Test Perspective Load Test - Do-it-yourself load testing service from Keynote Systems for Web applications. Utilizes Keynote's load-generating infrastructure on the Internet; conduct realistic outside-the-firewall load and stress tests to validate performance of entire Web application infrastructure.

SiteTester1 - Load test tool from Pilot Software Ltd. Allows definition of requests, jobs, procedures and tests, HTTP1.0/1.1 compatible requests, POST/GET methods, cookies, running in multi-threaded or single-threaded mode, generates various reports in HTML format, keeps and reads XML formatted files for test definitions and test logs. Requires JDK1.2 or higher.

httperf - Web server performance/benchmarking tool from HP Research Labs. Provides a flexible facility for generating various HTTP workloads and measuring server performance. Focus is not on implementing one particular benchmark but on providing a robust, high-performance, extensible tool. Available free as source code.

WAPT - Web load and stress testing tool from SoftLogica LLC. Handles dynamic content and HTTPS/SSL; easy to use; support for redirects and all types of proxies; clear reports and graphs.

http://www.microsoft.com/visualstudio/en-us/products/2010-editions/test-professional/overview Visual Studio Test Professional 2010 - A suite of testing tools for Web applications and services that are integrated into the Microsoft Visual Studio environment. These enable testers to author, execute, and manage tests and related work items all from within Visual Studio. Includes Lab Management capabilities.

OpenLoad - Affordable and completely web-based load testing tool from OpenDemand; knowledge of scripting languages not required - web-based recorder can capture and translate any user action from any website or web application. Generate up to 1000 simultaneous users with minimum hardware.

Apache JMeter - Java desktop application from the Apache Software Foundation designed to load test functional behavior and measure performance. Originally designed for testing Web Applications but has since expanded to other test functions; may be used to test performance both on static and dynamic resources (files, Servlets, Perl scripts, Java Objects, Data Bases and Queries, FTP Servers and more). Can be used to simulate a heavy load on a server, network or object to test its strength or to analyze overall performance under different load types; can make a graphical analysis of performance or test server/script/object behavior under heavy concurrent load.

TestMaker - Free open source utility maintained by PushToTest.com and Frank Cohen, for performance, scalability, and functional testing of Web application. Features test authoring of Web applications, Rich Internet Applications (RIA) using Ajax, Service Oriented Architecture, and Business Process Management environments. Integrates Selenium, soapUI, TestGen4Web, and HTMLUnit to make test development faster/easier. Repurposes tests from these tools into load and performance tests, functional tests, and business service monitors with no coding. Repurposes unit tests written in Java, Jython, JRuby, Groovy, and other dynamic scripting languages. Runs on any platform.

Siege - Open source stress/regression test and benchmark utility; supports basic authentication, cookies, HTTP and HTTPS protocols. Enables testing a web server with a configurable number of concurrent simulated users. Stress a single URL with a specified number of simulated users or stress multiple URL's simultaneously. Reports total number of transactions, elapsed time, bytes transferred, response time, transaction rate, concurrency, and server response. Developed by Jeffrey Fulmer, modeled in part after Lincoln Stein's torture.pl, but allows stressing many URLs simultaneously. Distributed under terms of the GPL; written in C; for UNIX and related platforms.

JBlitz - Load, performance and functional test tool from Clan Productions. Runs multiple concurrent virtual users.to simulate heavy load. Validates each response using plain text or regular expression searches, or by calling out to your own custom code. Full Java API. For testing and 'bullet-proofing' server side software - ASPs, JSPs, servlets, EJBs, Perl / PHP / C / C++ / CGI scripts etc.

WebServer Stress Tool - Web stress test tool from Paessler AG handles proxies, passwords, user agents, cookies, AAL.

Web Polygraph - Freely available benchmarking tool for caching proxies, origin server accelerators, L4/7 switches, and other Web intermediaries. Other features: for high-performance HTTP clients and servers, realistic traffic generation and content simulation, ready-to-use standard workloads, powerful domain-specific configuration language, and portable open-source implementation. C++ source available; binaries avail for Windows.

OpenSTA - 'Open System Testing Architecture' is a free, open source web load/stress testing application, licensed under the Gnu GPL. Utilizes a distributed software architecture based on CORBA. OpenSTA binaries available for Windows.

PureLoad - Java-based multi-platform performance testing and analysis tool from PureLoad Software. Includes 'Comparer' and 'Recorder' capabilities, dynamic input data, scenario editor/debugger, load generation for single or distributed sources.

ApacheBench - Perl API for Apache benchmarking and regression testing. Intended as foundation for a complete benchmarking and regression testing suite for transaction-based mod_perl sites. For stress-testing server while verifying correct HTTP responses. Based on the Apache 1.3.12 ab code. Available via CPAN as .tar.gz file.

Torture - Bare-bones Perl script by Lincoln Stein for testing web server speed and responsiveness and test stability and reliability of a particular Web server. Can send large amounts of random data to a server to measure speed and response time of servers, CGI scripts, etc.

WebSpray - Low-cost load testing tool from CAI Networks; includes link testing capabilities; can simulate up to 1,000 clients from a single IP address; also supports multiple IP addresses with or without aliases. For Windows.

eValid LoadTest - Web test tool from Software Research, Inc that uses a 'Test Enabled Web Browser' test engine that provides browser based 100% client side quality checking, dynamic testing, content validation, page performance tuning, and webserver loading and capacity analysis.

Load Testing by Web Performance - Load test tool emphasizing ease-of-use, from Web Performance Inc. Supports all browsers and web servers; records and allows viewing of exact bytes flowing between browser and server; no scripting required. Modem simulation allows each virtual user to be bandwidth limited. Can automatically handle variations in session-specific items such as cookies, usernames, passwords, IP addresses, and any other parameter to simulate multiple virtual users. For Windows, Linux, Solaris, most UNIX variants.

Optima Quality Studio - A collection of load testing, capture/playback, and related tools from Technovations for performance testing of web sites. Modules include WebCorder, Load Director, Report Generator, Batch, Manager, and others. WebSizer load testing module supports authentication, SSL, cookies, redirects. Recorded scripts can be modified manually. For Windows.

FORECAST - Load testing tool from Facilita Software for web, client-server, network, and database systems. Capabilities include proprietary, Java, or C++ scripting; windows browser or network recording/playback. Supports binary encoded data such as Adobe Flex/AMF, Serialised Java objects etc.SSL; supports NTLM, kerberos, proxies, authentication, redirects, certificates, cookies, caching, bandwidth limitation and page validation. Virtual user data can be parameterized. Works with a wide variety of platforms.

http-Load - Free load test application from ACME Labs to generate web server loads, from ACME Software. Handles HTTP and HTTPS; for Unix.

QALoad - Tool from Microfocus (formerly from Compuware) for load/stress testing of web, database, and character-based systems. Supports HTTP, SSL, SOAP, XML, Streaming Media. Works with a variety of databases, middleware, ERP.

IBM Rational Performance Tester - Performance testing tool from IBM/Rational; has optional extensions to Seibel applications and SAP Solutions. Supports Windows, Linux and z/OS as distributed controller agents; provides high-level and detailed views of tests.

SilkPerformer - Enterprise-class load-testing tool from Microfocus (formerly from Borland, formerly from Segue). Can simulate thousands of users working with multiple protocols and computing environments. Allows prediction of behavior of e-business environment before it is deployed, regardless of size and complexity.

Radview's WebLoad - Load testing tool from Radview Software. Capabilities include over 75 Performance Metrics; can view global or detailed account of transaction successes/failures on individual Virtual Client level, assisting in capturing intermittent errors; allows comparing of running test vs. past test metrics. Test scripting via visual tool or Javascript. Wizard for automating non-GUI-based services testing; DoS security testing.

Loadrunner - HP's (formerly Mercury's) load/stress testing tool for web and other applications; supports a wide variety of application environments, platforms, and databases. Large suite of network/app/server monitors to enable performance measurement of each tier/server/component and tracing of bottlenecks.

Java Test Tools

Arquillian - Arquillian from JBoss enables you to test Java business logic in a remote or embedded container. Alternatively, it can deploy an archive to the container so the test can interact as a remote client. No longer does writing a test involve system administration tasks, custom scripts, copy-paste Maven configuration, full builds, test classpath mayhem, looking up resources manually or reliance on coarse-grained, black-box testing. The goal is to provide a simple test harness that abstracts away all container lifecycle and deployment from the test logic so developers can easily produce a broad range of integration tests for their enterprise Java applications. Arquillian can either execute a test case inside the container, in which case the test class is deployed by Arquillian along with the code under test, or hold back the test class so it can act as a remote client to the deployed code. All the developer has to do is write the test logic.

RTI - Java performance analysis tool from OC Systems Inc. helps quickly find and resolve complex performance problems. RTI delivers lightweight deep diagnostics for distributed Java applications in production and test environments. Monitor transaction performance end-to-end from client across network, web and application tiers ? deep dive to method level. RTI integrates with LoadRunner, JMeter and soapUI. Targeted to JBoss, Tomcat, Linux, Windows.

Yourkit Java Profiler - Java profiling tool from Yourkit; CPU and memory hot spots; memory leak detection; memory distribution reports;on-demand profiling; utilizes all of the advanced Java 5/6/7 profiling features; runs on most platforms.

VisualVM - A free visual tool, originally from Sun, to monitor and troubleshoot Java applications. Runs on Sun JDK 6, but is able to monitor applications running on JDK 1.4 and higher. Utilizes various available technologies like jvmstat, JMX, the Serviceability Agent (SA), and the Attach API to get data and uses minimal overhead on monitored applications. Capabilities include: automatically detects and lists locally and remotely running Java applications; monitor application performance and memory consumption; profile application performance or analyze memory allocation; is able to save application configuration and runtime environment together with all taken thread dumps, heap dumps and profiler snaphots into a single application snapshot which can be later processed offline.

LAPSE - Lightweight Analysis for Program Security in Eclipse. Designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web apps. Targets parameter manipulation, header manipulation, cookie poisoning, command-line parameters, SQL injections, cross-site scripting, HTTP splitting, path traversal vulnerabilities Developed by Benjamin Livshits as part of the Griffin Software Security Project. Not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process.

Checkmarx - Code security analysis tool from Checkmarx; capabilitites include hundreds of out of the box security checks, checks for architectural flaws, coding practice enforcement. Runs on Windows against Java or any other programming language code.

Window Licker - An open source framework for the test-driven development of Java systems through the GUI. Provides a high-level API for controlling and making assertions about graphical user interfaces: for Swing and Dynamic HTML (aka "AJAX") including GWT. Deals with the asynchronous nature of GUI and AJAX programming so the tests don't have to; Controls the GUI by sending native mouse and keyboard events; Handles different keyboard layouts; Produces high quality error messages to help you easily diagnose test failures; Easily extensible to cope with new user interface components

Cobertura - Free Java tool to identify which parts of a Java program are lacking test coverage and calculate % coverage; based on jcoverage. Instruments already-compiled Java bytecode; execute from ant or from the command line; generate reports in HTML or XML; shows % of lines and branches covered for each class, each package, and for the overall project. Shows McCabe cyclomatic code complexity of each class, and average cyclomatic code complexity for each package, and for the overall product. Can sort HTML results by class name, percent of lines covered, percent of branches covered, etc. and sort in ascending or descending order.

JProfiler - Java profiling tool from ej-Technologies GmbH. Check for performance bottlenecks, memory leaks and threading issues.

Parallel-junit - Open source small library extensions for JUnit. Extends the junit.framework.TestSuite class by running tests in parallel, allowing more efficient test execution. Because TestResult and TestListener aren't designed to run tests in parallel, this implementation coordinates the worker threads and reorder event callbacks so that the TestResult object receives them in an orderly manner. In addition, output to System.out and System.err are also serialized to avoid screen clutter.

EMMA - Open-source toolkit, written in pure Java, for measuring and reporting Java code coverage. Targets support for large-scale enterprise software development while keeping individual developer's work fast and iterative. Can instrument classes for coverage either offline or on the fly (using an instrumenting application classloader); supported coverage types: class, method, line, basic block; can detect when a single source code line is covered only partially; coverage stats are aggregated at method, class, package, and "all classes" levels. Reports support drill-down, to user-controlled detail depth; HTML reports support source code linking. Does not require access to the source code; can instrument individual .class files or entire .jars (in place, if desired). Runtime overhead of added instrumentation is small (5-20%); memory overhead is a few hundred bytes per Java class.

PMD - Open source static analyzer scans java source for problems. Capabilities include scanning for: Empty try/catch/finally/switch statements; Dead code - unused local variables, parameters and private methods; Suboptimal code - wasteful string/stringBuffer usage; Overcomplicated expressions - unnecessary if statements, for loops that could be while loops; Duplicate code - copied/pasted code - could indicate copied/pasted bugs.

Hammurapi - Code review tool for Java (and other languages with latest version). Utilizes a rules engine to infer violations in source code. Doesn't fail on source files with errors, or if some inspectors throw exceptions. Parts of tool can be independently extended or replaced. Can review sources in multiple programming languages, perform cross-language inspections, and generate a consolidated report. Eclipse plugin.

TestNG - A testing framework inspired from JUnit and NUnit and developed by Cedric Beust; supports JDK 5 Annotations, data-driven testing (with @DataProvider), parameters, distribution of tests on slave machines, plug-ins (Eclipse, IDEA, Maven, etc); embeds BeanShell for further flexibility; default JDK functions for runtime and logging (no dependencies); can run tests in arbitrarily big thread pools with various policies available.

Concordian - An open source testing framework for Java developed by David Peterson. Utilizes requirements in plain English using paragraphs, tables and proper punctuation in HTML. Developers instrument the concrete examples in each specification with commands (e.g. "set", "execute", "assertEquals") that allow test scenarios to be checked against the system to be tested. The instrumentation is invisible to a browser, but is processed by a Java fixture class that accompanies the specification. The fixture is also a JUnit test case. Results are exported with the usual green and red indicating successes and failures. Site includes info re similarities and diffs from Fitnesse.

DBUnit - Open source JUnit extension (also usable with Ant) targeted for database-driven projects that, among other things, puts a database into a known state between test runs. Enables avoidance of problems that can occur when one test case corrupts the database and causes subsequent tests to fail or exacerbate the damage. Has the ability to export and import database data to and from XML datasets. Can work with very large datasets when used in streaming mode, and can help verify that database data matches expected sets of values.

StrutsTestCase - Open source Unit extension of the standard JUnit TestCase class that provides facilities for testing code based on the Struts framework, including validation methods. Provides both a Mock Object approach and a Cactus approach to actually run the Struts ActionServlet, allowing testing of Struts code with or without a running servlet engine. Uses the ActionServlet controller to test code, enabling testing of the implementation of Action objects, as well as mappings, form beans, and forwards declarations.

DDSteps - A JUnit extension for building data driven test cases. Enables user to parameterize test cases, and run them more than once using different data. Uses external test data in Excel which is injected into test cases using standard JavaBeans properties. Test cases run once for each row of data, so adding new tests is just a matter of adding a row of data in Excel.

StrutsTestCase for JUnit - Open source extension of the standard JUnit TestCase class that provides facilities for testing code based on the Struts framework. Provides both a Mock Object approach and a Cactus approach to actually run the Struts ActionServlet, allowing testing Struts code with or without a running servlet engine. Because it uses the ActionServlet controller to test code, can test not only the implementation of Action objects, but also mappings, form beans, and forwards declarations. Since it already provides validation methods, it's quick and easy to write unit test cases.

JavaNCSS - A free Source Measurement Suite for Java by Clemens Lee. A simple command line utility which collects various source code metrics for Java. The metrics are collected globally, for each class and/or for each function.

Open Source Profilers for Java - Listing of about 25 open source code profilers for Java from 2006 from the Manageability.org web site.

SofCheck Inspector - Tool from SofCheck Inc. for analysis of Java for logic flaws and vulnerabilities. Explores all possible paths in byte code and detects flaws and vulnerabilities in areas such as: array index out of bounds, buffer overflows, race conditions, null pointer dereference, dead code, etc. Provides 100% path coverage and can report on values required for 100% unit test coverage. Patented precondition, postcondition and presumption reporting can help detect Malware code insertion.

CodePro - Suite of Java tools from Instantiations Inc. CodePro AnalytixX is an Eclipse-based Java software testing tool and includes features like code audit, metrics, automated unit tests, and more. CodePro Profiler, an Eclipse-based Java profiling tool enables inspection of a running application for performance bottlenecks, detect memory leaks and solve thread concurrency problems. EclipsePro Test automatically generates JUnit tests and includes an editor and analysis tool, provides test cases/results in tabular layout; mouse over failing case and Editor shows the failure message. WindowTester Pro for Swing or SWT UI's enables recording of GUI tests; watches actions and generates test cases automatically; customize the generated Java tests as needed. Provides a rich GUI Test Library, hiding complexities and threading issues of GUI test execution; test cases are based on the JUnit standard

Squish for Java - Automated Java GUI testing tool for Java Swing, AWT, SWT and RCP/Eclipse applications. Record or create/modify scripts using Tcl, Python, JavaScript. Automatic identification of GUI objects of the AUT; inspect AUT's objects, properties and methods on run-time using the Squish Spy. Can be run via a GUI front-end or via command line tools. Can execute tests in a debugger allowing setting breakpoints and stepping through test scripts.

Klocwork - Static analysis technology for Java, C, C++, C#; analyzes defects & security vulnerabilities, architecture & header file anomalies, metrics. Developers can run Klocwork in Eclipse or various other IDE's. Users can select scope of reporting as needed by selecting software component, defect type, and defect state/status.

Coverity Prevent - Tool from Coverity Inc. for analysis of Java source code for security issues. Explores all possible paths in source code and detects security vulnerabilities and defects in multiple areas: memory leaks, memory corruption, and illegal pointer accesses, buffer overruns, format string errors and SQL injections vulnerabilities, multi-threaded programming concurrency errors, etc.

GUIDancer - Eclipse-based tool from Bredex GmbH for automated testing of Java/Swing GUI's, Tests are specified, not programmed - no code or script is produced. Test specification is initially separate from the AUT, allowing test creation before the software is fully functional or available. Specification occurs interactively; components and actions are selected from menus, or by working with the AUT in an advanced "observation mode". Test results and errors viewable in a results view, can be saved as html or xml file.

CMTJava - Complexity measurement tool from Verifysoft GmbH. Includes McCabe cyclomatic complexity, lines-of-code metrics, Halstead metrics, maintainability index.

JavaCov - A J2SE/J2EE Coverage testing tool from Alvicom; specializes in testing to MC/DC (Modified Condition/Decision Coverage) depth. Capabilities include: Eclipse plugin; report generation into HTML and XML; Apache Ant integration and support for test automation.

Jameleon - Open source automated testing harness for acceptance-level and integration testing, written in Java. Separates applications into features and allows those features to be tied together independently, in XML, creating self-documenting automated test cases. These test-cases can then be data-driven and executed against different environments. Easily extensible via plug-ins; includes support for web applications and database testing.

Agitator - Automated java unit testing tool from Agitar Software. Creates instances of classes being exercised, calling each method with selected, dynamically created sets of input data, and analyzing results. Stores all information in XML files; works with Eclipse and a variety of IDEs. Also available are: automated JUnit generation, code-rule enforcement, and more.

PMD - Open source tool scans Java code for potential bugs, dead code, duplicate code, etc. - works with a variety of configurable and modifiable rulesets. Integrates with a wide variety of IDE's.

JLint - Open source static analysis tool will check Java code and find bugs, inconsistencies and synchronization problems by doing data flow analysis and building the lock graph.

Lint4j - A static Java source and byte code analyzer that detects locking and threading issues, performance and scalability problems, and checks complex contracts such as Java serialization by performing type, data flow, and lock graph analysis. Eclipse, Ant and Maven plugins available.

FindBugs - Open source static analysis tool to inspect Java bytecode for occurrences of bug patterns, such as difficult language features, misunderstood API methods, misunderstood invariants when code is modified during maintenance, garden variety mistakes such as typos, use of the wrong boolean, etc. Can report false warnings, generally less than 50%.

CheckStyle - Open source tool for checking code layout issues, class design problems, duplicate code, bug patterns, and much more.

Java Development Tools - Java coverage, metrics, profiler, and clone detection tools from Semantic Designs.

AppPerfect Test Studio - Suite of testing, tuning, and monitoring products for java development from AppPerfect Corp. Includes: Unit Tester, Code Analyzer, Java/J2EE Profiler and other modules.

Cactus - A simple open-source test framework for unit testing server-side java code (Servlets, EJBs, Tag Libs, Filters, etc.). Intent is to allow fine-grained continuous testing of all files making up an application: source code but also meta-data files (such as deployment descriptors, etc) through an in-container approach. It uses JUnit and extends it. Typically use within your IDE, or from the command line, using Ant. From Apache Software Foundation.

JUnitPerf - Allows performance testing to be dynamically added to existing JUnit tests. Enables quick composition of a performance test suite, which can then be run automatically and independent of other JUnit tests. Intended for use where there are performance/scalability requirements that need re-checking while refactoring code. By Mike Clark/Clarkware Consulting, licensed under the BSD License.

Abbot Java GUI Test Framework - Testing framework by Timothy Wall provides automated event generation and validation of Java GUI components, improving upon the very basic functions provided by the java.awt.Robot class. (Abbot = "A Better 'Bot'). The framework may be invoked directly from Java code or accessed without programming through the use of scripts via 'Costello', a script editor/recorder. Suitable for use both by developers for unit tests and QA for functional testing. Free - available under the GNU Lesser General Public License

JUnit - Framework to write repeatable java unit tests - a regression testing framework written by Erich Gamma and Kent Beck. For use by developers implementing unit tests in Java. Free Open Source Software released under the IBM Public License and hosted on SourceForge. Site includes a large collection of extensions and documentation.

jfcUnit - Framework for developing automated testing of Java Swing-based applications at the UI layer (as opposed to testing at lower layers, for which JUnit may be sufficient). Provides recording and playback capabilities. Also available as plugins for JBuilder and Eclipse. Free Open Source Software from SourceForge site.

JBench - Freeware Java benchmarking framework to compare algorithms, virtual machines, etc. for speed. Available as binary distribution (including documentation), source distribution, or jar file.

Clover - Code coverage tool for Java from Atlassian. Fully integrated plugin for Eclipse, IntelliJ IDEA and projects using Apache ANT and Maven. View coverage data in XML, HTML, PDF, or via a Swing GUI. Tracks cyclomatic complexity. TestOptimization automatically prioritises just the tests needed to cover the particular changes made.

Structure101 - Java source code visualization tool from Headway Software. Lets user understand, measure, and control architecture, design, composition, and dependencies of code base. Analyzes byte code and shows all dependencies, at all levels and between all levels; method, class, package, application. Measures code complexity using a measurement framework called XS. For Windows, Linux and Mac OS X.

Java Tool Suite from Man Machine Systems - Includes JStyle, a Java source analyzer to generate code comments and metrics such as inheritance depth, Cyclomatic Number, Halstead Measures, etc; JPretty reformats Java code according to specified options; JCover test coverage analyzer; JVerify Java class/API testing tool uses an invasive testing model allowing access to internals of Java objects from within a test script and utilizes a proprietary OO scripting language; JMSAssert, a tool and technique for writing reliable software; JEvolve, an intelligent Java code evolution analyzer that automatically analyzes multiple versions of a Java program and shows how various classes have evolved across versions; can 'reason' about selective need for regression testing Java classes; JBrowser class browser; JSynTest, a syntax testing tool that automatically builds a Java-based test data generator.

JProbe Suite - Collection of Java debugging tools from Quest Software; includes JProbe Profiler and JProbe Memory Debugger for finding performance bottlenecks and memory leaks, LProbe Coverage code coverage tool, and JProbe Threadalyzer for finding deadlocks, stalls, and race conditions. JProfiler freeware version available.

Krakatau Professional for Java - Software metrics tool from Power Software includes more than 70 OO, procedural, complexity, and size metrics related to reusability, maintainability, testability, and clarity. Includes Cyclomatic Complexity, Enhanced Cyclomatic Complexity, Halstead Software Science metrics, LOC metrics and MOOD metrics. Has online advisor for quality improvement.

Jtest - ParaSoft's Jtest is an integrated, automatic unit testing and standards compliance tool for Java. It automatically generates and executes JUnit tests and checks whether code follows 400 coding standards and can automatically correct for many.

DevPartner Java Edition - Debugging/productivity tool from Microfocus (formerly from Compuware, formerly from NuMega) to detect and diagnose Java bugs and memory and performance problems; thread and event analysis, coverage analysis. Integrates with several Java IDE's.

TCAT for Java - Part of Software Research's TestWorks suite of test tools; code coverage analyzer and code analysis for Java; written in Java.

Open Source code analyzers listing - A listing of open source Java code analysis tools written in Java.

Open Source code coverage tools listing - A listing of open source Java code coverage tools written in Java.

Open Source Java test tools listing - A listing of open source tools and frameworks for Java testing, written in Java.

Open Source web test tools listing - A listing of open source web test tools and frameworks written in Java.

(Note: some other tools in these listings also handle testing, management, or load testing of java applets, servlets, and applications, or are planning to add such capabilities. Check listed web sites for current information.)

Link Checking Tools

LinkTiger - Hosted link checker; free and $pro versions. Capabilities include e-mail alerts, dashboard, reporting; canned reports or create rich custom reports. Scans PDF, CSS, Flash and MS Office files, flash-animation.

HiSoftware Link Validation Utility - Link validation tool; available as part of the AccVerify Product Line from HiSoftware Inc.

ChangeAgent - Link checking and repair tool from Expandable Language. Identifies orphan files and broken links when browsing files; employs a simple, familiar interface for managing files; previews files when fixing broken links and before orphan removal; updates links to moved and renamed files; fixes broken links with an easy, 3-click process; provides multiple-level undo/redo for all operations; replaces links but does not reformat or restructure HTML code. For Windows.

Link Checker Pro - Link check tool from KyoSoft; can also produce a graphical site map of entire web site. Handles HTTP, HTTPS, and FTP protocols; several report formats available. For Windows platforms.

Web Link Validator - Link checker from REL Software checks links for accuracy and availability, finds broken links or paths and links with syntactic errors. Export to text, HTML, CSV, RTF, Excel. Freeware 'REL Link Checker Lite' version available for small sites. For Windows.

Site Audit - Low-cost on-the-web link-checking service from Blossom Software.

Xenu's Link Sleuth - Freeware link checker by Tilman Hausherr; supports SSL websites; partial testing of ftp and gopher sites; detects and reports redirected URL; Site Map; for Windows.

Linkalarm - Low cost on-the-web link checker from Link Alarm Inc.; free trial period available. Automatically-scheduled reporting by e-mail.

Alert Linkrunner - Link check tool from Viable Software Alternatives; evaluation version available. For Windows.

InfoLink - Link checker program from BiggByte Software; can be automatically scheduled; includes FTP link checking; multiple page list and site list capabilities; customizable reports; changed-link checking; results can be exported to database. For Windows. Discontinued, but old versions still available as freeware.

LinkScan - Electronic Software Publishing Co.'s link checker/site mapping tool; capabilities include automated retesting of problem links, randomized order checking; can check for bad links due to specified problems such as server-not-found, unauthorized-access, doc-not-found, relocations, timeouts. Includes capabilities for central management of large multiple intranet/internet sites. Results stored in database, allowing for customizable queries and reports. Validates hyperlinks for all major protocols; HTML syntax error checking. For all UNIX flavors, Windows, Mac.

CyberSpyder Link Test - Shareware link checker by Aman Software; capabilities include specified URL exclusions, ID/Password entries, test resumption at interruption point, page size analysis, 'what's new' reporting. For Windows.

HTML Validators

Total Validator - Java-based desktop tool validates HTML / XHTML / WCAG / Section 508 / Links / Spelling; free and pro versions. HTML validation against the W3C Specifications; accessibility validation against the WCAG (1.0 and 2.0) and US Section 508 standard; checks each page for broken links; spell checks (English, French, Italian, Spanish, German), 1-click validation using the Firefox/SeaMonkey extension, choice of browser identification to use when checking websites. Works on a wide varity of operating systems.

RealValidator - Shareware HTML validator based on SGML parser by Liam Quinn. Unicode-enabled, supports documents in virtually any language; supports XHTML 1.0, HTML 4.01, HTML 4.0, HTML 3.2, HTML 3.0, and HTML 2.0 ; extensible - add proprietary HTML DTDs or change the existing ones; fetches external DTDs by HTTP and caches them for faster validation; HTML 3.2 and HTML 4.0 references included as HTML Help. For Windows.

HTML Validator - Firefox add-on, open source by Marc Gueury. The validation is done on your local machine inside Firefox and Mozilla. Error count of an HTML page is seen as an icon in the status bar when browsing. Can validate the HTML sent by the server or the HTML in the memory (after Ajax execution). Error details available when viewing the HTML source of the page. Based on Tidy and OpenSP (SGML Parser). Available in 17 languages and for Windows and other platforms.

CSE 3310 HTML Validator - HTML syntax checker for Windows from AI Internet Solutions. Supports wide variety of standards; accessibility (508) checking; uppercase/lowercase converter. Free 'lite' version. For Windows.

(Note: Many of the products listed in the Web Site Management Tools section include HTML validation capabilities.)

Free On-the-Web HTML Validators and Link Checkers

Site Check - Type in one URL and automatically run HTML and stylesheet validators, accessibility assessment, link check, load time check, and more. Organizes access to a collection of free online web test tools. Site of UITest.com/Jens Meiert. Also lists a wide variety of free online web analysis/development/test tools.

CynthiaSays Portal - Free web content accessibility/508 validation tool; checks one page at a time. Designed to identify errors in content related to Section 508 standards and/or the WCAG guidelines. The HiSoftware CynthiaSays portal is a joint Education and Outreach project of HiSoftware, ICDRI, and the Internet Society Disability and Special Needs Chapter.

Link Valet - Online link checker, includes capability for hilighting links modified since a specified date.

WDG HTML Validator - Web Design Group's validator - latest HTML version support, flexible input methods, user-friendly error messages.

Web Page 'Purifier' - Free on-the-web HTML checker by DJ Delorie allows viewing a page 'purified' to HTML 2.0, HTML 3.2, HTML 4.0, or WebTV 1.1. standards.

W3C HTML Validation Service - HTML validation site run by the WWW Consortium (the folks who set web standards); handles one URL at a time; Can choose from among 30 character encoding types, and multiple HTML and XHTML document types/versions.

W3C CSS Validation Service - CSS validation site run by the WWW Consortium (the folks who set web standards); handles one URI at a time; or upload file or validate by direct input.

W3C Link Checker - Link checking service run by the WWW Consortium (the folks who set web standards); configurable. Handles one URL at a time. PERL source also available for download.

Weblint Gateway - Site with online HTML validator; somewhat configurable. Site provided by San Francisco State University.

Web Page Backward Compatibility Viewer - On-the-web HTML checker by DJ Delorie; will serve a web page to you with various selectable tags switched on or off; very large selection of browser types; to check how various browsers or versions might see a page.

PERL and C Programs for Validating and Checking

W3C Link Checker - Link checker PERL source code, via the WWW Consortium (the folks who set web standards); configurable. Handles one URL at a time. See 'Download' link.

HTML TIDY - Free utility available from SourceForget.net; originally by Dave Raggett. For automatic fixing of HTML errors, formatting disorganized editing, and finding problem HTML areas. Available as source code or binaries.

Big Brother - Freeware command-line link checker for Unix, Windows, by Francois Pottier. Available as source code; binary available for Linux.

LinkLint - Open source Perl program checks local/remote HTML links. Includes cross referenced and hyperlinked output reports, ability to check password-protected areas, support for all standard server-side image maps, reports of orphan files and files with mismatching case, reports URLs changed since last checked, support of proxy servers for remote URL checking. Distributed under Gnu General Public License. Has not been updated in recent years.

MOMspider - Multi-Owner Maintenance Spider; link checker. PERL script for a web spider for web site maintenance; for UNIX and PERL. Utilizes the HTTP 'HEAD' request instead of the 'GET' request so that it does not require retrieval of the entire html page. This site contains an interesting discussion on the use of META tags. Not updated in recent years.

HTMLchek for awk or perl - Old but still useful HTML 2.0 or 3.0 validator programs for AWK or PERL by H. Churchyard; site has much documentation and related info. Not updated in recent years.

Cross-browser testing tools/services

Browsera - Online cross-browser testing service from Browsera LLC - select the browsers to include in testing and URLs. Can automatically crawl site to get screenshots of all pages. Can handle sites requiring login. Also reports on Javascript errors encountered.

Spoon - App emulation service that runs cloud-based applications from any windows desktop with no installs; requires installation of Spoon browser plugin. Provides free versions of Firefox, Chrome, Opera and Safari with multiple versions of each. IE is not included. Paid $ Spoon Server and Spoon Studio also available.

BrowserBox - Appliance for cross browser testing by Jacob Rask, a virtual machine that runs in VirtualBox, VMWare, or from live boot CD or USB memory stick. Has multiple browsers and versions, including some mobile browsers, but does not include IE8 or 9. Based on Linux distribution openSUSE, but don't need to have Linux installed or have Linux experience.

Utilu - Free utilities from Utilu that contain collections of standalone versions of IE or Firefox browsers; multiple versions can be used at the same time. Utilu Mozilla Firefox Collection contains more then ten versions of Firefox (English versions only); also includes the Firebug and Web Developer add-ons and Flash player; configurable to install only specified desired version. Supports upgrading - no need to uninstall a previous version before installing a newer version. Utilu IE Collection contains more than ten versions of Internet Explorer (English versions only); configurable to install only specified desired version; original version number is shown correcty in the User Agent string; version number also shown in window title; includes the IE Developer Toolbar.

Adobe Browser Lab - Cross-browser testing online service from Adobe; free until 2012. Preview web pages across multiple browsers and operating systems, navigate links, and use diagnostic tools to optimize websites efficiently. Also supports Firebug extension for Firefox.

Browsercam - Online cross-browser testing service from Compuware/Gomez. Screen capture service lets you submit single or multiple URL's, choose the browsers and operating systems you want to see, and screen captures of your webpage are loaded in the different browsers and operating systems you selected.

Browsershots - Free online cross browser/OS comparison testing. Choose browser OS, browser, and versions of interest and submit URL and site responds with a collection of screen shots.

Multi-Browser Viewer - Cross browser testing solution from TWD Solutions Pte Ltd. includes a wide variety of standalone virtualized browsers, multiple standalone mobile browsers or simulators, wide variety of screen capture image browsers; Screenshot comparison function (?Onion Skin? or ?Side-by-Side?); available in multiple languages.

BrowserSeal - Multi browser website screenshot tool - capture an image of web site under multiple browsers Supports multiple versions of IE, Firefox, Google Chrome, Opera, Safari. Optimized for speed. Comes with standalone versions of all major browsers to verify site layout issues and troubleshoot functionality issues. The Automated edition adds the ability to automatically capture multiple URLs without user intervention, and command-line control enabling use in automation scripts. For Windows platforms.

IETester - Free browser compatibility checker from Core Services for Internet Explorer Versions from 5.5 to 10. WebBrowser that allows you to have the rendering and javascript engines of IE10 preview, IE9, IE8, IE7 IE 6 and IE5.5 on Windows 7, Vista and XP, as well as the installed IE in the same process.

IE Netrenderer - Free site allows you to check how a website is rendered by Internet Explorer 9, 8, 7, 6 or 5.5, as seen from a high speed datacenter located in Germany. Just type in a URL. Able to process a large number of capturing jobs in parallel and in realtime, making for fast service. From Geotek IT.

Litmus - Cross-browser testing service from Salted Services Inc.; oriented to html email testing; but also does 'landing page' cross browser testing for 8 different web browsers.

Web Functional/Regression Test Tools

Fabasoft app.test - Web test tool from Fabasoft Distribution GmbH; tests are based on patterns to reduce the complexity of HTML and Java applications - no XPath or CSS expressions are stored in the test but meaningful and understandable statements. Patterns for web sites can be designed by using the point-and-click editor as an Eclipse Plugin. Tests can be recorded by using the point-and-click recorder in all supported web browsers (IE, Firefox, Safari) and immediately be replayed in all other browsers without modification. Various Ant-Tasks provide seamless integration into Continuous Integration systems like Hudson. Generates various reports as HTML or PDF; errors documented with screenshots and various dumps. Supports Win, Linux, Mac OS-X; free and premium $ versions available.

Janova - A web-based, automated web testing tool that runs functional tests securely in the cloud. Users configure Janova using project structures of Features (test scripts), Pages and Flows to access their web-based application and define the requirements of the site in English. Features describe how the application is supposed to work; once a feature has been created, a user defines what verification elements are supposed to be on the web page. Includes detailed test results reports.

FuncUnit - Free open source web application testing framework; uses API based on jQuery. Can be downloaded and used standalone or as the part of the full stack JavaScript framework - JavaScriptMVC. Supports all modern browsers on PC, Mac, and Linux; tests can also be run via Selenium. Also available is FuncIT an IDE for FuncUnit; and Syn which creates synthetic events and performs default event behavior - can simulate user typing, clicking, dragging the mouse and enables complex JavaScript functional testing and also works with most modern browsers on PC, Mac, and Linux.

qUnit - JavaScript test suite used by the jQuery project to test its code and plugins but is capable of testing any generic JavaScript code. Similar to other unit testing frameworks like JUnit, but utilizes JavaScript features and helps with testing code in the browser, such as with its stop/start facilities for testing asynchronous code.

EnvJS - Open source simulated browser environment (headless browser) written in javascript, originally developed by John Resig.

Twist - Integrated Development Environment (IDE) from Thoughtworks Studios for agile functional testing of web apps and Java Swing apps. Uses an enhanced version of Selenium ("TwistSelenium") to drive web app testing, which has many fixes on top of Selenium, and adds functionality such as a recorder. Capabilities include: Express requirements directly as test specifications in English (or any UTF-8 supported language) using your domain language; map test specifications to the underlying code and navigate between them with IDE-support; out-of-the-box support for Test Driven Development. Java-based - runs on Windows, Linux and Mac OS X.

QF-Test - QF-Test/web from Quality First Software is a cross-platform software tool for cross-browser test automation of web-based applications (HTML, AJAX, ExtJS, GWT, RAP, Qooxdoo, RichFaces) and Java apps. Includes small-scale test management capabilities, capture/replay mechanism, intuitive user interface and extensive documentation, reliable component recognition and can handle complex and custom GUI objects, integrated test debugger and customizable reporting.

Fabasoft app.test - Web test tool from Fabasoft Distribution GmbH; includes recorder, multi-browser support, dialog and script error handler, errors are documented with a screenshot and various dumps, various reports are generated and provided as HTML or PDF; more. Available as free and $ versions.

Tester Bench for jQuery - Web test automation tool from Mouseclick Technologies. Script language is javascript with jQuery. Additional language extensions simplify control of the mouse, keyboard, and test assertions, using jQuery syntax. Mouse and keyboard events are realistically emulated by the OS agent (not synthetic). Easy installation; unattended execution; extensible syntax. Targeted platforms/browsers: Windows XP, Vista, Win7, cross browser.

Cloud Testing Service - Web testing utilizing cloud capabilities, from Cloud Testing Limited. Involves first recording web functionality via browser and Selenium IDE, uploading scripts to the Cloud Testing website; then scripts run using real browsers on real operating systems in the testing cloud; results are available as screenshots, HTML & component diagnostics. Test can be re-run whenever needed or as scheduled. Cross Browser feature enables test runs in multiple browsers (IE, Firefox, Safari, Opera, Google Chrome) and comparing appearance/results side-by-side. Cloud load testing and site monitoring services also available.

Tellurium - Tellurium is an open-source UI module-based automated testing framework for web applications. The UI module is a collection of UI elements you group together. Usually, the UI module represents a composite UI object in the format of nested basic UI elements. The UI module makes it possible to build UI elements' locators at run time. The Tellurium UI Model Plugin (TrUMP) is a Firefox plugin to automatically create UI modules for users. The framework does Object to Locator Mapping (OLM) automatically at run time so that you can define UI objects simply by their attributes. Tellurium uses the Group Locating Concept (GLC) to exploit information inside a collection of UI components to help finding their locators. A new Domain Specific Language (DSL) for web testing is defined. A powerful feature of Tellurium is that you can use UI templates to represent many identical UI elements or dynamic size of different UI elements at runtime, which are extremely useful to test dynamic web such as a data grid. Another feature is the capability to composite UI objects into a Tellurium widget object. You can pack Tellurium widgets as a jar file and then use a Tellurium widget just like a single tellurium UI object once you include the jar file. The Tellurium Core is written in Groovy and Java. Tellurium Engine and Trump are implemented using JavaScript and jQuery. Test cases can be written in Java, Groovy, or pure DSL. Detailed User Guide, Frequent Asked Questions, and illustrative examples are provided.

SlimDog - A simple script based web application testing tool. It is based on httpunit. The tool offers a wide range of commands to work with forms, check the content of tables and navigation between HTML pages. Rather than writing long JUnit testcases or crucial XML files the users can write simple text scripts. Each line of the script file will contain one command which is a testnode. All commands inside one file will be processed as a testcase. The syntax of every command is simple and easy to learn. Several scripts can be combined to a testsuite. The results are written either to the console, a file or as a HTML page.

SymbioTeam - Test automation tool from SymbioWare, Inc. An integrated software testing, site monitoring, and load testing solution for Web and Windows desktop applications. Support for AJAX, Flash, and rich Web applications. JavaScript advanced support extends a wide set of predefined functions; built-in Selenium support. For Windows platforms; available as an online service or installed locally.

TestOptimal - Functional/regression and load/stress testing automation platform for web applications and Java applications, from TestOptimal. Utilizes Model-Based Testing (MBT) and Mathematical Optimization techniques; test case generation and execution directly from the application model. TestOptimal is a web application itself; can be integrated with JUnit and run inside Eclipse or NetBeans. Application modeling with graphs - state chart XML (SCXML) with drag and drop user interface running on standard browser; many test sequencers (test generation) to meet different testing needs, test automation with Java or mScript (XML-based scripting), statistical analysis on test executions and virtual (concurrent) users for load testing. With its WebService interface, can be integrated with other testing tools like Quality Center and QTP. Multiple browser support. For Windows, linux and unix.

WebUI Test Studio - WebUI Test Studio QA Edition from Telerik is a point-and-click automated testing tool that helps users build tests in minutes. The tool requires 0 lines of code. Instead, users can use smart wizards to visually highlight an element and automatically generate verifications. Test maintenance is faster thanks to the employed web element abstraction techniques. This allows for an element to be updated once and have the change applied to all tests. Furthermore, you can record and play your tests on IE, FF, and Safari at the same time. Also available is WebUI Test Studio Developer Edition, a Visual Studio plug-in for recording cross-browser functional tests.

Windmill - Open source web testing framework; in Python. Capabilities include full featured recorder - one click and the IDE writes the tests; DOM Explorer; assertion explorer - quickly generate action validating the state of application; test saving and playback; real time performance and output information; handles SSL; supports Python, JavaScript, Ruby; supports most browsers. Requires Python.

Ranorex Automation Framework - A Windows GUI test automation framework from Ranorex GmbH for testing many different application types including Web 2.0 applications, Win32, MFC, Delphi, WPF, Flash/Flex, .NET, Silverlght, and Java (SWT), and includes support for 3rd party controls like Infragistics, DevExpress, QT, etc.; Avoids proprietary scripting languages and instead enables use of the functionalities of programming languages like Python or C# as a base and expand on it with its GUI automation functionality. The Ranorex Spy tool allows users to explore/analyze host or web applications. Ranorex object repositories and repository browser enables separation of test automation code/recordings from RanoreXPath identification information. The IDE includes test project management, integration of all Ranorex tools (Recorder, Repository, Spy), intuitive code editor, code completion, debugging, and watch monitor.

Celerity - An open source JRuby wrapper around HtmlUnit. Runs as a headless Java browser - speeding up web testing; Java threads enable running tests in parallel; can run in background. JavaScript support. Provides simple API for programmatic navigation thu web apps. Intended to be API compatible with Watir. For any platform.

Celurity - Culurity is an open source tool by Alexander Lang that integrates Cucumber and Celerity; can run Celerity from within Cucumber which allows testing of the full stack of Rails or other web applications from database to in-browser JavaScript; run an application in any Ruby (like MRI 1.8.6) while Celerity runs in JRuby so you can still use gems/plugins that would not work with JRuby; enables reuse of existing Webrat-Style step definitions

Webrat - Ruby-based utility to enable quick development of web app acceptance tests. Open source by Bryan Helmkamp. Leverages the DOM to run tests similarly to in-browser test tools like Watir or Selenium without the associated performance hit and browser dependency. Best for web apps that do NOT utilize Javascript; apps using Javascript in-browser tools may be more appropriate.

Capybara - Open source tool from Jonas Nicklas available as a Ruby gem; aims to simplify the process of integration testing Rack applications, such as Rails, Sinatra or Merb. It is inspired by and aims to replace Webrat as a DSL for interacting with a web application. It is agnostic about the driver running tests and as of comes bundled with support for rack-test, Culerity, Celerity and Selenium support built in. Env.js support is available as the capybara-envjs gem.

Steam - An open source tool from Sven Fuchs and Clemens Kofler providing headless integration testing tool driving HtmlUnit to enable testing JavaScript-driven web sites. It is similar to Culerity which drives Celerity (which also drives HtmlUnit). Steam?s advantages over plain Webrat is that it can test your Javascript and CSS.

CubicTest - An open source graphical Eclipse plug-in for writing functional web tests in Selenium and Watir. Makes web tests faster and easier to write, and provides abstractions to make tests more robust and reusable. Tests are stored in XML, directly mapped from the CubicTest domain model to XML via XStream. Tests can at any time be exported to Selenium Core tables (a popular test format) or Watir test cases. Supports recording; maven.

Mechanize - Open source Ruby library for automating interaction with websites; automatically stores and sends cookies, follows redirects, can follow links, and submit forms. Form fields can be populated and submitted. Also keeps track of the sites visited. It is a Ruby version of Andy Lester's Perl 'Mechanize' Note: does not handle javascript.

Automation Anywhere - Tool from Tethys Solutions using 'SMART' Automation Technology offers over 180+ powerful actions for web automation. Works with any website, including complex websites using java, javascript, AJAX, Flash or iFrames. Agent-less remote deployment allows automated task to be run over various machines on the network. An advanced Web Recorder ensures accurate re-runs taking into account website changes. Also includes an editor with Point & Click wizards to automate tasks in minutes. includes link checking.

StoryTestIQ - StoryTestIQ (STIQ) is a test framework used to create Automated Acceptance Tests. It's a mashup of Selenium and FitNesse: its "wiki-ized" Selenium with widgets and features that make it easier to write and organize Selenium tests.

Watij - Web Application Testing in Java, an open source pure Java API. Based on the simplicity of the Watir open source web test framework and enhanced by the capabilities of Java; automates functional testing of web apps through a real browser. Provides a BeanShell Desktop console; For MS IE on Windows.

TestMaker - Free open source utility maintained by PushToTest.com and Frank Cohen, for functional testing as well as performance and scalability testing. Features test authoring of Web applications, Rich Internet Applications (RIA) using Ajax/Flex/Flash, Service Oriented Architecture, and Business Process Management environments. Enables integration of Selenium, soapUI, TestGen4Web, and HTMLUnit, Bluenog and Icefaces to make test development faster/easier. Repurposes tests from these tools into tests, and business service monitors with no coding. Repurposes unit tests written in Java, Jython, JRuby, Groovy, and other dynamic scripting languages. Built-in Root Cause Analysis and Correlation using Glassbox and Dynatrace monitoring services. Runs on any platform.

AutoMate - Automation platform from Network Automation, includes capability to simulates GUI activity via the browser.Inc with robust automated testing capabilities. Capabilities include support for HTTPS; Microsoft Excel Integration; a test run Event Database, native Terminal Emulation support. Tasks can be developed via drag-and-drop without writing code. Runs on Windows platforms.

Automation Anywhere - Functional test automation tool from Tethys Solutions, LLC, includes web test automation capabilities - includes a web recorder that understands web controls; web page data extraction capabilities. For Win platforms

iMacros for Firefox - Free Firefox add-on to record and automate web interactions. Can use variables inside the macros, and import data from CSV files. Includes user agent switcher, PDF download and Flash, ad and image blocking functions. The recorded macros can be combined and controlled with Javascript, so complex tasks can be scripted. The EXTRACT command enables reading of data from a website and exporting it to CSV files. Full Unicode support and works with all languages including multi-byte languages such as Chinese. STOPWATCH command enables capturing of web page response times

Avignon Acceptance Testing System - Open source acceptance test system that allows writing of executable tests in a language that the user can define. It uses XML to define the syntax of the language but, if the user chooses to extend the language, allows the semantics of the tests to be user-defined. Includes modules for testing web applications through either IE or FireFox, and modules for testing Swing and .NET WinForm applications also..

Sahi - Free open-source web test tool, written in java and javascript, from Narayan Raman/Tyto Software; capabilities include an Accessor Viewer for identifying html elements for scripting, editable scripts (javascript), simple APIs, ant support for playback of suites of tests, multi threaded playback, HTTP and HTTPS support, AJAX support, logging/reports, suites can run in multiple threads thus reducing the test execution time.

Fitnesse - A lightweight, open-source framework that makes it easy for software teams to collaboratively define Acceptance Tests -- web pages containing simple tables of data inputs and expected outputs, and run those tests and see the results. The tables are expressed in the form of a wiki; the Fitnesse wiki enables easy creation and editing of the Wiki/Fitnesse pages. FitNesse is a web server.

WebFT - Web-centric functional testing solution from Radview, supports both established and emerging web technologies. Provides a visual environment for creating Agendas (scripts) that include test recording, editing, debugging, verification and reporting features.

Floyd - A Java library for automated testing of web applications; provides full control of standard web browsers such as Firefox and MSIE. Interaction with the browser and any loaded web pages is achieved via calls to Floyd's Java API. Has two main components: a normal browser embedded into the web application and controlled via its public interface, and an embedded servlet container/web server. Can be used with any unit test library.

Imprimatur - Free web functional testing tool by Tony Locke, written in Java as a command-line application. Tests are described in a simple XML file; along with standard GET, POST and DELETE methods, handles HTTP authentication and file uploads. Responses can be validated using regular expressions.

WET - Open source web testing tool that drives MSIE directly; from Qantom Software Pvt. Ltd. Has many features like multiple parameter based object identification for more reliable object recognition, support for XML Based Object Repository and more. Scripting in Ruby; written in Ruby.

SOASTA Concerto - A suite of visual tools for automated web functional and load testing from SOASTA, Inc. Available as services on the web. Drag and drop visual interface that also allows access to underlying message complexity. Task-specific visual editors support creation of targets, messages, test cases, and test compositions. Works with Firefox and MSIE, Win and OSX.

Regression Tester - Web test tool from Info-Pack.com allows testing of functionality of any page or form Reports are fully customizable.

Yawet - Visual web test tool from InforMatrix GmbH enables graphical creation of web app tests. Create, run and debug functional and regression tests for web applications. Can verify HTML, XML, and PDF' ability to do report generation, reusable step libraires and parameterization. Freeware; download jar file and start by double-click or with command javaw -jar yawet.jar

vTest - Web functional and regression test tool from Verisium Inc. Includes record and playback capabilities and scripting utilizing JavaScript. For Windows platforms.

SWExplorerAutomation - Low cost web tool from Webius creates an automation API for any Web application which uses HTML and DHTML and works with MSIE. The Web application becomes programmatically accessible from any .NET language. The SWExplorerAutomation API provides access to Web application controls and content. The API is generated using SWExplorerAutomation Visual Designer, which helps create programmable objects from Web page content. Features include script recording and VB/C# code generation.

LISA Test - Automated web application testing tool from iTKO, Inc. No test coding or scripting. Can invoke and verifies functionality at every layer of an application - from dynamic web UIs, to web services, ESB/JMS messaging layers, EJB servers, Java objects, databases, file systems, legacy objects and much more.

Squish for Web - Cross platform automated testing framework from Froglogic GmbH for HTML-based Web and Web 2.0/Ajax applications running in any of several browsers. Record or create/modify scripts using Tcl, Python, JavaScript. Automatic identification of GUI objects of the AUT; inspect AUT's objects, properties and methods on run-time using the Squish Spy. Can be run via a GUI front-end or via command line tools. Can execute tests in a debugger allowing setting breakpoints and stepping through test scripts.

Funkload - Free web functional testing and load testing tool written by Benoit Delbosc in Python and distributed as free software under the GNU GPL. Emulates a web browser (single-threaded) using webunit; https support; produces detailed reports in ReST, HTML, or PDF. Functional tests are pure Python scripts using the pyUnit framework.

WebCorder - Free GUI web testing tool from Crimson Solutions, developed in VB. Designed for end users who are doing web based software testing, as a simple tool to record test scenarios, and play them back and generate log files. The user may also check for text or images on the screen or save screenshots.

Watir - 'Web Application Testing in Ruby', a free open-source family of web automation libraries in Ruby. The libraries support IE on Windows, Firefox on Windows, Mac and Linux, Safari on Mac, Chrome on Windows and Flash testing with Firefox. Note: Firewatir (targeting Firefox) is now merged with Watir. For a listing of additional tools that are available to extend some capabilities - see the Watir site and also Alternative Tools for Web Testing' page at the OpenQA site for more info.

WatiN - 'Web Application Testing in .Net', a free open-source tool, drives MSIE browser and checks results. Uses C#. Automates all major HTML elements, find elements by multiple attributes, supports AJAX website testing, supports frames (cross domain) and iframes, supports popup dialogs like alert, confirm, login etc.,supports HTML dialogs (modal and modeless), and has a basic (extensible) logging mechanism Also available is a WatiN Test Recorder

Selenium - Free open-source tool set, originally from Thoughtworks. Consists of multiple related tools/projects including: * Selenium IDE, a Firefox add-on for record/playback tests in Firefox 2+; can be used to generate code to run tests with Selenium Remote Control.
* Selenium Remote Control, a client/server system enabling control of web browsers locally or on other computers, using almost any programming language and testing framework.
* Selenium WebDriver, for driving a browser natively either locally or on remote machines. Works with most browsers and OS's.
* Selenium Grid, which enables use of Selenium Remote Control to run tests on many servers simultaneously, reducing time needed to test multiple browsers or OS's.

Selenium Grid - An open source web functional testing tool that can transparently distribute your tests on multiple machines to enable running tests in parallel, cutting down the time required for running in-browser test suites. This enables speed-up of in-browser web testing. Selenium tests interact with a 'Selenium Hub' instead of Selenium Remote Control. The Hub allocates Selenium Remote Controls to each test. The Hub is also in charge of routing the Selenium requests from the tests to the appropriate Remote Control as well as keeping track of testing sessions.

WebDriver - Open source alternative to the initial Selenium approach for driving browsers; has been integrated into the Selenium 2.x project. Instead of being a JavaScript application running within the browser, WebDriver uses whichever mechanism is most appropriate to control the browser. For Firefox, it's implemented as an extension; for IE, it utilizes IE's Automation controls. This alternative mechanism of controlling the browser allows working around the JavaScript security model browser restrictions. Addtionally, where automation through the browser isn't enough, WebDriver can interact with the Operating System - such as in simulating typing at the OS level in Windows. WebDriver has been integrated into the Selenium project.

PesterCat - Low cost web functional testing tool from PesterCat LLC. Features include recording and playback of HTTP web requests, XML format for saved scripts, HTTP response validations, perform backend database validations or call procedures, use variables and variable setters to make scripts dynamic, automate test scripts with Ant tasks to run scripts and generate reports. Requires Java JRE; for Linux, Mac OSX, and Windows.

IeUnit - IeUnit is an open-source simple framework to test logical behaviors of web pages, released under IBM's Common Public License. It helps users to create, organize and execute functional unit tests. Includes a test runner with GUI interface. Implemented in JavaScript for the Windows XP platform with Internet Explorer.

QEngine - Automated testing tool from Zoho Corp. for functional testing of web applications and web services. For Linux anx Windows. Records and plays in IE, Mozilla, and Firefox browsers.

AppPerfect DevSuite - Suite of testing, tuning, and monitoring products from AppPerfect Corp. that includes a web functional testing module. Records browser interaction by element instead of screen co-ordinates. Supports handling dynamic content created by JavaScript; supports ASP, JSP, HTML, cookies, SSL. For Windows and MSIE; integrates with a variety of IDE's.

JStudio SiteWalker - Test tool from Jarsch Software Studio allows capture/replay recording; fail definitions can be specified for each step of the automated workflow via JavaScript. JavaScript's Document Object Model enables full access to all document elements. Test data from any database or Excel spreadsheet can be mapped to enter values automatically into HTML form controls. HTML-based test result reports can be generated. Shareware for Windows/MSIE.

Test Complete Enterprise - Automated test tool from AutomatedQA Corp. for testing of web applications as well as Windows, .NET, and Java applications. Includes capabilities for automated functional, unit, regression, manual, data-driven, object-driven, distributed and HTTP load, stress and scalability testing. Requires Windows and MSIE.

actiWate - Java-based Web application testing environment from Actimind Inc. Advanced framework for writing test scripts in Java (similar to open-source frameworks like HttpUnit, HtmlUnit etc. but with extended API), and Test Writing Assistant - Web browser plug-in module to assist the test writing process. Freeware.

WebInject - Open source tool in PERL for automated testing of web applications and services. Can be used to unit test any individual component with an HTTP interface (JSP, ASP, CGI, PHP, servlets, HTML forms, etc.) or it can be used to create a suite of HTTP level functional or regression tests.

jWebUnit - Open source Java framework that facilitates creation of acceptance tests for web applications. Provides a high-level API for navigating a web application combined with a set of assertions to verify the application's correctness including navigation via links, form entry and submission, validation of table contents, and other typical business web application features. Utilizes HttpUnit behind the scenes. The simple navigation methods and ready-to-use assertions allow for more rapid test creation than using only JUnit and HttpUnit.

SimpleTest - Open source unit testing framework which aims to be a complete PHP developer test solution. Includes all of the typical functions that would be expected from JUnit and the PHPUnit ports, but also adds mock objects; has some JWebUnit functionality as well. This includes web page navigation, cookie testing and form submission.

WinTask - Macro recorder from TaskWare, automates repetitive tasks for Web site testing (and standard Windows applications), with its HTML objects recognition. Includes capability to expand scope of macros by editing and adding loops, branching statements, etc. (300+ commands); ensure robustness of scripts with Synchronization commands. Includes a WinTask Scheduler.

Canoo WebTest - Free Java Open Source tool for automatic functional testing of web applications. XML-based test script code is editable with user's preferred XML editor; until recording capabilities are added, scripts have to be developed manually. Can group tests into a testsuite that again can be part of a bigger testsuite. Test results are reported in either plain text or XML format for later presentation via XSLT. Standard reporting XSLT stylesheets included, and can be adapted to any reporting style or requirements.

TestSmith - Functional/Regression test tool from Quality Forge. Includes an Intelligent, HTML/DOM-Aware and Object Mode Recording Engine, and a Data-Driven, Adaptable and Multi-Threaded Playback Engine. Handles Applets, Flash, Active-X controls, animated bitmaps, etc. Controls are recorded as individual objects independent of screen positions or resolution; playback window/size can be different than in capture. Special validation points, such as bitmap or text matching, can be inserted during a recording, but all recorded items are validated and logged 'on the fly'. Fuzzy matching capabilities. Editable scripts can be recorded in SmithSript language or in Java, C++ or C++/MFC.

TestAgent - Capture/playback tool for user acceptance testing from Strenuus, LLC. Key features besides capture/playback include automatically detecting and capturing standard and custom content errors. Reports information needed to troubleshoot problems. Enables 'Persistent Acceptance Testing' that activates tests each time a web application is used.

MITS.GUI - Unique test automation tool from Omsphere LLC; has an intelligent state machine engine that makes real-time decisions for navigating through the GUI portion of an application. It can test thousands of test scenarios without use of any scripts. Allows creation of completely new test scenarios without ever having performed that test before, all without changing tool, testware architecture (object names, screen names, etc), or logic associated with the engine. Testers enter test data into a spreadsheet used to populate objects that appear for the particular test scenario defined.

Badboy - Tool from Bradley Software to aid in building and testing dynamic web based applications. Combines sophisticated capture/replay ability with performance testing and regression features. Free for most uses; source code available.

SAMIE - Free tool designed for QA engineers - 'Simple Automated Module For Internet Explorer'. Perl module that allows a user to automate use of IE via Perl scripts; Written in ActivePerl, allowing inheritance of all Perl functionality including regular expressions, Perl dbi database access, many Perl cpan library functions. Uses IE's built in COM object which provides a reference to the DOM for each browser window or frame. Easy development and maintenance - no need to keep track of GUI maps for each window. For Windows.

PAMIE - Free open-source 'Python Automated Module For Internet Explorer' Allows control of an instance of MSIE and access to it's methods though OLE automation . Utilizes Collections, Methods, Events and Properties exposed by the DHTML Object Model.

PureTest - Free tool from Minq Software AB, includes an HTTP Recorder and Web Crawler. Create scenarios using the point and click interface. Includes a scenario debugger including single step, break points and response introspection. Supports HTTPS/SSL, dynamic Web applications, data driven scenarios, and parsing of response codes or parsing page content for expected or unexpected strings. Includes a Task API for building custom test tasks. The Web Crawler is useful for verifying consistency of a static web structure, reporting various metrics, broken links and the structure of the crawled web. Multi-platform - written in Java.

Solex - Web application testing tool built as a plug-in for the Eclipse IDE (an open, extensible IDE). Records HTTP messages by acting as a Web proxy; recorded sessions can be saved as XML and reopened later. HTTP requests and responses are fully displayed in order to inspect and customize their content. Allows the attachment of extraction or replacement rules to any HTTP message content, and assertions to responses in order to validate a scenario during its playback.

QA Wizard Pro - Automated functional test tool for web, windows, and java applications from Seapine Software. Includes a next-generation scripting language, 'smart matching', a global application repository, data-driven testing support, validation check points, and built-in debugging, batch file support, a real-time status tool, and remote execution support.

HttpUnit - Open source Java program for accessing web sites without a browser, from SourceForge.net/Open Source Development Network, designed and implemented by Russell Gold. Ideally suited for automated unit testing of web sites when combined with a Java unit test framework such as JUnit. Emulates the relevant portions of browser behavior, including form submission, basic http authentication, cookies and automatic page redirection, and allows Java test code to examine returned pages as text, an XML DOM, or containers of forms, tables, and links. Includes ServletUnit to test servlets without a servlet container.

iOpus Internet Macros - Macro recorder utility from iOpus Inc. automates repetitious aspects of web site testing. Records any combination of browsing, form filling, clicking, script testing and information gathering; assists user during the recording with visual feedback. Power users can manually edit a recorded macro. A command line interface allows for easy integration with other test software. Works by remote controlling the browser, thus automatically supports advanced features such as SSL, HTTP-Redirects and cookies. Can handle data input from text files, databases, or XML. Can extract web data and save as CSV file or process the data via a script. For Windows and MSIE.

MaxQ - Free open-source web functional testing tool from Tigris.org, written in Java. Works as a proxy server; includes an HTTP proxy recorder to automate test script generation, and a mechanism for playing tests back from the GUI and command line. Jython is used as the scripting language, and JUnit is used as the testing library.

TestDrive-Gold - Test tool from Original Software Group Ltd. utilizes a new approach to recording/playback of web browser scripts. It analyses the underlying intentions of the script and executes it by direct communication with web page elements. IntelliScripting logic removes the reliance on specific browser window sizes, component location and mouse movements for accurate replay, and for easier script maintenance; supports hyperlinks targeted at new instances of browser. Playback can run in background while other tasks are performed on the same machine.

TestPartner - Automated software testing tool from Microfocus (formerly from Compuware) designed specifically to validate Windows, Java, and web-based applications. The 'TestPartner Visual Navigator' can create visual-based tests, or MS VBA can be used for customized scripting.

WebKing - Web site functional, load, and static analysis test suite from ParaSoft. Maps and tests all possible paths through a dynamic site; can enforce over 200 HTML, CSS, JavaScript, 508 compliance, WML and XHTML coding standards or customized standards. Allows creation of rules for automatic monitoring of dynamic page content. Can run load tests based on the tool's analysis of web server log files. For Windows, Linux, Solaris.

eValid - Web functional test tool from Software Research Inc. Browser-centric view simplifies test recording and editing, and replays user activity with accuracy by combining browser-internal data, timers, event counters, and direct DOM access. Can be used for AJAX-based web development methodologies. The built-in test suite management system eV.Manager controls test suite structure, runs tests automatically, records detailed logs and pass/fail statistics, and can handle hundreds of thousands of tests.

Rational Functional Tester - IBM's (formerly Rational's) automated tool for testing of Java, .NET, and web-based applications. Enables data-driven testing, choice of scripting languages and editors. For Windows and Linux.

QuickTest Pro - Functional/regression test tool from HP (formerly Mercury); keyword-driven; includes support for testing Web, Java, ERP, etc.

SilkTest - Functional test tool from Microfocus (formerly from Borland, formerly from Segue) for Web, Java or traditional client/server-based applications. Features include: test creation and customization, test planning and management, direct database access and validation, recovery system for unattended testing, and IDE for developing, editing, compiling, running, and debugging scripts, test plans, etc.

Web Site Security Test Tools

Vega - A GUI-based, multi-platform, free and open source web security scanner from Subgraph Inc. that can be used to find instances of SQL injection, cross-site scripting (XSS), and other vulnerabilities in your web applications. Also includes an intercepting proxy for interactive web application debugging. Vega attack modules are written in Javascript, users can easily modify them or write their own.

Aribisec Web Analyzer - Web based online tool scans for potentially malicious links, analyzes HTML code, and checks server information and various parameters, without exposing the user to malicious content and without revealing your own web session. Can provide a quick and detailed overview of the security state of a web project. Free and paid $ versions.

Golem - Online web site security scanning service; available as one-time scan or periodic scanning service.

Skipfish - Open source active web application security scanner from Michal Zalewski/Google. Prepares interactive sitemap by carrying out a recursive crawl and dictionary-based probes. The map is then annotated with the security check output. The final output report is meant to serve as a foundation for professional web application security assessments. Goals for the tool are stated as: Raw speed; Unique brute-force capabilities: includes utilization of highly customized, hand-picked dictionaries, and a unique auto-learning feature that builds an adaptive, target-specific dictionary based on site content analysis; High quality security checks with an emphasis on well-crafted probes, and on testing for behavioral patterns, rather than signatures; Coverage of more nuanced problems - looks for significant security issues often neglected by other tools - such as caching intent mismatches, mixed content issues, XSSI, third-party scripts, cross-site request forgery, etc; Adaptive scanning for real-world applications - handles complex, mixed technology sites such as recognizing obscure 404 behaviors, unusual parameter passing conventions, redirection patterns, content duplication, etc; Sleek reports with minimal noise.

Seeker - Web security testing app from Quotium Technologies. Runs automatic and adaptive processes to accurately and quickly detect vulnerabilities. Pinpoints and reveals the most at-risk areas of source code and suggests code corrections for immediate implementation. Supports complex web development environments such as AJAX, Adobe Flex & Air, RIA, .Net, J2EE, Webservices, secure exchanges (HTTPS), etc.

WebSecurify - Open source integrated web security testing environment from GNUCITIZEN Information Security Think Tank, for identifying web vulnerabilities by using advanced browser automation, discovery and fuzzing technologies. Designed to perform automated as well as manual vulnerability tests; Automatically detected vulnerabilities include: SQL Injection, local and remote file include, cross-site scripting, cross-site request forgery, information disclosure problems, session security problems, others including all categories in the OWASP TOP 10. Platform components can be extended with the help of add-ons and plugins. so task and business specific customizations can be introduced without cross-platform issues, deployment, internationalization and future support.

Samurai Web Testing Framework - Open source web pen testing framework from Inguardians Inc. includes a live linux environment that has been pre-configured to function as a web pen-testing environment. Includes a variety of open source and free tools web pen testing tools. Includes reconnaissance, mapping, discovery, and exploitation tools, and a pre-configured wiki set up to be the central information store during pen testing.

Arachni - Open source web application scanner by Tasos Laskos. Modular, high-performance Ruby framework for helping pen testers and administrators evaluate web app security. Arachni is 'self-training' by learning from the HTTP responses it receives during the audit process - it takes into account the dynamic nature of web applications and can detect changes during scanning.

Tarantula - Open source tool from Relevance Inc. that crawls your Rails application, fuzzing data to see what breaks.

RATS - The Rough Auditing Tool for Security is an open source code security analysis tool developed by Secure Software, which was acquired by Fortify Software/HP. Scans C, C++, Perl, PHP and Python source code and flags common security related programming errors such as buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions. Provides a security analyst with a list of potential trouble spots on which to focus, along with describing the problem, its potential severity, and potential remedies. Also performs some basic analysis to try to rule out conditions that are obviously not problems. As the name implies, it provides a rough analysis of source code, and will not find all errors, and will find things that are not errors; can be used as an aid to manual code inspection.

beSTORM - Software security analysis fuzzing tool from Beyond Security; can be used for securing in-house software applications and devices, as well as testing the applications and devices of external vendors. Tries virtually every attack combination, intelligently starting with the most likely scenarios and detects application anomalies which indicate a successful attack. Also available is hosted service WSSA - Website and Web Server Security Auditing. Provides a complete report with the facts and recommendations needed to take corrective action. 15-day free trial.

Zed Attack Proxy (ZAP) - An easy to use free open-source integrated penetration testing tool for finding vulnerabilities in web applications; a fork of the well regarded Paros Proxy. Designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. Includes Intercepting Proxy, Automated scanner, Passive scanner, Brute Force scanner, Spider, Port Scanner, comprehensive help pages, cross platform, requires java 1.6.

Suru - Suru is a Man In The Middle (MITM) proxy tool from SensePost Pty Ltd that sits between the user's browser and the web application. It receives requests made by a the browser and records them. The requests can be modified in any way and replayed. Suru not only catches requests that were made by the user, but also requests that use the IE object, such as rich applications using web services, MSN ads, Google Earth requests, application auto-updates etc. The proxy understands multi part POSTs (MPPs) and XML POSTs (used for web services). Includes a web application fuzzer that provides the ability to fuzz any part of the HTTP request. This includes GET and POST parameters, but can also be extended to Host: fields, Content-length: etc. The analyst can choose to fuzz any point of the HTTP request header or body.

SPIKE Proxy - Free tool from Immunity Inc; looks for application-level vulnerabilities in web applications. It covers the basics, such as SQL Injection and cross-site-scripting, but it's completely open Python infrastructure allows advanced users to customize it for web applications that other tools fall apart on. SPIKE Proxy is available for Linux and Windows. Note: requires a working install of Python and pyOpenSSL on Linux. This is included in the Windows distribution.

Powerfuzzer - Open source automated customizable Web fuzzer; based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. Capable of spidering website and identifying inputs. Capable of identifying common web vulnerabilities (incl. XSS, SQL Injection). Supports https. Written in python. Project leader is Marcin Kozlowski. Commercial version Powerfuzzer Online available as an online service.

Wapiti - Open source vulnerability scanner for web applications. It checks vulnerabilities like XSS, SQL and XPath injections, file inclusions, command execution, LDAP injections, CRLF injections. Uses Python; no SSL support.

nCircle Certified PCI Scan Service - External scan service from nCircle for all PCI Data Security Standard-relevant conditions. Upon completion of the scan, merchants have access to an auto-generated PCI Security Standards Council certified report. The scan report clearly indicates whether the merchant's payment network is secure, in which case the merchant may download the report and submit it to the acquiring bank.

SecPoint Penetrator - Site/network security testing tool from SecPoint ApS, available as penetration testing appliance or as a web-based service. Provides full vulnerability scanning, pen testing and capability to launch real exploits. Can change the IP addresses to scan on the license and can brand reports with your own logo. Scan for both Web and Host vulnerabilities; more than 14.000 remote unique vulnerabilities; including Cross Site Scripting (XSS), SQL Injection, Directory Traversal vulnerabilities, command execution vulnerabilities, information disclosure vulnerabilities, file inclusion vulnerabilities.

Netsparker - Web application security scanner from Mavituna Security with integrated exploitation features to allow users to exploit the identified vulnerabilities and see the real impact of the problem. Capabilities include: false-positive-free; handling of websites that rely on AJAX and Javascript; confirms vulnerabilities by exploiting them in a safe non-destructive manner; specific impact and remediation information is tailored based on details of issue. For Windows.

ZeroDayScan - Free web site security scanning service; capabilities include cross site scripting attacks (XSS), detects hidden directories and backup files, looks for known security vulnerabilities, searches for SQL Injection vulnerabilities, generates free reports, more.

Fortify 360 - Security product from Fortify Software/HP includes vulnerability detection. Integrates static source code analysis, dynamic runtime analysis, and real-time monitoring to identify and accurately prioritize the greatest number of critical security vulnerabilities. Capabilities include the Program Trace Analyzer (PTA) that finds vulnerabilities that become apparent only while an application is running - integrate into a QA test to find vulnerabilities while a functional test is being conducted on an application. Also available is Fortify On Demand, a hosted security testing service.

OWASP Security Testing Tools - Variety of free and open source web security testing tools via the OWASP (Open Web Application Security Project) site. SQLiX is an SQL injection vulnerability test tool that uses multiple techniques - conditional errors injection; blind injection based on integers, strings or statements, MS-SQL verbose error messages ("taggy" method); can identify database version and gather info for MS-Access, MS-SQL, MySQL, Oracle and PostgreSQL. Other security testing tools available include WSFuzzer, WebScarab, Tiger, LAPSE, Pantera, etc.

Retina Web Security Scanner - Vulnerability scanning tool from eEye Inc. for large, complex web sites and web applications. Identifies application vulnerabilities as well as site exposure risk, ranks threat priority, produces graphical, intuitive HTML reports, and indicates site security posture by vulnerabilities and threat level. Also performs an advanced site analysis on site structure, content and configuration to identify inherent exposure to future or emerging threats.

Hailstorm - Automated web security testing tool from Cenzic Inc.; customize and configure tests based on requirements, or use pre-sets for quick assessments. Capabilities include: prioritize vulnerabilities with a quantitative score called HARM; easy-to-use wizard-based interface; 'SmartAttacks' library, updated frequently; comprehensive reports with detailed remediation information and export capabilities; administrator control over user roles, tasks and privileges. Enterprise, Pro, Core, and Starter versions.

GamaSec - Automated online website vulnerability assessment delivers proactive tests to Web Servers, Web-interfaced Systems, and Web-based Applications. Configurable scan intervals/frequency. Supports a wide variety of HTTP Authentication schemes, common HTTP protocol, BASIC, NTLM with abilities to analyze the broadest web technologies; PHP, ASP.NET, ASP, etc.

Wikto - Web server security assessment tool for windows servers, open source, from SensePost. It's three main sections are its Back-End miner, Nikto-like functionality, and Googler to obtain additional directories for use by the other two. Includes ability to export results to CSV file

Nikto Scanner - Open source web server scanner from CIRT.net which performs comprehensive tests against web servers for multiple items, including over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated.

HP WebInspect - WebInspect automated security assessment tool for web applications and services, from HP (Formerly SPI Dynamics). Identifies known and unknown vulnerabilities, includes checks that validate proper web server configuration. Capabilities includes discovery of all XML input parameters and parameter manipulation on each XML field looking for vulnerabilities within the service itself. Requires Windows and MSIE.

AppScan - Tool suite from Rational/IBM (formerly Watchfire) automates web application security testing, produces defect analyses, and offers recommendations for fixing detected security flaws. Assessment module can be used by auditors and compliance officers to conduct comprehensive audits, and to validate compliance with security requirements. Also available as a hosted service.

Acunetix Web Vulnerability Scanner - Web site security testing tool from Acunetix first identifies web servers from a particular IP or IP range. It then crawls entire site, gathering information about every file it finds, and displaying website structure. After this discovery stage, it performs an automatic audit for common security issues. Applications utilizing CGI, PHP, ASP, ASP.NET can all be tested for vulnerabilities such as cross site scripting, SQL injection, CRLF injection, code execution, directory traversal and more. Acunetix WVS also ships with a number of advanced manual penetration testing tools to also ease the manual penetration test phase of a web application. Requires Windows and MSIE.

Defensics Core Internet Test Suite - Security testing tool from Codenomicon Onc. searches and preemptively eliminates security-related flaws from the implementations that create the backbone of the modern Internet and communication between the networked devices. This includes, but is not limited to, routers, switches, firewalls, desktop and server systems, laptops, PDAs, cell phones and other mobile systems, as well as a large number of various embedded systems. Because several protocols from this category are often tightly coupled with the underlying operating system, serious flaws in handling them may easily result in total system compromises.

Perimeter Check - SecurityMetrics 'Perimeter Check' service analyzes external network devices like servers, websites, firewalls, routers, and more for security vulnerabilities which may lead to interrupted service, data theft or system destruction. Includes instructions to help immediately remedy security problems. Can automatically schedule vulnerability assessment of designated IP addresses during low traffic times.

Core Impact Pro - Security testing tool from Core Security Technologies for web apps and other systems. Uses penetration testing techniques to safely identify exposures to critical, emerging threats and trace complex attack paths

C5 Compliance Platform - Security testing appliance from SecureElements Inc. for determining security and compliance status across heterogeneous systems. Identifies security vulnerabilities, finds compliance exposures, evaluates and matches exposures with fixes, provides ready to deploy remediations and enforcement actions, and summarized or detailed views of monitored assets, information security exposures, and compliance risks.

Snort - Open source network intrusion prevention and detection system from Sourcefire Inc.; uses a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. Can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.

SecurityMetrics Appliance - Integrated software and hardware device includes Intrusion Detection and Prevention Systems and Vulnerability Assessment. Operates as a Layer 2 Bridge - no network configuration needed. Automatically downloads latest IDS attack signatures, vulnerability assessment scripts and program enhancements nightly.

Nessus - Vulnerability scanner from Tenable Network Security with high speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of security posture. Nessus scanners can be distributed throughout an entire enterprise, inside DMZs, and across physically separate networks. Free to download and subscriptions for vulnerability updates are free for home users; annual fee for Professional license. Updated continuously. Includes scripting language for writing custom plugins.

Security Center - Security management tool from Tenable Network Security for asset discovery, vulnerability detection, event management and compliance reporting for small and large enterprises. Includes management of vulnerability, compliance, intrusion and log data. Company also provides the Nessus Vulnerability Scanner, and Passive Vulnerability Scanner.

SARA - 'Security Auditor's Research Assistant' Unix-based security analysis tool from Advanced Research Corp. Supports the FBI/SANS Top 20 Consensus; remote self scan and API facilities; plug-in facility for third party apps; SANS/ISTS certified, updated bi-monthly; CVE standards support; based on the SATAN model. Freeware. Also available is 'Tiger Analytical Research Assistant' (TARA), an upgrade to the TAMU 'tiger' program - a set of scripts that scan a Unix system for security problems.

Qualys Free Security Scans - Several free security scan services from Qualys, Inc. including SANS/FBI Top 20 Vulnerabilities Scan, network security scan, and browser checkup tool.

GFiLANguard - Network vulnerability and port scanner, patch management and network auditing tool from GFI Software. Scans using vulnerability check databases based on OVAL and SANS Top 20, providing thousands of vulnerability assessments.

Qualys Guard - Online service that does remote network security assessments; provides proactive 'Managed Vulnerability Assessment', inside and outside the firewall,

Lumension Scan - Stand-alone network-based scanning solution from Lumension Security that performs a comprehensive external scan of all of the devices on your network, including servers, desktop computers, laptops, routers, printers, switches and more; risk-based prioritization of identified threats; continuously updated vulnerability database for orderly remediation; comprehensive reports of scan results

Secure-Me - Automated security test scanning service from Broadbandreports.com for individual machines. Port scans, denial-of-service checks, 45 common web server vulnerability checks, web server requests-per-second benchmark, and a wide variety of other tests. Limited free or full licensed versions available.

SAINT - Security Administrator's Integrated Network Tool - Security testing tool from SAINT Corporation. An updated and enhanced version of the SATAN network security testing tool. Updated regularly; CVE compatible. Includes DoS testing, reports specify severity levels of problems. Single machine or full network scans. Also available is 'WebSAINT' self-guided scanning service, and SAINTbox scanner appliance. Runs on many UNIX flavors.

NMap Network Mapper - Free open source utility for network exploration or security auditing; designed to rapidly scan large networks or single hosts. Uses raw IP packets in novel ways to determine what hosts are available on the network, what services (ports) they are offering, what operating system (and OS version) they are running, what type of packet filters/firewalls are in use, and many other characteristics. Runs on most flavors of UNIX as well as Windows.

NetIQ Security Analyzer - Multi-platform vulnerability scanning and assessment product. Systems are analyzed on demand or at scheduled intervals. Automatic update service allows updating with latest security tests. Includes a Software Developer's Kit to allow custom security test additions. For Windows/Solaris/Linux

Foundstone - Vulnerability management software tools from McAfee/Network Associates can provide comprehensive enterprise vulnerability assessments, remediation information, etc. Available as a hardware appliance, software product, or managed service.

OWASP Security Testing Tools Listing - Listing of commercial, free, and open source security testing tools, source code analyzers, and binary analysis tools via the OWASP (Open Web Application Security Project) site.

Top 125 Security Tools - Listing of 'top 125' network security tools from survey by Gordon Lyon/Insecure.org/Sectools.org. (Includes various types of security tools, not just for testing.)

External Site Monitoring Services

Catchpoint Web Performance Monitoring - Site monitoring service from Catchpoint Systems, Monitors the performance of webpages, APIs, DNS, and FTP from several locations around the world. Provides detailed analysis that assists in quick detection of problems and quick resolution times. Includes support for Selenium transaction scripts.

Alertfox - Real browser website and web application performance monitoring service from iOpus Inc. Supports transaction monitoring of sites that use complex HTML, AJAX, Flash, Flex, and Silverlight. In-depth root cause analysis for trouble-shooting sporadic issues.

iGlass Small Business Web Server Monitoring Service - Web site monitoring service from iGlass Networks.

SiteRay - External site monitoring service from Silktide Ltd. Enterprise tool for automatically testing website accessibility, marketing, usability, spelling, performance, compliance, frequency of updates and more. Test and compare scores between websites, e.g. competitors and peers.

Vantage for Server Performance - Service from Compuware examines applications, servers and databases to proactively identify performance problems. Uses agentless and agent-based monitoring and is for businesses with applications that must meet high service levels. Works with a variety of databases, middleware, ERP.

IntroSpectrum - A hosted performance monitoring system which uses real browsers to provide the most accurate view of web site performance. Hosted in the cloud, so it's platform/OS agnostic. Works with any public website or web application.

IP-label.newtest - An external availability and performance monitoring solution for internet services (websites, streaming, mail servers etc) and business applications based upon an extensive network of measurement points worldwide which provide real-time insight into how internet users experience a website.

Techout - Measure and optimize speed and availability of critical online applications. Website monitoring, business transaction monitoring, REST/SOAP Web Services Monitoring, Cloud Monitoring/Amazon Web Service Monitoring, more. Also available as an iPhone application.

100Pulse - Online Website Monitoring service from HIOX Web Services; free and paid services available. Monitor websites, Port and DNS Servers for availability and performance; free Instant alerts through E-mail, RSS Feed and Google gadget; analyze site's periodic performance through graphs, charts and statistical data; periodical Reports customizable by all users

EZ Web Site Monitoring - Service can keep tabs on your website and competitor websites in one easy report. Monitor uptime, response time monitoring, weekly error checking; track keywords and popularity, and always know when it changes.

Uptime Party - Web server monitoring for small business or personal web sites. Sends message if it's down, and when it's back up. Notifications via email or cell phone. Free for one server. $ for more than one, and monitoring is every 15 or 30 minutes.

Watchmouse - Site monitoring service includes website performance monitoring (checks web servers continuously from over 20 locations worldwide), functionality monitoring (monitor transactions of up to 20 steps/1MB with a single script), periodic vulnerability scanning. (new vulnerabilities added daily, detailed security reports), and external automated load testing service.

SiteUpTime - Basic plan for monitoring one web site is free; others $. Highly configurable service options, multiple monitoring locations around the world; if more than one location detects a connection failure a notification is sent.

Panopta Advanced Server Monitoring - Web site monitoring service and outage management system from Panopta LLC for online businesses and service providers, with the ability to detect outages immediately, provide notifications, and provide a team the right tools to resolve the outage quickly. Checks services every 60 seconds using global monitoring network.

Pingdom - Server, network and website monitoring services from Pingdom AB. Includes current and historical reporting; world-wide network of monitoring servers; checks every 1-60 mins.

Site 24x7 - Monitoring of website uptime & performance from multiple geographical locations; monitor multi-step web applications or e-business transactions; monitor DNS servers & email server round-trip time; instant alerts for any downtime or threshold violations; email/SMS alerts and reports. Also available are free accounts with limited services for personal use.

WebSitePulse - Monitoring service from WebSitePulse. Simultaneous monitoring from up to 20 global stations; alerts sent when web page errors occur, performance thresholds are exceeded or connectivity problems are detected and verified from up to three independent monitoring resources, and when unauthorized content changes are detected. Supports cookies; monitors and verifies file size, MD5 checksum, present or missing text string. Customizable alert escalation schedules, configurable 'Do Not Disturb' times for contacts. Daily, weekly, monthly e-mailed uptime reports.

SiteMorse - External site monitoring services from SiteMorse - runs a periodic full report - clients can request to be notified if there is any change to the sites scores. Enterprise clients have the option of setting such thresholds on any one of over 300 tests.

YMU - Site monitoring service from Dreamcast Systems, Inc. HTTP, HTTPS, customizable map location selection of monitoring source, graphical reports, configurable periodic check intervals.

eXternalTest - Site monitoring service from eXternalTest. Periodically checks servers from different points of the world; view what customers see with screen shots using different browsers, OSs, and screen resolutions.

Site Notifier - Site monitoring service from Transcendigital Ltd.; configurable for various monitoring intervals, multiple notifications.

Global Up Time - HTTP/HTTPS website monitoring service from Global Web Monitor; configurable frequency, alerting, and reporting options; false alarm protection. Server monitoring, website monitoring, network appliance monitoring, business transaction monitoring, port monitoring and port security monitoring.

internetVista - Service from Lyncos remotely monitors web sites and Internet services for availability (http, https, smtp, ftp, pop, nntp, tcp). Notifications sent via email and SMS. Monitoring centers in U.S. and Europe. Free service also available, with limited features.

Host Tracker - Site monitoring service from Host Tracker; monitor an unlimited number of resources, distributed monitoring points, possible monitoring of CGI scripts' operation, keyword presence control, can specify keywords by regular expressions, unlimited number of addresses for server error notifications, historical statistics.

Neustar Webmetrics Monitoring Service - Transactional application monitoring service from Webmetrics/Neustar. Simulates defined web transactions, such as customer logins and purchase order fulfillment, up to every five minutes to verify application availability and performance. A 'Basic Monitoring' service is also available.

Dotcom-Monitor - Web site monitoring and load testing services utilize multiple worldwide locations. Checks content and response times; provides reporting and notifications. Free 'Lifetime Lite' monitoring service available.

Vertain Monitoring Service - Services from Vertain Software include verification that web site is up and running and that users can complete multi-page transactions. Also available: Free service for up to six tests per day.

AlertBot - Monitoring service from InfoGenius, Inc. tests website availability, performance, and alerts webmaster of downtime. Also provides ftp, http, pop3, snmp, https, smtp, ip, and dns server monitoring.

WebSitePulse - Remote web site and server monitoring service with instant alerts and real time reporting. Simulates end-user actions from multiple locations around the globe. Web transaction monitoring available. Free basic service available.

1stMonitor - Site monitoring service notifies when a web site is down or new content has been posted. Easy and simple to use. Email notification. Weekly and monthly reports; instant setup.

SiteTechnician - Service of SiteTechnician LLC, identifies broken links, analyzes accessibility, reports on search engine optimization, monitors page load times and provides eight reports to help manage changes to website content over time.

WatchOur.com - Web site monitoring service from PingALink LLC; remotely monitors websites and other Internet protocol servers for availability and performance issues. Sends detailed error codes via pager, email, ICQ, etc. RFC compliant protocol checks assure valid monitoring. Extensive reporting.

AlertSite - Web site monitoring tools and services from SmartBear Software to ensure website is available and performing optimally. Includes mobile web monitoring capabilities using popular mobile devices such as iPhone, iPad, Blackberry and Android, and can add other devices. Immediate notification of problems via e-mail, pager, cell, or SMS. Comprehensive reporting. Monitoring from multiple locations around the world.

elkMonitor - Service from Elk Fork Technologies for websites and other Internet servers; monitors availability and performance. Utilizing multiple test servers located on various Internet backbones, elkMonitor can alert users when sites or servers are unavailable or performing poorly. Alerts via email, pager or SMS alert.

AlertMeFirst - Service from Commerx Corp. reports on the performance and availability of a web site from customer's perspective; including experience with mail server, proxy server, transaction server, databases, etc. Flexible design allows changes to monitoring profile at any time and payment is required only for services used each day.

PureAgent - Service from Minq Software that monitors response times from the agent to a server, by replaying transactions at specified intervals. This includes static and dynamic web applications as well as other server applications. Capabilities include specifying limited access for certain users (such as historical stats only), encryption of stored scenarios, and viewing/downloading of raw XML definitions of Scenarios/Activities.

Dotcom-Monitor - External website monitoring/alerting/load testing service from Dana Consulting. Monitoring locations worldwide. Supports full-cycle sequential transactions; 'macro recorder' capabilities for setting up monitoring of complex web site processes such as online ordering; monitoring of sites, email and FTP services, DNS and router monitoring; includes a wide variety of online and downloadable reporting tools.

SiteGuardian - Site monitoring solution provides 24x7 monitoring of downtime, user experience, and application problems. Configururable notification method and intervals.

Patrol Express - Service from BMC Software continuously simulates and measures end-to-end customer web site experience. Monitors performance and availability of servers, applications and storage and network devices. Also monitors performance and availability of Web transactions. Compares performance and availability to user-defined goals.

WatchDog - Online website tracking and monitoring services from MyComputer.com geared to small business web sites. Provides uptime and load time reports, downtime alerts, etc. Distributed monitoring from five U.S. sites.

SiteScope - HP's (formerly Mercury's) hosted Web-based monitoring service; agentless monitoring solution designed to ensure the availability and performance of distributed IT infrastructures including servers, operating systems, network devices, network services, applications.

Keynote Application Perspective - Hosted performance and availability monitoring services and root cause diagnostics from Keynote Systems. Utilizes a distributed geographic measurement network for comprehensive end-user coverage. Provides advanced scripting tools with functionality for complex transaction recording and ad-hoc diagnosis.

Web Site Management Tools

(This section includes products that contain: site version control tools, combined utilities/tools, server management and optimization tools, and authoring/publishing/deployment tools that include significant site management or testing capabilities.)

Nuxeo - Open source platform for Enterprise Content Management enabling architects and developers to build, deploy and run the best content-driven applications in an easy way. Nuxeo applications can be configured with no programming experience, and extended using standard Java EE technologies.

Screaming Frog SEO Spider - Desktop application from Screaming Frog Ltd spiders websites? links, images, CSS, script and apps; fetches key onsite page elements for SEO, presents them in tabs by type and allows filtering for common SEO issues, or slice and dice the data as needed by exporting and importing into Excel. View, analyse and filter the information as it?s gathered and updated continuously in the program?s user interface. Allows quick analysis or review of a site from an onsite SEO perspective. Useful for analysing medium to large sites where manually checking every page would be difficult.

Outclip - Outclip from Catchpoint Systems Inc is a tag management system which optimizes the delivery of tags from adservers, widgets, tracking pixles, etc to speed up webpages and mitigate the performance risks associated with these tags. SaaS tool, JavaScript tag on the page required.

SEOToaster - Free & Open Source SEO CMS & Ecommerce CMS. Includes unique features out of the box such as automated 301, automated deep-linking, point & click Java Script based silo building. Easy front-end edition, and administration. Also uniquely scalable with a SEO Samba (http://www.seosamba.com ) subscription where an unlimited number of ?toasted? websites are remote controlled from a central interface. Available in multiple languages.

Radiant CMS - A no-fluff, open source content management system designed for small teams. Features: elegant user interface, flexible templating with layouts, snippets, page parts, and a custom tagging language, extension/plugin system, simple user management and permissions.

Frog CMS - Frog, an open source CMS, was born as phpRadiant in January 2007, and is a PHP version of Radiant CMS. Although the two applications still share a family resemblance, Frog is charting its own development path. It is unique in its simple templating code, and because it uses PHP directly, there is no need to learn yet another scripting language. It requires PHP5, a MySQL database or SQLite 3 with PDO, and a web server (Apache with mod_rewrite is highly recommended). It is distributed under the GNU General Public License version 3. Source is available from Frog?s Google Code project page.

AutoTestBot - Free online service for automated website monitoring and testing. Emails warnings about 404-pages, PHP errors, ASP .NET errors, custom pattern matching (both positive and negative), etc. Can be used to check for such errors as pages with no products if you are running a web shop, or detect pages that you have removed, but forgotten to remove all links to.

4Webcheck - Site monitoring and utilities application from Bibase Software; Checks availability and verifies web pages at the byte level; compare pages on a web site to files on the local computer. Will compare single files, all files in a local folder or multiple sites and folders. Also provides url search engine submission options and includes link checking and other capabilities. For Windows platforms.

BugDigger - Web bug reporting tool from BugsIO Solutions, Inc; works as a plugin for MS IE and Firefox, adds a bug reporting button to browser toolbar. Automatically collects contextual data that may be of use to developers to isolate the bug to a specific area. Capabilities include screenshot of the web page, screenshot annotation editor, current and recently opened URLs on the web site, browser details, and more. Can send bug reports to hosted My BugDigger service or, via API's, to yuour Jira, Bugzilla, Fogbugz, Basecamp, Mantis, etc.

BigEasy CMS - Content management system from Bold Endeavours Group Ltd. Capabilities include: Template management - allows the creation and re-use of html templates; dynamic navigation generation; functionality for working with several languages on the web site, where the information is stored in the same location, regardless of language; forms, search, personalization/registration, discussion forums, sitemaps, etc.

Test Anywhere - Web and application GUI test automation tool from Automation Anywhere. Capabilities include: conversion of test scripts to .exe, Windows Object recorder, web recorder, image recognition, script editor with 385+ commands. For Windows platforms.

Webmaster Toolkit - Collection of 35 free tools and utilities useful to webmasters; includes link checker, page analyzer, ping, color tool, link extractor, etc.

Webriq - Web-based site management and editing tool with drag and drop capabilities, from Webriq, includes multiple language interfaces.

A1 Website Analyzer - Website analyzer and link checker from Microsys, also can check response times, html and CSS validation, track file sizes, check for page title duplication; optimize internal page link structure to maximize SE page rankings.

BrowserCMS - Web content management system from BrowserMedia LLC for creating, managing, and publishing dynamic, information driven websites. Handles traditional text, images, or files, as well as such searchable, dynamic 'content objects' as press releases, job postings, a member locator/business directory, and an events calendar. 100% browser-based content management system is installed on the same web server that hosts website - no software installed on individual desktop machines. Geared to associations, non-profits, government agencies, and corporate websites. Compatible with multiple server OS's and web servers. Related app available as an open source CMS written in Ruby on Rails.

Errorlytics - Site management service/plugin from Errorlytics/Accession Media, LLC helps site managers minimize errors for their users. Keeps track of errors that site visitors come across. Can see what errors have come up, and then set up 'rules' as to where site visitors should be redirected to. For any website developed with Java, PHP, Rails, Drupal or Wordpress.

eValid Site Analysis - Site analysis, mapping, and page tuning tool from Software Research Inc. Checks for broken links and characteristics such as page age, size, existence of specified strings, download times of elements, pinpointing bottlenecks. Reports are generated onscreen, including 3D-SiteMap showing site structure; can be rotated, expanded, zoomed-in, etc.

SortSite - Tool from Electrum Solutions that checks pages against W3C and IETF standards, checks for compliance with accessibility standards; link checker, browser compatibility checker; checks for regulatory compliance, checks site against Google/Yahoo/MSN search guidelines, more.

DeepTrawl - Site management tool from Deep Cognition Ltd. finds dead/slow/invalid links, finds common html flaws, has integrated HTML editor with problem highlighting, finds stale content. Finds slow content based on configurable settings, checks for undesirable user postings, exports to CSV / HTML, more.

Atomic Watch - Site monitoring software from Info-Pack.com;runs as background process on Win machine; no software to install on server. Can check webpage or form for certain strings and report back if not present. Configurable monitoring intervals; various notification options including email notifications, sound alarm, or load a URL. No monthly fees like the server monitoring services.

TruWex - Site management tool from Erigami Ltd. checks accessibility, privacy, quality, web page performance. Utilizes a web interface; available as a managed service and as a redistributable product installed on Windows based servers.

CMS400.net - Web site content management tool from Ektron Inc. Enables non-technical users to add/update web content, create and manage documents. Workflow and user management tools. Support for ASP.NET, ColdFusion, PHP, and JSP development.

WSOP - Website load time testing and optimization tool from SoftLogica LLC; other capabilities include checking for errors and broken links, highlighting of problem elements with a built-in HTML viewer, and support for custom testing scenarios for regular tests. Provides a set of reports, statistics and suggestions to improve website load time and performance.

TrueView - Web management suite from Symphoniq Corp. that can monitor Web application performance from browser to back-end by instrumenting both client and server side of web applications. Can measure page load times and errors directly from users' browsers and automatically detect and diagnose problems inside or outside the datacenter. Trace slowdowns to specific IP addresses, servers, method calls, and SQL queries.

WebWatchBot - Web site monitoring, notification, and analysis tool for web sites and IP Devices, from ExclamationSoft Inc. Capabilities include real-time charting of response times for multiple items, reporting of historical data, comprehensive dashboard view of all monitoring. Monitor web page transactions - execute any monitored item in sequence, handle login and web form posting, run as a windows service or application. Requires Windows, MSIE, SQLServer.

Savvy Content Manager - Content management tool from Savvy Software Inc. Simplified editing process - click on an area of your web site in Savvy's browser-based interface, update the information and then publish to the Web with another click. No coding, no file transfers, no additional software.

CA Introscope - Web performance monitoring tool from CA Technologies; presents data in easy-to-use customizable dashboards which enable deep, intuitive views of interrelation between system components and application infrastructure. Monitors applications as soon as installed; no coding needed. Included 'LeakHunter'identifies potential memory leaks. 'Transaction Tracer' can provide detailed tracing of execution paths and component response times for individual transactions in production systems.

WebCEO - Tool from WebCEO.com includes a site maintenance module. Includes link checker, WYSIWYG editor, FPT/publishing, traffic analysis, and site monitoring capabilities.

RealiTea - Web application management solution from TeaLeaf Technology Inc. that provides detailed visibility into availability and functionality issues to enable efficient problem identification, isolation, and repair. Captures and monitors real user sessions, providing context and correlation data for application failure analysis. Add-on capabilities include a 'Dashboard' to provide real-time, customizable views of success/failure rates for key online business processes and other critical metrics, and 'Real Scripts' automatically generated from recorded user sessions for use in specified other load testing tools.

PROGNOSIS - Comprehensive tool from Integrated Research Ltd. for performance and availability monitoring, network management, and diagnostics; suited to large systems.

CMS Foundation - Web content management system from Open Text Corp includes s offers a modular design of software capabilities, allowing flexible deployment depending on individual customer requirements.

Cuevision Network Monitor - Monitoring tool from Cuevision for monitoring website, server, services, applications, and network; capabilities include notifications via email, net send, and popup, restart apps and services, etc. For Windows.

GFI Network Server Monitor - Server management tool from GFI Software Ltd. checks network and servers for failures and fixes them automatically. Alerts via email, pagers, SMS; automatically reboot servers, restart services, run scripts, etc. Freeware version of GFI Network Server Monitor is also available; includes modules to check HTTP and ICMP/ping for checking availability of HTTP and HTTPS sites.

Web Site Monitoring - Performance Monitoring - Free open-source website performance monitoring and uptime notification application in PERL, from AllScoop; sends email notification if site is slow or down.

ContentStudio - E-catalog management tool from TechniCon Systems with Win Explorer-type interface with drag and drop functionality; eliminates need for programmers and special production staff to maintain catalogs. Legacy-to-Web Tools can "bulk-load" online catalog from legacy product data. Capabilities include defining intra-configuration rules, such as option compatibilities on a single product; spatial relationships between products, etc.

SpinPike - Flexible and scalable content management system from SavvyBox Systems, based on database-driven, template-based dynamically-created content. Installer easily installs system on your server, high-level functions save template coding time; WYSIWYG editor.

Constructioner - Website development software with integrated content management system from Artware Multimedia GmbH. Design/administrate database connected PHP web applications in combination with individual web design. Includes: Ready-to-use Backoffice, Content and Table Management (WYSIWYG-Editor), User Administration, Multilingualism, Dynamic Menu, Message Board, PHP-Code Insertion, Statistical Reports, Database Backup, Search. All can be integrated without writing code. Constructioner Light Edition available as Freeware.

CrownPeak CMS - Content management service from CrownPeak Inc., which hosts the management system application and the client's administrative interfaces and pushes the final assembled pages to client Web servers. Provides complete software developers environment, comprehensive Communications Gateway for inbound and outbound data, and a robust API.

WebLight - HTML validator and link checking tool from Illumit LLC. Free for use on small sites, low cost for large sites. Works on multiple platforms.

Trellian InternetStudio - Suite of web site management utilities from Trellian including site upload/publishing tools, text editor, HTML editor, link checker, site mapper, spell checker, site spider, image handling, HTML encryptor/optimizer, HTML validator, image mapper, e-commerce site designer/generator. For Windows.

Documentum - Enterprise content management product from EMC Corp. - capabilities/support include scalability, security, business process automation, globalization, XML-content-based multi-channel delivery, support for more than 50 document formats, integration with a variety of servers, authoring tools, etc.

Serena Collage - Content management tool from Serena; browser-based, scalable content management platform for content contributors distributed across an organization. Works with content from any platform or application. Enables collaboration, version control, activity tracking, administration, templates, styles, approval workflow, multi-lingual support, more. Runs with a variety of platforms, web servers, and DB servers.

FlexWindow - Tool from Digital Architects B.V., enables users to update their web site via e-mail. Update news flashes, notifications, advertisements, product info, stories, prices, and more. Use any e-mail client capable of producing HTML to format your content or use HTML tags in a plain text e-mail. Easy to install, simply create an account and paste one line of javascript into your pages. Basic accounts are free.

Alchemy Eye - System management tool from Alchemy Lab continuously monitors server availability and performance. Alerts by cell phone, pager, e-mail, etc. Can automatically run external programs, and log events.

Web500 CMS - Web content management and site maintenance solution from Web500. Add-on modules allow capabilities such as WAP, e-commerce, payment processing, customer relationship management, and more.

HTML Rename - Site Migration/Batch processing tool from Expandable Language that enforces file naming conventions (case, length, invalid chars), renaming the files to match the convention, then correcting the links to those files automatically. Eliminates problems encountered when moving files between Windows, Mac, and UNIX systems and publishing to CD-ROM. For Mac or Windows.

IPCheck Server Monitor - Server monitoring tool from Paessler AG. Alerts webmasters if a webserver is not working correctly via sensor types PING, PORT, HTTP, HTTPS, HTTP Transaction, DNS, SMTP, POP3, SNMP, and custom sensors. Notifications can be triggered by downtimes, uptimes, or slow responses. For Win platforms; has a web-based user interface.

Oracle Universal Content Management System - Content management tool formerly from Stellent, now Oracle. Content Server uses a web-based repository, where all content and content types are stored for management, reuse and access. Enables services such as library services, security, conversion services, workflow, personalization, index/search, replication and administration. Other modules provide additional services such as: services for creating, managing and publishing Web content and supporting from one to thousands of Web sites; services for capturing, securing and sharing digital and paper-based documents and reports; and services for collaborative environments and for digital asset and records management.

Rhythmyx Content Manager - Web content management product from Percussion Software; based on native XML and XSL technologies; content development, publishing, version control, and customizable workflow. Manages Web content, documents, digital assets, portals and scanned images.

Broadvision - Suite of content and publishing management tools from Broadvision Inc.; allows a distributed team of non-technical content experts to manage every aspect of site content, including creation, editing, staging, production, and archiving.

HP OpenView Internet Services - Internet services monitoring/management tool from HP; integrates with other OpenView products to provide a variety of management and monitoring services and capabilities. Enables end-user emulation of major business-critical applications as well as a single integrated view of the complete Internet infrastructure. Designed to help IT staff efficiently predict, isolate, diagnose and troubleshoot problem occurrences, anticipate capacity shortfalls, and manage and report on service level agreements.

HTML-Kit - Free, full-featured editor from Chami.com designed to help HTML, XHTML and XML authors to edit, format, lookup help, validate, preview and publish web pages. Uses a highly customizable and extensible integrated development environment while maintaining full control over multiple file types including HTML, XHTML, XML, CSS, XSL, JavaScript, Perl, Python, Ruby, Java, and much more. Finds errors and provides suggestions on how to create standards compliant pages. Includes internal, external, server-side and live preview modes; FTP Workspace for uploading, downloading and online editing of files; and the ability to use hundreds of optional free add-ins through its open plugins interface. GUI support of W3C's HTML Tidy; seamless integration with the CSE HTML Validator. Validate XML documents using its DTD and/or check for well-formedness. Over 400 free plugins available for extending and customizing HTML-Kit. Pro plugins available to paid registered users.

IBM Workplace Web Content Management - IBM's web content management product for Internet, intranet, extranet and portal sites; runs on both Lotus Domino and IBM WebSphere.

WebCheck - Windows application from Peregrine Software that runs in background and periodically checks a site for availability and correctness; searches for keywords; provides notification by displaying a message or sending an e-mail.

WS_FTP Pro - FTP/web publishing tool from Ipswitch; manage, upload, and update websites; automatically resume interrupted transfers; support more than 50 host file systems; drag-and-drop files; for Windows.

A1Monitor - Utility from A1Tech for monitoring availability of web servers. Capabilities include notification by email and automatic reboot of web server. For Windows.

AgentWebRanking - Freeware tool from AADSoft to monitor site's search engine position, improve search engine ranks, submit URL's. Searches top engines for keywords; can specify search depth. Also has keyword count for pages vs competitor's pages; auto or manual submit of URL's to search engines, meta tag creator. Requires MSIE and Windows.

WebSite Director - Web-content workflow management system from CyberTeams Inc. with browser-based interface includes configurable workflow management, e-mail submission of web content, and e-mail notifications; allows defining and applying existing workflow and approval rules to web content management process. For Windows, UNIX.

Equalizer - Load balancing server appliance and site management tool from Coyote Point Systems. Web based interface for load balancing administration, server failure detection, real-time server monitoring of server response time, number of pending requests, etc.

WebTrends - Web site management tools from Webtrends Inc.; such as WebTrends Analytics9 and WebTrends Optimizer for site metrics and management.

XMetal - XML development tool from Justsystems, Inc. for XML-based web site authoring and validation. Includes a 'Database Import Wizard', and can automatically convert output to CALS or HTML table models or to XML; For Windows.

Interwoven Team Site - Web development, version control, access control, and publishing control tool; works with many servers, OS's, and platforms. Other deployment and management tools available also.

Macromedia Contribute - Adobe's (formerly Macromedia's) web content management solution Content created in Contribute matches the look and feel of a site via Dreamweaver templates and advanced CSS support. Ensures design standards are met, functionality is maintained, and code is protected.

Site/C - 'Set-and-forget' utility from Robomagic Software; for periodic server monitoring for web server connection problems, link problems. E-mail/pager notifications, logging capabilities. For Windows.

PowerMapper - From Electrum Multimedia; for customizable automated site mapping, accessibility and usability checking, HTML validation, link checking, CSS validation, browser compatibility, and more. Requires Windows and MSIE.

SiteScope - HP's (formerly Mercury's) product for agentless site monitoring and maintenance. Runs on servers and monitors server performance, links, connections, logs, etc.; scheduled and on-demand reporting; provides notifications of problems. Includes published API for creating custom monitors. Monitors mimic users' end-to-end actions. For Windows or Unix.

HTML PowerTools - HTML validator, global search-and-replace. Date stamper, spell checker, Meta manager, image tag checker, HTML-to-Text converter, customizable reports. Link checker. Validates against various HTML versions, browser extensions; has updateable rulebase. From Talicom. For Windows.

OpenDeploy - Interwoven's configurable control system for deploying from development to production environments. Includes automated deployment, security, and encryption capabilities. Other management tools available also. For Windows and Unix.

Vignette Content Management - Vignette Corporation's products for web site collaborative content, publishing, management, and maintenance. Support for managing content stored in databases, XML repositories, and static files. Supports a wide variety of web attributes, databases, API's, and servers.

HomeSite - A lean, code-only editor for web development from Adobe (formerly Macromedia). Advanced coding features enable instant creation and modification of HTML, CFML, JSP, and XHTML tags, while enhanced productivity tools allow validation, reuse, navigation, and formatting of code more easily.

NetObjects Fusion - Site authoring/management tool from WebSite Pros Inc. Visual site structure editor, layout editor, graphics management, staging/publishing control. For Windows.

Content Management apps listing - Large listing of content management apps, in Wikipedia. Includes info re: Proprietary, Open source, etc; Platform (java, php, asp.net, Perl, python, etc.) supported databases and latest release date.

Log Analysis Tools

DMOZ Log Analysis Tools List - DMOZ open directory project's lists of open source and commercial log analysis tools.

Mobile Web/App Testing Tools

SeeTestMobile - Mobile application test tool from Experitest Ltd. Can be used on both emulators as well as real devices and covers visual testing, functionality testing and speed performance. Incorporates image recognition and self-learning algorithms. Test recording can take place utilizing real devices - plug real device in to desktop via USB. Utilizes self-learning diagnostic and matching algorithms and a modular self-enhancing image recognition technology. Editable scripts using included IDE; scripts can also be exported and edited in QTP, TestComplete, VBScript, C#, Java, Perl, Python. Runs on Windows, Linux, or Mac.

ZAP-fiX for Mobile - ZAP-fiX from ZAP Technologies International Inc. enables mobile app test automation from a windows desktop interface via an extension of HP Quick Test Professional and viewers; for multiple platforms including iPhone, iPad and Android.

Mobitest - Mobile Performance Testing Tool from Blaze Software Inc. uses real iPhone and Android agents to conduct a performance analysis of browsing a website on a mobile device at multiple locations. Returns a website speed test with site?s load time, bandwidth, and waterfall chart. Take screenshots (and optionally video) of the page load.

M-eux - Mobile apps test automation software from Jamo Solutions; recognizes the GUI elements of the mobile device resulting in test cases that are device model independent and re-useable across different versions of the service/application under test. Integrates with existing environments such as Eclipse, QuickTest Professional and Visual Studio.

Android APK for Selenium - Open source Android APK, needed for the Android driver. For use with Selenium 2.11.0 and later. Works with ICS emulators and real devices (phone + tablets).

Instruments for Xcode 4 - Part of Apple's XCode developer toolkit for building Mac iOS (and OS X) applications. Many testing, profiling, and analysis capabilities include enabling easy creation of ad-hoc test harness by recording and playback of user interactions, OpenGL ES for tracking iPhone graphics performance, memory allocation monitoring, Time Profiler on iOS for collecting samples with very low overhead, complete System Trace for insight into how all system processes interact, more. Also in XCode is iOS Simulator, which enables running an app similar to the way it would run in an actual iOS device; can check that network calls are correct, and that views change as expected when phone rotates; can simulate touch gestures by using the mouse.

Perfecto Mobile - Provides 'The MobileCloud' which allows remote access to more than 600 different real mobile handsets located around the globe. Also provides keyword-based automation scripting with Perfecto Mobile's 'ScriptOnce' technology; also provides remote access to handsets in the native network for testing.

Robotium - Open source Android test automation framework from Renas Reda/Hugo Josefson/Jayway; available as java source or jar file. Can integrate with Maven or Ant to run tests as part of continuous integration. Supports Android 1.6 and up.

FoneMonkey - Free functional test automation tool for iOS apps on the iPhone and iPad from Gorilla Logic. Provides for the interactive creation, editing and playback of automation scripts that exercise an application's user interface. Create suites of tests that automate performing user operation sequences and verifying results. Tests can be easily incorporated into continuous integration environments.

TestQuest CountDown - Mobile test automation tool from BSquare. Enables collaboration and asset sharing among distributed test teams. Organized into 4 components -- TestDesigner, TestManager, TestRunner and AssetManager; platform independent.

Intent Fuzzer - Free Android testing tool from Isec Partners; often finds bugs that cause the system to crash or performance issues on the device. The tool can either fuzz a single component or all components. It works well on Broadcast receivers, and average on Services. For Activities, only single Activities can be fuzzed, not all them. Instrumentations can also be started using this interface, and content providers are listed, but are not an Intent based IPC mechanism

MITE - Free version of MITE, from Keynote Systems Inc., for mobile content testing. Desktop testing tool with 1,600+ device profiles and 11,000 user agent strings. Test and validate mobile content quickly across numerous device/ mobile OS/ mobile browser combinations navigating mobile sites, checking for broken. Provides information including source code, redirects, protocol details, oversized objects, and device compatibility checks.

DeviceAnywhere - Mobile handset testing platform from MobileComplete enables development, deployment, and testing of content/apps on more than 2000 real handset devices in live global networks around the world using just the Internet. The mobile handset bank includes devices stationed in the United States, Canada, United Kingdom, France, Germany, Spain, Japan, etc and the agnostic platform hosts a diverse portfolio of carriers and manufacturers from around the world.

Gomez Real-User Monitoring - Mobile - An on-demand mobile monitoring solution from Gomez/Compuware, to accelerate identification, diagnosis and resolution of mobile Web, SMS and application performance and availability problems. Provides a unified view of mobile and Web performance and availability. Utilizes thousands of different 'mobile devices': tests are performed by the Gomez testing agents deployed on mobile nodes. Mobile nodes are a globally distributed set of computers connected to wireless carrier networks via attached wireless modems and provide a realistic measure of the mobile Web experience. Supports all major phone platforms such as iOS, Android OS, BlackBerry OS, Palm OS, Symbian OS & multiple feature phone operating systems.

Mobile Web and App Development Testing and Emulation Tools - Info on a variety of test and emulation tools from 2010 listing in SpeckyBoy Design Magazine.