What is Testing Anywhere software product? What are its uses?

Testing anywhere software product was developed by the Automation Anywhere Inc. based in San Jose. This is another software in the category of test automation tools. This software has proven to be a boon for the software testers and developers who have to test the web sites, applications, GUI front-ends, objects and controls. The product has got many uses from recording to the execution of the test cases. It is used for the following major purposes:

1. Recording of the tests
2. Debugging them
3. Scheduling their execution
4. Executing the tests

The above mentioned operations can be carried out for a number of application types such as:

1. Java
2. Silverlight
3. Mainframe
4. C++
5. .NET and so on.

Testing anywhere product provides option for automating the test case creation. Testing anywhere offers you 5 different methods for creating the test cases namely:

1. Web recording
2. Object recording
3. Image recognition
4. Smart recording and
5. Editor

- The test cases thus created using any of the above methods can be later recorded, edited, saved and can also be enhanced. 

- The editor is used for editing the test cases. 

- People who don’t have programming skills can use the wizard for creating and editing the test cases. 

- Testing anywhere software lets you create files with .exe extension i.e., the executable files which later can be deployed by the software testers on remote machines. 

- The creation of a high level IT and business processes is the responsibility of the workflow manager. 

- Further, workflow manager only takes care of the ability by virtue of which these processes are managed. 

- It supports a number of platforms:

1. Microsoft windows 7 (both 32 and 64 bit)
2. Microsoft windows vista (both 32 and 64 bit)
3. Microsoft windows XP (both 32 and 64 bit and along with service pack 2)
4. Microsoft windows server 2008 R2
5. Microsoft windows server 2003

- Testing anywhere supports the following kinds of testing:

1. Integration testing
2. Compatibility testing
3. Performance testing
4. GUI testing
5. System testing
6. Java application testing
7. Automated flex testing
8. Silverlight application testing
9. Mainframe application testing
10. WPF testing
11. Third party .NET supported testing
12. Automated software testing
13. Automated web testing
14. Regression testing
15. Distributed testing
16. Functional testing
17. Black box testing
18. Acceptance testing
19. Unit testing
20. Keyword driven testing
21. Data driven testing
22. Smoke testing

- The product has been named because of the facility that it provides for running the tests on any remote machine present in the network. 

- Further, it reduces the testing cost by a huge margin since it cut down the money being spend up on the software licenses, resources, and training and time of course.

- Testing anywhere provides you a SMART recorder for creating new tests.

What is meant by Behavior Driven Development (BDD)?

BDD or Behavior Driven Development is one of the most important development approaches in the field of software engineering and is just a modified implementation of the TDD or test driven development. It actually combines the guiding principles and general techniques of the test driven development with the combined ideas from two sources namely:

1. Domain – driven design
2. Object – oriented analysis and design

- The behavior driven development thus provides a shared process and tools to business analysts and software developers for their collaboration on the software development process.

- Ideally, behavior driven development represents an idea regarding the management of the software development process by both technical sight and business interests.

- It is assumed in this approach that the specialized software tools are being used to provide support to the development process. 

- The specialized tools thus involved have been developed especially to be used in projects following the BDD approach. 

- They can be considered as special tools that supports test driven development. 

- The primary purpose of these tools is to automate the ubiquitous language statements around which the BDD process is centralized. 

- Agile software development gets successful only when it is considered from the beginning. 

- On the contrast, in some projects this is the last thing to be considered which means that there is no sustainable operation in the websites that serve purposes other than blogging.

-  A blogging web site is just a software that is just modified by the users as it is ready for use. 

- However, BDD and TDD provides the only ways for achieving this goal. 

- The word ‘driven’ in TDD signifies that the test cases are written first and then the code for passing the test. 

- TDD is actually a low level methodology of accomplishing tasks and is sort of developer oriented. 

- On the other hand in BDD, the description of the tests is written in a natural language, thus making the tests more accessible to people outside the development team. 

- Such descriptions can describe the functionality in the same way as done by the specifications. 

Dan North was the person who actually brought the concept of behavior driven development in response to the issues experienced in implementing the test driven development such as:

1. From where to start testing?
2. What is to be tested?
3. How much should be tested in one turn?
4. How the reason for the failure of the test is to be understood?

- At the heart of the behavior driven development approach lies the approach to acceptance testing and unit testing which were again identified by North. 

- He emphasized that the acceptance tests should be written using the user story frame work. 

- Thus starting from the scratch, the development of the BDD approach continued over a couple of years and finally we have it as a communication and collaboration framework. 

- It has been designed especially for the QA people and business participants involved in a project.

- The agile specifications, BDD and testing eXchange meet highlighted the following characteristics of BDD:

1. Second generation methodology
2. Outside – in approach
3. Pull based
4. Multiple stake holder support
5. Multiple scale generation
6. High automation process
7. Agile methodology

- Further, it was said that it involves a cycle of interactions with outputs that are well defined and results in delivery of working software that makes sense. - First, BDD frame work that came in to existence was Jbehave which was followed by Rbehave–a story level BDD ruby frame work.

- All these frameworks were later replaced by cucumber testing tool. It was developed by Aslak Hellesoy. 

What is the difference between HTTP and HTTPS?

HTTP is quite a common language with us and stands for hyper text transfer protocol. This is actually an application protocol that has been developed exclusively for the hyper media, collaborative and distributed information systems. 

The foundation of the data communication is entirely based upon www or World Wide Web.  

Now what is HTTPS? HTTPS is nothing but HTTP secure! This one is much more secure than usual hyper text transfer protocol. And like HTTP, it is also a quite popular communication protocol for a much secure communication over a network of computers. It is quite popular with internet. 

If you see it technically, it is actually not a protocol in itself but rather a layered form of HTTP along with SSL/ TLS protocol. This allows the security capabilities of the SSL/ TLS to be added to the HTTP.  In this article we hold up to discuss the differences between the two i.e., the HTTP and HTTPS.

Difference #1:

- The transmission and receiving of the information across a computer network or internet is solely the responsibility of the HTTP.   

- HTTPS holds the responsibility of exchanging confidential information among the servers and also since the access to such information has to be secured to prevent it from any un- authorized access.

Difference #2:

-The transmission of HTTP takes place through a wire via PORT 80(TCP) but it is not at all secure! Some can easily interfere in the communication between your system and the server. 

- HTTPS is a creation of the NetScape and it comes as a built in thing with the netscape browser that uses it for the encryption and decryption of the user’s requests.

- HTTPS is actually HTTP working over the layer of netscape’s secure socket layer (SSL). 

- Unlike regular HTTP, HTTPS transmission takes place through a wire via PORT 443 for carrying out interactions between the lower layer TCP/ IP. 

- SSL or secure socket layer makes use of a 40 bit key size for encrypting the RC4 streams algorithm. 

- Therefore an adequate degree of encryption is possible for commercial exchange.

Difference #3:

- HTTPS being so very secure finds its use in shopping/ commercial sites and login pages. 

- HTTPS though being a standard secure protocol transmits the data over world wide web just like HTTP with the only difference being in the form in which data is transmitted i.e., the encrypted form. 

- When you put https:// instead of http:// you are asking the server to establish a secure connection path. 

- The server makes it a point that the secure and non secure connections are kept separately. 

- When the address in the address bar of the web browser that you are using, starts with http://, it simply means that your requests are being communicated over regular un-secure “HTTP” language.

- It is basically the letter ‘S’ that makes all the difference between HTTP and HTTPS. 

Difference #4:

- Most of the requests of the clients are processed via HTTP. The client in turn gets a response from the server on the completion of a request in the form of a web page. 

- In HTTPS the information is highly encrypted which means that no can have a clue of what you are looking for. 

This type of secure communication is commonly prevalent in those areas wheer security is quite mandatory like the following:

1. E- mails
2. Banking web sites
3. Payment gateways and so on.

To get an HTTPS connection, the server requires a public key trusted and signed certificate.

What are the types of web testing security problems?

Web testing is much in demand these days since the use of web sites and web applications are increasing by huge margins day by day. As the cyber crimes are increasing, web sites and web applications call for more security settings which in turn plunge in to the web testing schedule as the web testing security problems.

"Web testing is a kind of software testing that focuses on web sites and web applications. The security issues of the web sites and web applications are addressed by another type of web testing called web security testing". 

The testing of the web sites and web applications for security vulnerabilities is quite and exciting concept. Though the matter is quite exciting, it needs to be taken seriously. The best method to combat with the known web testing security problems can be to be prepared in advance and having knowledge of what is to be checked for.

In this article we are going to take up some of the most common security aspects that can pose problems in web testing. They are mentioned below:

1. Server problems: These are the most common security problem. It happens many a times that the server is down for maintenance or some other reason.
2. Hardware problems
3. Data base problems: Any problems in the data base of the web site or web application gives rise to many of the security problems. Any problem and uncertainty in the data base can prove to be a danger to the overall security of the web site or web application.
4. Navigation from one page to another: Too much of navigation from one page to another endangers the security of the web site or web application which in turn acts as a hindrance in the web testing of that particular web site or web application.
5. Server security: A server houses a web site or web application data base; therefore it is obvious that the security of the web site or the application relates a lot to the security of the server. Maintaining the security of the web server is quite an important point which otherwise could introduce many of the security problems during the web testing.
6. Authentication issue
7. Data encryption
8. User privileges leaks
9. SQL injection
10. Cross side scripting
11. Cookie testing
12. The content on a web site that proves to be inaccessible or incorrect can also pose security problems during web testing.
13. Improper validation of the input can disturb the working mechanism of the web site or web application.
14. Link testing is an important aspect of web testing. Broken links can hamper the security of the web site or application and thus poses problems in web testing security.
15. Incorrect copyright information.
16. Incorrect EULA or end user license agreement.
17. Un-optimized images that do not meet the specifications.
18. Improper storage of the data obtained through the web pages.
19. Time taken by the pages to render.
20. Lag in performance with many simultaneous users.
21. Concurrency issues like when a user is working on multiple windows of the same page or there are multiple users on the same page.
22. Improper and inefficient tracking of the transactions by the server log.
23. Improper usage of SSL by the web site or web application.
24. Inefficient working of the feeds.
25. Inefficient working of the cookies.

Web testing is absolutely essential if you want make sure that your web site or web application has enough browser support and the HTML is valid. 

What is website usability testing?

Since the past few years the growth and usage of the web sites which are both free and paid had risen rapidly. In other words, we can say that the usability of the web sites has witnessed a massive growth. With the rise of usage of web sites and web applications, it is obvious that the demand for the web site usability testing also increases! 

Now you must be wondering what actually is web site usability testing? In the earlier times, it took expensive recruitment labs and a large amount of time and deployment to carry out the web site usability testing. Since the advent of the web site usability testing tools, the whole process of testing seems to be so smooth and so under control. 

In this article we have discussed about web site usability testing. You might be thinking that why it is necessary to carry out web site usability and what good it does to the web sites and web applications. 

- The web site usability testing contributes as an essential element of the quality assurance of the web site or web application under the testing. 

- Web site usability testing can be considered to be an exact, actual and true test of how a web site or web application is actually being used by the end users.

- Web site usability testing  becomes quite easy when you know how to do it and also quite cheap when you are going to carry it out yourself. 

- Web site usability testing involves checking the following aspect of the web sites and web applications:

1. It checks if the web site or the web application is being used by a series of individuals under some guidance from a facilitator.
2. It checks whether or not the web site or the web application can be successfully used by the outsiders.
3. It checks if the web site or the web application is focusing only on a particular group.

There are some common terms associated with the web site usability testing that we are going to discuss now:

1. Observer: An observer is the person in charge of the observation of the of the test that is in progress and he/ she often sits in another room.
2. Facilitator: He/ she is the person in charge of the guidance of the user while the usability test is under progress and takes relevant notes.
3. Owner: Owns the web site or the web application.
4. Web site development team: This team constitutes of all the people who are involved with the development and maintenance of the web site or the web application. It includes the following:

a)    Strategy group

b)    Programmers

c)    Designers

d)    Stake holders and so on.

5. User: The person who uses the web application or web testing during the usability testing.
6. Usability: It can be thought of as a measure up to which the intended user achieve his/ her goals using the web site or web application that is under test.

Testers usually take a whole one whopping big usability test which makes the whole testing process quite clumsy rather than breaking down the testing process in to little parts and then executing them. 

There are 5 appropriate timings for carrying out the web site and application testing as mentioned below:

1. At the time of the conception of the web site you can start by testing a printed mock up of the home page of the site.
2. Before a re development plan is created.
3. Repeatedly during development.
4. Whenever an anomaly shows up in a traffic analysis.
5. When the owner of the web site calls for some info regarding his web site or web application. 

What are different aspects of Inference SQL injection attack?

SQL injection attacks nowadays are rising up by a huge mark in the cyber world, making a huge number of web sites and web applications its poor victims. Few years back the SQL injection attacks were not much in news but, now they have come to top the web’s vulnerabilities chart.

SQL injection attacks have emerged as a popular and notorious means for harming the security of the websites and web applications. 

Actually how exactly an SQL injection attack come in to affect? 

- In a typical SQL injection attack, some statements written in SQL language serve as input to a web form.

- This is done in order to obtain a web site or application that will carry out operations on the targeted data base.

- Such fake obtained web sites via the SQL injections are often badly designed. 

- The attacker employs this badly designed web site to get the access to the private data base contents. 

- It is a kind of code injection technique and that is often set for exploiting the security vulnerability in the software of the web site or web application. 

When does an injection attack occurs?

An injection attack occurs through two usually committed mistakes which are:

1. Incorrect filtering of the input by the user for entering the escape characters in string literals which are embedded in the vicious SQL statements. Here then emerges a scope for the potential manipulation of SQL statements which is done by the end user who is using the data base.

2. The unexpected execution or running of the input entered by the user that has not been strongly typed. This is commonly referred to as incorrect type handling. The constraints are then left unchecked.  

Approaches of Inference SQL Injection Attack

The SQL inference injection attacks are usually used for mining of data. There are 3 approaches that are used for data mining following inference SQL:

1. In band approach: The in band approach involves the extraction of data via an already existing path between the application and the attacker. For example, returning the data in a well rendered error message or web page.

2. Out of band approach: The out of band approach involves the creation a new path between the application and the attacker. This is actually worked out by establishing a connection between the data base server and the client by employing a network function such as HTTP, data base connection, e mail and so on.

3. Inference: Inference does not involve any direct transfer of any actual data rather the value of the data is inferred directly by calculating the differences between the responses from the attacker as well as the application. This is generally done by revoking several questions. Deliberate differences between the two responses are generated based up on the answers to the revoked questions. 

About the Inference SQL Injection Attack

1.The inference approach can also be used at the bit level and it makes use of properties such as status of the web server, time and difference in the content.

2.Making use of these properties, it enables the attacker for correctly inferring the data values.

3.Inference SQL injection has proven to be a great mile when it comes to the extraction of the data using SQL injections. 

4.It came to be extremely useful when the other two methods for data retrieval i.e., in band and out of band didn’t prove to be successful. 

5.The inference SQL attacks only affect the SQL servers and they are quite slow due to time delay. 

6.Since 2002 no remarkable improvements have been witnessed in the field of inference SQL.

7.The inference SQL injection attacks have an added advantage which is that they can be employed in any SQL injection situation. 

8.When a specific query is injected in to an ADQ (application defined query), the web server generates a response code depending up on the data values. 

9.It is quite common for an attacker to initially look for exploiting the SQL injection vulnerability by using the in band results.

10.But this not feasible every time since in some situations time is the major factor, in such situations out of band or inference methods are deployed. 

11.Not only data, but logic can also be inserted in to the query of the application.

12.In this the output of the application can be controlled and based on this output the stored values can be inferred from the data base.

13.The creation of an SQL inference attack is based on the sophistication of the information that the attacker has regarding it beforehand. 

14.The inference SQL attack through the web server response codes present a major problem which is that they can be quite easily be detected by the good web server administrators.

15.But, the attackers are so clever that they have figured out another such inference attack called content manipulation inference attack.

16.Using this, they are able to keep the response code constant while simultaneously changing the web site content. 

What causes browser display differences?

Most of the time while browsing the same over many browsers you might have noticed considerable differences between the displays across the various browsers. These differences cause a lot of annoyance to the users.

There are various reasons why there occur differences across the different browsers. This article is focussed up on such browser display differences and errors as well as suggestions to avoid them.

ABOUT WEB BROWSER DISPLAY DIFFERENCES

- Earlier it was quite difficult and time consuming task to compare the web sites displays under many different browsers but nowadays several tools have been developed that have proven to be quite effective in testing the appearance of a web site on various browsers.

- These tools help in checking out the differences by taking the snap shots of the web site across the various browsers and then comparing them.

- You can even have the snap shots of your web page under different computers and screen resolutions.

- An HTML tool box is incorporated in these tools which tell whether the differences have occurred due to the incompatibility of the HTML code used in the web site or are they because of the browser incompatibility.

- The HTML tool box in some of the tools has also the capability for repairing off the code errors in just a few clicks.

Some of the most common factors that causes browser display differences are:
1. Browser bugs
2. Browser incompatibility
3. HTML errors
4. Different font sizes
5. Different computer types
6. Different screen sizes
7. Different versions of the browsers

RARE CASES
- In some very rare cases, the problem of differences might also occur due to certain features of a web site that have been exclusively designed for certain browsers and are not meant for others.

- Usually a web site is developed so that all of its features are accessible by all the web sites.

- For example, the web site for downloading Google chrome extensions and tools has been designed exclusively for the Google chrome browser.

- Though this web site can be viewed in any other browser but, one cannot download extensions through that browser.

STEPS FOR ELIMINATING DISPLAY DIFFERENCES ARE:

There are several steps that one can take for eliminating such differences:
1. Avoiding using cutting edge HTML as far as possible.
2. Set some goals for your web site.
3. Always check for the browsers incompatibilities.
4. Follow the trial and error debugging method.
5. Never forget to validate your web pages.

WHAT WEB BROWSERS ACTUALLY DO?

- They translate the web site code in to the formatted web pages.

- Every individual web browser has its own way of translating the web pages.

- This can be compared to the following example: you give a sentence written in German to a few people and ask them to translate it in to English. Checking the results, you will observe that all of them though have translated the sentence but their ways of translation are different i.e., the have used different words and grammar composition.

- Though the rules and standards for using HTML have been stated by the World Wide Web consortium, web site designers have their own way of implementing it.

- There is a fact that you should know which is that there is no such an effective browser that supports the hundred percent of the HTML, though there are certain browsers that come a little far away than their counterparts.

- If your browser does not supports a part of the code, it is sure to affect the display of your web site.

- This problem is further exaggerated by the HTML extensions that are specific to certain browsers.

- Such problems have forced the designers to put a label on their web site stating on which browser their web site can be viewed.

What we can do to avoid browser incompatibility?

Malfunctioning of the web sites across various browsers has become a topic of utter annoyance.

Why it happens so that your web site functions perfectly well on one browser and at the same time fails to perform well in some other browser?
Why it appears to be missing some thing while it appears as proper on other browsers?

The root cause of all such errors and differences is the browser incompatibility.

WHAT IS BROWSER INCOMPATIBILITY & TOOLS FOR DETECTING BROWSER INCOMPATIBILITY

- There are various tools that can help you across detecting the browser incompatibility.

- Such tools check for the browser incompatibility by comparing the various snap shots of the web site operating under various web browsers.

- Different browsers and different browser versions all add up to the browser incompatibility.

- Browser incompatibility though cannot be eradicated fully; it can be at least reduced to a certain extent.

- Though the browser is only to be blamed for its incompatibility, the measures to reduce or avoid it can be taken from both sides.

- It can be done by improving either the standards of the browser or by taking care of the web site.

- If the web site in its design and code is good, incompatibility will be noticed less.

WHY INCOMPATIBILITY ARISES?

- It arises either because of the incompatibility of the web browser or because of the problems in the web site itself.

- So you need to focus on the design an implementation of your web site rather than bogging up yourself with the browser issues.

- Employing cutting edge HTML can also run you in to the incompatibility problems as the HTML standards usually are a way step ahead of what is supported by the web browsers.

- Till now, no such browser has been developed that will take in to consideration 100 percent HTML.

- No doubt there are certain browsers that are a bit close to this value than the others.

- Using latest versions and standards of the HTML is always not a good choice. So be wise when you choose the version of HTML for designing up your web site.

- Another fact to be kept in mind is that not all the web browsers are equally efficient in translating the HTML code in to formatted web sites.

- There are some browsers that may leave certain parts of the HTML code because they are not able to execute it and again you will have trouble with your browser compatibility.

- Also all the web browsers do not translate a web page in the same manner and don’t give the same results.

- Before you start building up your web site, check out the compatibility of the different browsers so that you will have an idea what all formats and standards they support and you can build your site according and simultaneously avoiding a bug deal of incompatibility.

- After you have finished developing your web site, have your pages validated. If you are getting errors in your web site try out the trail and error debugging method.

Though the World Wide Web consortium has specified the standards for using HTML, you can very well invent your own and design your web site accordingly. But this has a disadvantage that the browser may reject the parts that cannot be executed and the appearance and functioning of your web site will be affected.

The basic difference between the two versions of a browser lies in the support they provide for the HTML. But on top of all it would be better if you pay attention to the browser compatibility while designing your web site. This will prevent you from running in to future issues regarding the incompatibility of the browser.

What are different aspects of Compounded SQL injection attack?

Till now so many types of SQL injection attacks have been identified. But, there is one type of SQL injection type which results in to different kinds of combinations of the other SQL injection attacks. This type of SQL injection attacks are commonly known as the compound SQL injection attacks.

This type of SQL injection attack has been derived from rigorous research and experimenting with the different SQL injection attack vectors putting them in different combinations with the various other web application attacks.

Some of the most commonly employed combinations are:

1. SQL injection + XSS cross site scripting
2. SQL injection + DDos attacks
3. SQL injection + insufficient authentication
4. SQL injection + DNS hijacking

Compounded SQL Injection Attack

- SQL is a language developed for interacting with the data base of the applications and web sites.

- The functions are mainly defined to retrieve the data from the data bases or to update the contents of the existing data bases.

- It uses compound conditions basically that make use of AND or OR.

- A compound statement is used to group all the other statements so as to constitute an executable block.

- SQL variables can be declared in an atomic compound statement that has been dynamically developed.

- A compound statement can be easily embedded in to SQL functions, SQL methods, trigger etc.

- To invoke a dynamic compound statement no privileges are required, although the authorization ID of the compound statement needs to include all the privileges required invoking the other SQL statements that form a part of that particular compound statement.

- Most of the compilers compile the compound statements as one single statement since this technique proves effective for the short scripts that do not require little control flow logic though a great data flow.

- For larger scripts or constructs, it’s better to use the SQL procedures.

- The “discretize” function is quite a simple one and is often used for the classification and modification of the data and gives back a NULL value for the malicious data.

- Later this malicious data is cleansed up by the compound statement.

- Most of the mechanisms can be elaborated using the technique of multi stage cleansing.

- The advantage of the compound statement is that here the FOR loop neither does open up a cursor nor the single row inserts are treated so.

- Here the underlying logic is of a multi table insert that has been selected previously.

- This advantage is reaped by compiling the dynamic statement as a single one.

- In contrast to this dynamic compound statement, there’s another type called Compounded SQL embedded statement.

- These statements can only be embedded in to the applications.

- In contrast to the dynamic statements, these cannot be prepared dynamically.

- These statements do not required any special privileges for invocation.

Explain the concepts of Cross site scripting attacks?

XSS or cross site scripting attack is a much familiar security threat in today’s cyber world and is taking a toll on the web sites and applications by breaking in to their security system.

What is Cross Site Scripting Attack?

- Cross site scripting attack is another attack categorized under the category of computer security vulnerabilities which are the most common and frequent among the web applications.

- These attacks are known for making the web application so vulnerable that the malicious outside attackers are able to inject the malicious client side scripts in to the web pages or applications that are later set for the view by the users who visit the page.

- Another nefarious purpose of these attacks is to incur the access controls like the same origin policy.

- The cross site scripting attacks account for almost 80 percent of all the security threats identified and documented in the year of 2007 till now by the Symantec.

- The cross site scripting technique for the good purpose is usually employed for curbing risk depending on the measure of the sensitivity of the data that is being processed by that particular web site or web page.

- Apart from this factor, another factor that makes it easy for the attacks to happen is the security mitigation as implemented by the owner of that web site.

- Cross site scripting attacks are employed by some people to create petty nuisance.

- This is nothing but the misuse of the vulnerability of the security system by the attackers for bypassing the security mechanisms on the client side which are usually implemented by the web browsers up on the web content on the web site.

- There are various ways through which the site can be attacked and accessed for injecting the malicious scripts in to them.

- Such ways or methods can provide the attacker an unauthorized and easy way to access all the sensitive content of the page, information of the user activity as stored by the web browser and session cookies etc.

- Cross site scripting attacks are a type of code injection attack and somewhat similar to the SQL injection attacks.

- Earlier the cross site scripting technique was seen as the loading of the third party application that had been attacked at an unrelated attack site while the execution of the java scripts took place in the context of security of the domain on target as created by the attacker.

- Eventually this cross site scripting attacks were carried out through different modes of the code injection using non java script vectors (like VBscript, flash, Java, ActiveX, HTML, SQL and so on).

- Cross site scripting attacks are a consequence of the cross site scripting vulnerabilities that have been under exploitation since the advent of 20th century.

So many famous social networking sites of today like my space, orkut, twitter, Facebook etc have witnessed these attacks in the past. With the advancement of the cross site scripting techniques, they have now successfully surpassed the vulnerabilities like buffer overflows reporting to be the most common security vulnerability. Even now around 60 percent of the total web sites have been sorted as vulnerable to the cross site scripting attacks.

As such there are no defined criteria for the classification of the XSS flaws, but according to the experts they are classified in to two categories:

1. Persistent XSS flaws
- Also known as stored XSS flaws and is the most destructive type.
- Occurs when the data which has been provided by the attacker is stored by the server.

2. Non persistent XSS flaws
- Also known as reflected XSS flaws and most common type.
- Occurs when data from a web client is used by server scripts for generating required pages without the sanitization of the queries.

What is meant by negative testing?

Negative testing is one of the most sought after software testing methodology. Negative testing is the counterpart of positive testing.

Facts about Negative Testing

- Negative testing is really very helpful when it comes to handling the invalid input test data and abnormal behavior of the software system or application.

- The purpose of the negative testing is to prevent such situations in which the invalid data might be taken by the system and which in turn may disrupt the functioning of the whole software system or application.

- For example, when a user tries to enter numerical data in the alphabetic field, the software system displays a message like “incorrect data type”.

- Such response from the software system or application is required since it avoids the crashing or hanging of the whole system by preventing input of invalid data.

- Not only this, the negative testing helps one improve the quality of the software system or application by knocking out its weak points.

- In positive testing, giving some invalid data as input to the system is considered to be an exception but this is not so in the case of negative testing.

- In negative testing, giving some exceptional input to the software system or application is treated just like a normal event.

- Negative testing is all about testing the exceptions.

- Usually for a better software testing results, both the negative testing as well as positive testing are combined together and implemented.

- Using such a testing methodology provides greater test coverage rather than using just one of the either mentioned software testing methodologies.

Situations which are typically tested by the negative testing:

1. Filling up fields by user
- Most of the web sites as well as web applications require the user to fill up all the fields that are marked compulsory.
- To test this functionality, leave all the marked fields blank and hit the submit button and observe the response of the site or the application.
- The expected outcome here can be a message asking you to fill up all the compulsory fields.

2.Checking correspondence between field and data type
- Negative testing also checks the correspondence between the field and data types.
- For example, the different fields in a form can accept the specified type of data. - To test this, you can enter various sorts of invalid data types in to those fields and check the behavior of the application.

3. Checks allowed limits and data bounds
- It also checks for the allowed limits and allowed data bounds.
- Fields in a form can accept data only within a specified data range and not above or below that.
- This can be tested in two ways. You can either enter value that is less than the lower range of the data or you can enter value that is above the specified range.
- Another example can be of text box which accepts only a finite number of characters.
- You can test it by inputting less or more number of characters.

4. Checking reason ability of input data. - Negative testing is also an effective tool for checking the reasonability of the input data.
- The age fields in some web forms etc do not allow any negative integers and also no floating point value.
- This can be tested by simply putting in the wrong data types like a negative integer.

5. Tests the web sessions
- Negative testing can also be used to test the web sessions either for timing or for log-in purposes.
- There are some web pages for viewing which you first have to log in.
- This can be tested by trying to open that web page without logging in.

Negative testing is pretty easy to be carried out manually, but still you can find many automation tools for it.

What are different phases of web application testing?

What is a web application actually? How do we define it? Let us put it in very simple words!

" A web application is much like any other normal application, the only difference being that a web application can be accessed only over an internet connection."

So only the accessibility makes it different form the other types of applications.

What is Web Application?
- A web application can be purely an individual application with its own spate existence over the web.

- But, there are several other kinds of web applications which are written in the Java script and are embedded in a web page or web site.

- The scripts that are used to write these web applications should be supportable by the web browsers.

- The scripts are usually a combination of Java and HTML codes and can be executed only with the help of a web browser and otherwise not possible.

What makes these web applications so popular among today’s generation?

- It is nothing else but the ubiquity of the web browsers.

- The web applications make use of the web browsers as a running client.

- Most of the web applications display the property of the cross platform compatibility i.e., they can be used on multiple platforms and across multiple browsers.

- This further makes them very much popular.

- Web applications like online retail sales and wikis are gaining so much of popularity world wide.

- As the number of users of the web applications keep on increasing the more vulnerable its following aspects become: security, reliability and quality.

These are some of the most crucial factors responsible for the success of a web application.

What can be done to improve their efficiency?

- Effective testing is one such measure which can improve the performance of any web application.

- Performing a web application testing is kind of tough task and requires great skills since the tester has got no direct control over the working of the web application.

Phases of Web Application testing
A typical web application testing comprises of three main phases:

1.1st phase: Testing of the Web tier
This phase involves the testing of the web application for the cross browser compatibility. The web application is checked the commonly and widely used web browsers.

2. 2nd phase: Testing of the middle tier
This phase involves the testing of the security related aspects as well as the functionality and features of the web application.

3. 3rd phase: Testing of the Data base tier
This phase involves the determination of the integrity of the data base of the web application as well its components. This phase is also concerned with the verification of the components of the web application.

Steps followed in each phase are:
Whichever the phase may be, there are common steps that are followed in every phase.
- First step is usually the loading of the web application on to a web server. The testing is not concerned with the location of the server! It might be known or unknown, it doesn’t matters.

- After this step, the second step involves the installation of this web application on the client side server.

- The web application is tested on the client’s side. The following mentioned aspects are foremost tested:
1. Browser compatibility
2. Operating system compatibility
3. Error testing
4. Static pages
5. Validation of the CSS and HTML code (either by checking the URL or by uploading)
6. Load testing and
7. Back end testing.