Testing of a product which has no test cases?

a) Test the application with the customer view

b) Try to develop the test cases with the method”What you see is what you test”

    (Experience is required for writing test cases)

c) Try to perform insallation/uninstllation tests and all GUI objects validation

    Like radio, command button, list box, check box, links ETC

d) Get the information of the similar type of features which were tested for other

     Projects.

 e) Enter the min and max values for all the user input fields and determine the

     Valid length

 f) Verify the screen flow and develop test cases

Testing of the product when requirements are frequently changing

a) Plan the testing activity with a buffer time in it.

b) Update and intimate the schedules that are affected because of requirements changes

c) Try to move the new requirements or enhancement requests to next phase of testing

d) Estimate the possibilities of automating the testing sequence and apply it

e) Check that the code is well commented and documented so that updations or change 

     To code becomes easy

f) Try to provide a prototype of the application of the new features to the customers,  

    This helps to change the requirements at the initial stages

Things to be considered when testing has to be carried out in a short period/ not enough time is given

a) Use risk analysis to determine where testing should be focused

b) Determine which is the core or important functionality of the   

     Project/product/application

c) Which functionality is the most visible to the user?

d) Most required and frequently used functionality by the customer

e) Which part of the code or design is most complex and has the chances of

      Having more bugs/errors/defects

f) What are the specific tests that will cover multiple functionality of the application?

g) If testing of the current project has the same features or similar functionality to the 

    Previously executed project, get details of that project information and try to eliminate   

    Those problems in the current project.    

h) Which functionality has the largest safety impact?

Web Based application(s) testing

Web sites are essentially client/server applications they can be divided as web servers and 'browser' clients. Consideration should be given to the interactions between HTML pages, protocols, security, applications that run in web pages such as applets, JavaScript, plug-in applications, and applications that run on the server side such as CGI scripts, database interfaces, logging applications, dynamic page generators, etc.

Additionally, there are a wide variety of servers and browsers, various versions of each. Small but sometimes significant differences between them, variations in connection speeds, rapidly changing technologies, and multiple standards and protocols. The end result is that testing for web sites can become a major ongoing effort.

Things to be considered for web testing

a) What are the expected loads on the server and does it meets the expected performance       And the stress

b) What are the different browser(s) capabilities of the application?

c)  How is the connection speed internal & external (real time)

d) What are the security threats and how it is secured (firewalls, encryptions Etc)

e)  How is the server recovery from down time or an crash

f)  What are the different injections or vulnerabilities (SQL injection, cross site scripting?  

      Etc) that might occur and how it is handled

g) How is the master slave severs performance, that is when one server is down how effectually the slave or the other server will come up (if configured)

h) How is the web page layout, fonts, colors, text, graphics and user Interface? Etc.

i)  Cookie handling

Security vulnerability: -

Security vulnerability can be said as threat to the application from unauthorized access

And corruption of the application data. Following are the few security vulnerabilities.

Injection attacks

Cross site scripting

Session hacking

Form tampering

Port Scanning / Foot Printing

Injection Attacks:-

Following are the different types of injections

SQL injection

Ldap injection

Command Injection ETC

SQL Injection:-

Try the following steps

a) Open the Web site in a browser

b) Find a script which has common scripting-language file extensions

    Like .asp or .cfm

c) The “search” filed of an application is the field most vulnerable The Uniform Resource      Locator (URL) on the results page will likely contain a script. Also try hovering your cursor over links while watching the Bottom status bar. If the status bar doesn't display URLs click on links and watch the address bar until you find a URL that has parameters.

Once you are on a page whose URL contains parameters, you are ready to test for SQL Injection vulnerability. There are two methods. Be sure to test each parameter value, one at a time, with each method

Method 1:-

In the address bar URL, highlight a parameter value. Replace it with a single quote.

 Ex: - http://www.exampl.com/abced/default.asp?rollnumID = ‘

 

Method 2:-

Instead of highlighting the entire parameter value, click inside the value and type a single quote.

    Ex: - http://www.exampl.com/abced/default.asp?rollnumID = 12’23

And click on send/enter/submit. Look for database error message      

                                  

(Note)  Sometimes the error message does not display on screen. To find it, you may have to search the HTML source of the page. (View | Source in Microsoft Internet Explorer or View | Page Source in Netscape.) A document will open. Use that program's search tool to look for either of these phrases:

                        Microsoft OLE DB

                                     Or

                          [ODBC]

Other way to test for SQL Injection

If you are using the normal string concatenation method of writing the code then you have to just enter the following in this manner in the text box.

                                      ‘Or 1=1 --- 

This will allow u to breach into sql and if u know how to create a windows acc then follow it up with the command, u well be able to create an account.

Cross Site Scripting:

Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website

Try out by dong this

Look for an URL like (http://webserver.com/...../Search?box=java),

See the value here which is java and this value have been assigned to “box”. So now u needs to change this URL to

(http://webserver.com/...../Search?box=<script>alert(document.cookie);</script>)

And enter this new URL in browser and say Enter, which would display the current session cookie which is a serious security bug.

*** You need to learn some stuff in URL syntax or manipulation or programming to give this script there. You can’t just blindly give this anywhere in your URL.

Session ID hacking: -

A session is piece of code that is encrypted or encoded into a randomly organized string. This is used by the web server and browser for Authenticity /access to the authorized resource. To hack a session ID we need to have a sniffer. For example in domain where

We have three systems. A, B, C, system A has a web application, System B

Has a sniffer installed in it and C has a web server installed on it

a) Configure the sniffer and make it ready

b) Do an authentication from the system which has the web application installed on it

c) When it is successfully authenticated and session is alive get the information from the  

     Sinffer –system B

d) Since the captured information mostly in the machine language you need to Write a    small program to convert it to get the clear information Get the session id , append this ID with in the URL and access the  Protected resources

* NEED MORE R&D

Quality certifications for organizations

Capability maturity model:-

Software CMM is a business process management and quality improvement concepts to software development and maintenance. It’s a community-developed guide for evolving towards a culture of engineering excellence, model for organizational improvement. The underlying structure for reliable and consistent software process assessments and software capability evaluations. The Capability Maturity Model for Software (CMM) is a framework that describes the key elements of an effective software process.

It has the following 5 levels

CMM level 1 (initial): Software development follows little to no rules. The project may go from one crisis to the next. The success of the project depends on the skills of individual developers. They may need to finish the project in a heroic effort.

CMM level 2 (repeatable): Software development successes are repeatable. The organization may use some basic project management to track cost and schedule. The precise implementation differs from project to project within the organization.

CMM level 3 (defined): Software development across the organization uses the same rules and events for project management. Crucially, the organization follows this process even under schedule pressures, ideally because management recognizes that it is the fastest way to finish.

CMM level 4 (managed): Using precise measurements, management can effectively control the software development effort. In particular, management can identify ways to adjust and adapt the process to particular projects without measurable losses of quality or deviations from specifications.

CMM level 5 (optimizing): Quantitative feedback from previous projects is used to improve the project management, usually using pilot projects, using the skills shown in level 4.

(Note) All of the above mentioned levels have many key processing areas in it

ISO:-

International Organization for Standardization, it provides a reference framework, or a common technological language, for different industry types which will help Industries to develop & maintain quality of the products. The ISO 9000 and ISO 14000 families are among ISO's most widely known standards ever. The familiar three standards ISO 9001, ISO 9002 and ISO 9003 have been integrated into the new ISO 9001:2000.        

                         

Six Sigma

Six Sigma is a rigorous and a systematic methodology that utilizes information (management by facts) and statistical analysis to measure and improve a company's operational performance, practices and systems by identifying and preventing 'defects' in manufacturing and service-related processes in order to anticipate and exceed expectations of all stakeholders to accomplish effectiveness.

Six sigma levels Metric: 3.4 Defects Per Million Opportunities. DPMO allows you to take complexity of product/process into account. Rule of thumb is to consider at least three opportunities for a physical part/component - one for form, one for fit and one for function, in absence of better considerations. Also you want to be Six Sigma in the “Critical to quality” characteristics and not the whole unit/characteristics.

Methodology: DMAIC/DFSS structured problem solving roadmap and tools.

Philosophy: Reduce variation in your business and take customer-focused, data driven decisions.

BS7799: -

BS 7799, Information Security Management, released by the British Standards Institution (BSI) in 1995, and revised in 1998 and 1999, provides a comprehensive set of controls comprising the best information security management system (ISMS) practices.

BS 7799 applies to information systems used by organizations in industry and commerce, including information processing technology in the area of networks and communications. Organizations complying with BS 7799 should assess security risks, select controls and develop guidelines. This standard may be used for ISMS audits and as a basis for a registration scheme. It covers such areas as document control, security policy and organization, asset classification and control, physical and environmental security, communications and operations management, access control and compliance with legal requirements.

(Note)The advantage of having these certifications for an organization is that, it will provide an identification and good will in the market. That makes the customers More belief towards these organizations when they are approaching for different type of the services and requirements

Quality in software

Software Quality can be defined as “an application/system/product which satisfies the requirements and expectations of the customer(s) developed with in the time and budget". Quality is obviously a subjective term. Hence definition is frequently changed.

What is quality assurance

Quality assurance can be defined as a defined process which is applied on application/product/system to confirm that it has satisfied the specifications, requirements of the customer. This is can be also called validation.