Aditi Technologies

Basic Concepts of Software Testing

Software Testing
Basic Concepts and Industry awareness

Page 1 of 60

Aditi Technologies

Basic Concepts of Software Testing

Table of Contents 1. Introduction.................................................................................................4 2. Types of Testing...........................................................................................4 2.1. White Box Testing...................................................................................4 2.2. Black Box Testing....................................................................................4 2.3. Unit Testing............................................................................................5 2.3.1. Benefits ...........................................................................................5 2.3.2. Encourages change ...........................................................................5 2.3.3. Simplifies Integration ........................................................................5 2.3.4. Documents the code .........................................................................5 2.3.5. Separation of Interface from Implementation .......................................6 2.3.6. Limitations .......................................................................................6 2.4. Integration testing .................................................................................6 2.4.1. Purpose ...........................................................................................6 2.5. Performance Testing................................................................................7 2.5.1. Technology ......................................................................................7 2.5.2. Performance specifications .................................................................7 2.5.3. Tasks to undertake ...........................................................................8 2.6. Stress Testing ........................................................................................8 2.7. Security Testing......................................................................................9 2.7.1. Security Testing Techniques ...............................................................9 2.8. Usability Testing.....................................................................................9 2.9. Stability Testing....................................................................................10 2.10. Acceptance Testing..............................................................................10 2.11. Installation Testing..............................................................................10 2.12. Alfa Testing........................................................................................11 2.13. Beta Testing.......................................................................................11 2.14. Product Testing...................................................................................11 2.15. System Testing...................................................................................12 2.16. Regression Testing...............................................................................12 2.17. Compatibility Testing...........................................................................13 2.18. Test Cases, Suits, Scripts and Scenario..................................................13 2.19. Defect Tracking...................................................................................14 2.20. Formal Verification...............................................................................14 2.20.1. Validation and Verification ..............................................................14 2.21. Fuzz Testing.......................................................................................15 2.21.1. Uses ............................................................................................15 2.21.2. Fuzz testing methods .....................................................................15 2.21.3. Event-driven fuzz ..........................................................................16 2.21.4. Character-driven fuzz ....................................................................16 2.21.5. Database fuzz ...............................................................................16 3. Manual Testing...........................................................................................17 3.1. Facts...................................................................................................17 3.2. Software Crisis .....................................................................................17 3.3. Software Myths ....................................................................................17 3.3.1. Management Myths .........................................................................17 3.3.2. Developers Myths ...........................................................................17 3.3.3. Customer’s Myth .............................................................................18 3.3.4. What do we do? ..............................................................................18 3.4. Software Quality Assurance: ..................................................................18 3.4.1. Verification: ...................................................................................18 3.4.2. Validation: .....................................................................................18 3.5. Software Life Cycle Models: ...................................................................18

Page 2 of 60

Aditi Technologies

Basic Concepts of Software Testing

3.6. What makes a good Software QA engineer? .............................................18 3.7. Testing: ..............................................................................................19 3.7.1. Why Testing? .................................................................................19 3.8. Test Life Cycle .....................................................................................19 3.9. Testing Techniques ...............................................................................19 3.10. Test Plan: ..........................................................................................19 3.10.1. Test Specification: .........................................................................20 4. Testing Procedure.......................................................................................20 4.1. Bug Tracking .......................................................................................20 5. Testing Tools and Software..........................................................................23 5.1. Load and Performance Test Tools ...........................................................23 5.2. Java test Tools......................................................................................23 5.3. Link Checking Tools...............................................................................27 5.4. Perl Testing Tools..................................................................................28 5.5. Web Functional and Regression Testing Tools............................................28 5.6. Web Site Security Test Tools...................................................................33 5.7. Web Site Management Tools...................................................................37 5.8. Other Web Testing Tools........................................................................45 6. Testing FAQ ..............................................................................................50

Page 3 of 60

2. Black-box test design is usually described as focusing on testing functional requirements. and closed-box. White-box test design allows one to peek inside the "box". Introduction Testing is a process used to help identify the correctness. This is a software testing technique whereby explicit knowledge of the internal workings of the item being tested are used to select the test data. testing can never completely establish the correctness of computer software. Synonyms for white-box include: structural. structural. He or she can then see if the program diverges from its intended goal. The test is accurate only if the tester knows what the program is supposed to do. Although most of the intellectual processes of testing are nearly identical to that of review or inspection. Black Box Testing Testing of a function without knowing internal structure of the program. and the product answers with its behavior in reaction to the probing of the tester. 2. white box testing uses specific knowledge of programming code to examine outputs. Types of Testing 2. The quality of the application can and normally does vary widely from system to system but some of the common quality attributes include reliability. Synonyms for black-box include: behavioral.Aditi Technologies Basic Concepts of Software Testing 1. stability. where the "questions" are things the tester tries to do with the product. 2. maintainability and usability. functional. Black-box test design treats the system as a "black-box". so it doesn't explicitly use knowledge of the internal structure. but effective testing of complex products is essentially a process of investigation. White Box Testing White box testing is also known as glass box. glass-box and clear-box. White box testing does not account for errors caused by omission. not merely a matter of creating and following rote procedure. With that in mind. portability. Page 4 of 60 . Black-box and white-box are test design methods. Here comparison in the sense comparing the actual value with expected one. opaque-box. the word testing is connoted to mean the dynamic analysis of the product—putting the product through its paces. and all visible code must also be readable. Refer to the ISO standard ISO 9126 for a more complete list of attributes and criteria. Unlike black box testing. One definition of testing is "the process of questioning a product in order to evaluate it". and it focuses specifically on using internal knowledge of the software to guide the selection of test data. There are many approaches to software testing.1. completeness and quality of developed computer software. clear box and open box testing. In other words Testing is nothing but CRITICISM or COMPARISION.

Page 5 of 60 .3. The idea is to write test cases for every non-trivial function or method in the module so that each test case is separate from the others if possible. system testing. a unit test is a method of testing the correctness of a particular module of source code. Behavioral test design is slightly different from black-box test design because the use of internal knowledge isn't strictly forbidden.Documents the code Unit testing provides a sort of "living document" for the class being tested.4.3. This isolated testing provides four main benefits: 2. Unit Testing In computer programming. but it's still discouraged.Encourages change Unit testing allows the programmer to re-factor code at a later date. In practice. Unit testing is usually associated with structural test design. many people prefer the terms "behavioral" and "structural". 2. By testing the parts of a program first and then testing the sum of its parts will make integration testing easier.3. It is important to understand that these methods are used during the test design phase. This type of testing is mostly done by the developers. but others wish we'd stop talking about boxes altogether.3. 2. One has to use a mixture of different methods so that they aren't hindered by the limitations of a particular one.) can use any test design methods. 2.Simplifies Integration Unit testing helps eliminate uncertainty in the pieces themselves and can be used in a bottom-up testing style approach. Clients looking to learn how to use the class can look at the unit tests to determine how to use the class to fit their needs.2.3. Note that any level of testing (unit testing.Aditi Technologies Basic Concepts of Software Testing While black-box and white-box are terms that are still in popular use. it hasn't proven useful to use a single test design method. This provides the benefit of encouraging programmers to make changes to the code since it is easy for the programmer to check if the piece is still working properly. and make sure the module still works correctly (regression testing). and their influence is hard to see in the tests once they're implemented.3.Benefits The goal of unit testing is to isolate each part of the program and show that the individual parts are correct. 2. etc. Some call this "gray-box" or "translucent-box" test design. but this is because testers usually don't have well-defined requirements at the unit level to validate. It provides a written contract that the piece must satisfy.1.

thus minimizing dependencies in the system.5. assemblages (or groups of units). takes as its input modules that have been checked out by unit testing. The overall idea is the "building block" approach in which verified assemblages are added to a verified base which is then used to support the Integration testing of further assemblages. Therefore.4. are exercised through their interfaces using Black box testing. performance problems and any other system-wide issues. individual subsystems are exercised through their input interface. This is a mistake. Simulated usage of shared data areas and inter-process communication is tested.Separation of Interface from Implementation Because some classes may have references to other classes. A common example of this is classes that depend on a database. All test cases are constructed to test that all components within assemblages interact correctly. Unit testing is only effective if it is used in conjunction with other software testing activities. across procedure calls or process activations. and delivers as its output the integrated system ready for system testing.Purpose The purpose of Integration testing is to verify functional.3. In addition. These "design items". applies tests defined in an Integration test plan to those aggregates. As a result.6. This results in loosely coupled code. for example. the tester finds herself writing code that interacts with the database. the software developer abstracts an interface around the database connection. success and error cases being simulated via appropriate parameter and data inputs. Page 6 of 60 .1. 2.e. 2. because a unit test should never go outside of its own class boundary.4. 2.3.Aditi Technologies Basic Concepts of Software Testing 2. Integration testing Integration Testing is the phase of software testing in which individual software modules are combined and tested as a group. i. performance and reliability requirements placed on major design items. It follows unit testing and precedes system testing. testing a class can frequently spill over into testing another class. By definition. it only tests the functionality of the units themselves. it will not catch integration errors. it may not be trivial to anticipate all special cases of input the program unit under study may receive in reality. in order to test the class. and then implements that interface with their own Mock Object.Limitations It is important to realize that unit-testing will not catch every error in the program. groups them in larger aggregates.

Usually. performance testing is frequently used as part of the process of performance profile tuning. However.g. given as number of users vs.e. 2.5.. no one will have expressed what the maximum acceptable response time for a given population of users is. It is sometimes a difficult task to identify which part of the system represents this critical path. performance testing is testing that is performed to determine how fast some aspect of a system performs under a particular workload. etc. will result in the overall system running faster. Performance testing can be combined with stress testing. i. e. It can demonstrate that the system meets performance criteria.1. Or it can measure what parts of the system or workload cause the system to perform badly.5.Aditi Technologies Basic Concepts of Software Testing 2. Performance testing can serve different purposes. coordinating and gathering metrics from each of the injectors and collating performance data for reporting purposes.2. In performance testing. if it is made to respond faster. in order to see what happens when an acceptable load is exceeded –does the system crash? How long does it take to recover if a large load is reduced? Does it fail in a way that causes collateral damage? 2. a separate PC acts as a test conductor. response time. It can compare two systems to find which performs better. and some test tools come provided with (or can have add- Page 7 of 60 . The usual sequence is to ramp up the load – starting with a small number of virtual users and increasing the number over a period to some maximum. software engineers use tools such as profilers to measure what parts of a device or software contribute most to the poor performance or to establish throughput levels (and thresholds) for maintained acceptable response time. Sometimes the results can reveal oddities. In the diagnostic case. there are outliers of a few key transactions that take considerably longer to complete – something that might be caused by inefficient database queries. Performance Testing In software engineering.Technology Performance testing technology employs one or more PCs to act as injectors – each emulating the presence or numbers of users and each running an automated sequence of interactions (recorded as a script. The test result shows how the performance varies with the load. including Compuware Corporation's QACenter Performance Edition.5. it is often crucial (and often difficult to arrange) for the test conditions to be similar to the expected actual use. are available to perform such tests. Tools in this category usually execute a suite of tests which will emulate real users against the system. or as a series of scripts to emulate different types of user interaction) with the host whose performance is being tested. that while the average response time might be acceptable.Performance specifications Performance testing is frequently not performed against a specification. The idea is to identify the “weakest link” – there is inevitably a part of the system which. Various tools.

database access times. It is always helpful to have a statement of the likely peak numbers of users that might be expected to use the system at peak times. For example. Performance testing can be performed across the web. It can also be done in-house.6.Tasks to undertake Tasks to perform such a test would include: • • • • • • Analysis of the types of interaction that should be emulated and the production of scripts to do those emulations Decision whether to use internal or external resources to perform the tests.Aditi Technologies Basic Concepts of Software Testing ons that provide) instrumentation that runs on the server and reports transaction times. router configuration. either pass/fail. Set up of a configuration of injectors/controller Set up of the test configuration (ideally identical hardware to the production platform). There is an apocryphal story of a company that spent a large amount optimizing their software without having performed a proper analysis of the problem. often to a breaking point. but even having the most efficient idle loop in the world obviously didn’t improve overall performance one iota! Performance testing almost invariably identifies that it is parts of the software (rather than hardware) that contribute most to delays in processing users’ requests. Analyzing the results. Running the tests – probably repeatedly in order to see whether any unaccounted for factor might affect the results. 2. It involves testing beyond normal operational capacity. a web server may be stress tested Page 8 of 60 . quiet network (we don’t want results upset by other users). since it is known that the response times of the internet itself vary regionally. which can be analyzed together with the raw performance statistics. Stress Testing Stress Testing is a form of testing that is used to determine the stability of a given system or entity. in order to observe the results. They ended up rewriting the system’s ‘idle loop’. etc. and even done in different parts of the country. then an injector configuration could be used to test whether the proposed system met that specification. 2. If there can also be a statement of what constitutes the maximum allowable 95 percentile response time. where they had found the system spent most of its time.5. or investigation of critical path and recommendation of corrective action.3. although routers would then need to be configured to introduce the lag what would typically occur on public networks. deployment of server instrumentation. network overhead. Without such instrumentation one might have to have someone crouched over Windows Task Manager at the server to see how much CPU load the performance tests are generating.

bots. A designers' primary function should be more than appearance. and various denial of service tools to observe the performance of a web site during peak loads.Security Testing Techniques • • • • • • • • Vulnerability Scanning Network Scanning Password Cracking Log Views Virus Detect Penetration Testing File Integrity Checkers War Dialing 2. An external security vulnerability review by Third Eye Testing will give you the best possible confidence that your application is as secure as possible. Security within an application or web service is crucial to avoid such vulnerabilities and new threats. compromising usability and functionality. forcing designers to develop systems based on management expectations instead of people's needs. 2. This is often caused by pressure from the people in charge. During usability testing. manipulating parts. Stress testing a subset of load testing. or interpreting feedback. performance testing. Downtime. Data theft. then developers should improve the design and test it again.e. Designers commonly focus excessively on creating designs that look "cool". 2. the detection of application vulnerabilities requires independent evaluation of your specific application's features and functions by experts." Page 9 of 60 .7. whereas general human-computer interaction studies attempt to formulate universal principles. to discover errors and areas of improvement. Data corruption and application Defacement.7. If usability testing uncovers difficulties. "Caution: simply gathering opinions is not usability testing -. Usability testing focuses on a particular object or a small set of objects. While automated tools can help to eliminate many generic security issues. usability testing measures the usability of the object. Security Testing Application vulnerabilities leave your system open to attacks.1. a document. including making things work with people. such as people having difficulty understanding instructions. or a device) for its intended purpose. Also see testing. software testing.you must arrange an experiment that measures a subject's ability to use your document. i. the aim is to observe people using the product in as realistic a situation as possible. Usability Testing Usability testing is a means for measuring how well people can use some humanmade object (such as a web page.Aditi Technologies Basic Concepts of Software Testing using scripts. a computer interface.8.

In the pharmaceutical field. and what people like. Several other test instruments such as scripted instructions. Acceptance Testing User acceptance testing (UAT) is one of the final stages of a software project and will often occur before the customer accepts a new system. to which the system should conform.). it refers to a period of time during which a multi-dose product retains its quality after the container is opened. software will not run etc. and pre. Developers should have worked out these issues during unit testing and integration testing. the test subjects should be given the instructions and a box of parts. Results of these tests will allow both the customers and the developers to be confident that the system will work as intended. "Do you understand this?". 2.and post-test questionnaires are also used to gather feedback on the product being tested. to test the attachment function of an e-mail program.10. Test designers will draw up a formal test plan and devise a range of severity levels. a scenario would describe a situation where a person needs to send an e-mail attachment. 2. ideally. wherein the person performs a list of tasks using the product being tested while observers watch and take notes. illustration quality. The test scripts will emulate real-world usage of the system. and ask him or her to undertake this task. cosmetic problems) and show stoppers (major problems like the software crashing. Rather. The idea is that if the software works as intended and without issues during a simulation of normal use. Setting up a usability test involves carefully creating a scenario.Aditi Technologies Basic Concepts of Software Testing Rather than showing users a rough draft and asking.9.11. when testing instructions for assembling a toy. Instruction phrasing. The focus in this type of testing is less on simple problems (spelling mistakes. and the toy's design all affect the assembly process. paper prototypes. usability testing involves watching people trying to use something for its intended purpose. stability testing is an attempt to determine if an application will crash. or realistic situation. Page 10 of 60 . developers have derived from the User Requirements Specification. The aim is to observe how people function in a realistic manner. The technique popularly used to gather data during a usability test is called a think aloud protocol. Stability Testing In software testing. For example. it will work just the same in production. Users of the system will perform these tests which. so that developers can see problem areas. the focus is on a final verification of the required business function and flow of the system. For example. 2. Installation Testing Installation testing (in software engineering) can simply be defined as any testing that occurs outside of the development environment.

Product testing experts design the test process to take advantage of the economies of scope and scale that are present in a software product. A beta release is very close to the final release. 2. Ideally. It can then be handed over to testing staff for additional inspection in an environment similar to how it was intended to be used. however no serious or critical bugs would exist.13. Alfa Testing In software development. Whilst the ideal installation might simply appear to be to run a setup program.12. the software is released to a limited audience who would finally form the end users.14. This process helps in determining whether the final software meets its intended purpose and whether the end users would accept the same. 2. Only suitably organized and executed test process can contribute to the success of a software product. The product handed out as a Beta Release is not bug free. the deployment plan itself should be tested in an environment that is a replica of the live environment. Product Testing Software Product development companies face unique challenges in testing. In distributed systems. particularly where software is to be released into an already live target environment (such as an operational web site) installation (or deployment as it is sometimes called) can involve database schema changes as well as the installation of new software. Deployment plans in such circumstances may include back-out procedures whose use is intended to roll the target environment back in the event that the deployment is unsuccessful. This is often known as the second stage of alpha testing. This technique is known as black box testing. testing is usually required before release to the general public. Page 11 of 60 .Aditi Technologies Basic Concepts of Software Testing Such testing will frequently occur on the computer system the software product will eventually be installed on. In-house developers often test the software in what is known as 'ALPHA' testing which is often performed under a debugger or with hardware-assisted debugging to catch bugs quickly. 2. to use it / test it and come back with feedback or bugs. Beta Testing Many a time. the generation of that setup program itself and its efficacy in a variety of machine and operating system environments can require extensive testing before it can be used with confidence. A factor that can increase the organizational requirements of such an exercise is the need to synchronize the data in the test deployment environment with that in the live environment with minimum disruption to live operation.

Alpha testing and Beta testing are sub-categories of System testing. IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries. Regression testing is more of a limiting type of testing. 1990. integrated system to evaluate the system's compliance with its specified requirements. 2. System testing takes. The purpose of Integration testing is to detect any inconsistencies between the software units that are integrated together called assemblages or between any of the assemblages and hardware. System Testing According to the IEEE Standard Computer Dictionary. 2. As a rule. should require no knowledge of the inner design of the code or logic (IEEE. Page 12 of 60 . Regression testing takes. and as such. integrated system to evaluate the system's compliance with its specified requirements.16. NY. as its input. System testing is testing conducted on a complete. Regression testing falls within the scope of Black box testing. IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries. 1990. all bug previously identified and fixed is tested along with it's impacted areas to confirm the fix and it's impact if any. New York. Regression Testing Regression Testing is typically carried out at the end of the development cycle. Alpha testing and Beta testing are sub-categories of Regression testing. and as such. The purpose of Integration testing is to detect any inconsistencies between the software units that are integrated together called assemblages or between any of the assemblages and hardware. System testing falls within the scope of Black box testing. all of the "integrated" software components that have successfully passed Integration testing and also the software system itself integrated with any applicable hardware system(s).15. New York. should require no knowledge of the inner design of the code or logic (IEEE.Aditi Technologies Basic Concepts of Software Testing These activities are sequenced and scheduled so that a test activity occurs immediately following the construction activity whose output the test is intended to validate. During this testing. System testing is more of a limiting type of testing.). Regression testing is testing conducted on a complete. as its input. all of the "integrated" software components that have successfully passed Integration testing and also the software Regression itself integrated with any applicable hardware Regression(s). where it seeks to detect both defects within the "inter-assemblages" and also the system as a whole. According to the IEEE Standard Computer Dictionary.). As a rule. where it seeks to detect both defects within the "inter-assemblages" and also the system as a whole. NY.

database or other common repository. and check boxes for whether the test is automatable and has been automated. Test Cases. They can be as simple as a diagram for a testing environment or they could be a description written in prose. test step or order of execution number. It is (a) a story that is (b) motivating. They are usually different from test cases in that test cases are single steps and scenarios cover a number of steps. Test scripts should be written for modules with the highest risk of failure and the highest impact if the risk becomes an issue. spreadsheet. or even a test scenario. (d) complex. These past results would usually be stored in a separate table. system. and (e) easy to evaluate. A test case should also contain a place for the actual result. and regression testing. It can occasionally be a series of steps but with one expected result or expected outcome. A group of test cases may also contain prerequisite states or steps. It definitely contains a section where the tester identifies the system configuration used during testing.Aditi Technologies Basic Concepts of Software Testing 2. In a database system. The optional fields are a test case ID. Test suites and scenarios can be used in concert for complete system tests. Scripts and Scenario Black box testers usually write test cases for the majority of their testing activities. you may also be able to see past test results and who generated the results and the system configuration used to generate those results. thus ensuring you that the application is compatible with various hardware. operating system and browser versions. Collections of test cases are sometimes incorrectly termed a test plan. Compatibility testing service aims at locating application problems by running them in real environments. They may also be called a test script. Suits.18. related requirement(s). depth. Most companies that use automated testing will call the code that is used their test scripts. and its expected result. test category. 2. The ideal scenario test has five key characteristics. (c) credible. and descriptions. These steps can be stored in a word processor document. Most white box tester write and use test scripts in unit. The test suite often also contains more detailed instructions or goals for each collection of test cases. The most common term for a collection of test cases is a test suite. Larger test cases may also contain prerequisite states or steps. author. and descriptions of the following tests. along with various additional pieces of information.17. Page 13 of 60 . A test case is usually a single step. Compatibility Testing One of the challenges of software development is ensuring that the application works properly on the different platforms and operating systems on the market and also with the applications and devices in its environment. A scenario test is a test based on a hypothetical story used to help a person think through a complex problem or system.

The main approaches to implementing formal verification include state space enumeration. Often one refers to the overall checking process as V & V. Formal Verification In the context of hardware and software systems. Defect tracking systems are computer database systems that store defects and help people to manage them. 2.. Validation: "Are we building the right product?” i.20. E.e. which is more closely related to exploratory testing. testing. and reasoning with the aid of automatic theorem provers such as HOL or Isabelle. Page 14 of 60 . labeled transition systems (LTS) and their compositions..20. for a software product one can inspect the source code (static) and run against specific test cases (dynamic). timed automata and hybrid automata.e. System types that are considered in the literature for formal verification include finite state machines (FSM).. abstract interpretation. Defect tracking is important in software engineering as complex software systems typically have tens or hundreds of thousands of defects: managing. Usually formal verification is carried out algorithmically.1. abstraction refinement.g. and tracking them to closure. and abstractions of general software components. 2. using formal methods. does the product do what the user really requires. processalgebraic methods. Verification: "Are we building the product right?” i. evaluating and prioritizing these defects is a difficult task. Validation and Verification Verification is one aspect of testing a product's fitness for purpose. defect tracking is the process of finding defects in a product. (by inspection. combinatorial circuits. Defect Tracking In engineering. The properties to be verified are often described in temporal logics. cryptographic protocols. formal verification is the act of proving or disproving the correctness of a system with respect to a certain formal specification or property. 2. Validation is the complementary aspect. Petri nets. digital circuits with internal memory. or recording feedback from customers).19. The verification process consists of static and dynamic parts. but not the same as session-based testing. such as linear temporal logic (LTL) or computational tree logic (CTL). symbolic state space enumeration.Aditi Technologies Basic Concepts of Software Testing Scenario testing is similar to. does the product conform to the specifications. but the two concepts can be used in conjunction.

. • Database inputs are from tabular data. the product is tested by putting it through typical usages and atypical usages ("Can we break it?"). 2. Uses Fuzz testing is often used in large software development projects that perform black box testing. with fuzz test failures actually being more useful as a bug-finding tool than fuzz test passes as an assurance of quality. by crashing. or by failing in-built code assertions). i. The great advantage of fuzz testing is that the test design is extremely simple. fuzz testing can only be regarded as a proxy for program correctness. The advantage here is that the cost of generating the tests is relatively low. 2.21. the test data is preserved. and free of preconceptions about system behavior. Thus.21. For this reason. then there are defects to correct. Fuzz testing is also used as a gross measurement of a large software system's quality. so that if the computer fails dramatically. third party testers have used fuzz testing to evaluate the relative merits of different operating systems and application programs. and even careful human test designers would fail to create tests for.e.1. rather than a direct measure. However. • Character driven inputs are from files or data streams.2. There are at least two different forms of fuzz testing: Page 15 of 60 . For example. If the program fails (for example.21. or possibly from a mechanism in an embedded system. fuzz testing is not a substitute for exhaustive testing or formal methods: it can only provide a random sample of the system's behavior. Fuzz testing is thought to enhance software security and software safety because it often finds odd oversights and defects which human testers would fail to find. and in many cases passing a fuzz test may only demonstrate that a piece of software handles exceptions without crashing. Fuzz testing methods As a practical matter. developers need to reproduce errors in order to fix them. rather than behaving correctly. These usually have a budget to develop test tools. The basic idea is to attach the inputs of a program to a source of random data. almost all fuzz testing makes a record of the data it manufactures. and fuzz testing is one of the techniques which offer a high benefit to cost ratio. Modern software has several different types of inputs: • Event driven inputs are usually from a graphical user interface. usually before applying it to the software. Fuzz Testing Fuzz testing is a software testing technique. 2.Aditi Technologies Basic Concepts of Software Testing Validation usually can only be done dynamically. such as relational databases.

A combined approach uses valid test data with some proportion of totally random input injected. Event-driven fuzz Normally this is provided as a queue of data-structures. not handling every possible binary value.4. One of the more interesting issues with real-time event handling is that if error reporting is too verbose. Robust error detection systems will report only the most significant or most recent error over a period of time.3. Character-driven fuzz Normally this is provided as a stream of random data. or conforms to actual production data. when the character data exceeds the available buffer space. 2.21. The most common problem with an event-driven program is that it will often simply use the data in the queue. To succeed in a fuzz-tested environment. Some IT shops use software tools to migrate and manipulate such databases. often the database is more tolerant of odd data than its client software. software must validate all fields of every queue entry. The queue is filled with data structures that have random values. 2. because input and comparison constraints reduce the invalid data in a database. and then ignore impossible requests.Aditi Technologies Basic Concepts of Software Testing • • • Valid fuzz attempts to assure that the random input is reasonable. without even crude validation.21. Since major customer and enterprise management Page 16 of 60 . Database fuzz The standard database scheme is usually filled with fuzz that is random data of random sizes. One common problem with a character driven program is a buffer overrun. fuzz-generated randomness can test the un-designed behavior surrounding a wider range of designed system states. and a general-purpose interface is available to users. Often the same schema descriptions can be used to automatically generate fuzz databases. This problem tends to recur in every instance in which a string or number is parsed from the data stream and placed in a limited-size area. Simple fuzz usually uses a pseudo random number generator to provide input. By using all of these techniques in combination. Another is that decode tables or logic may be incomplete. decode every possible binary value.21. 2. Fuzz testing may use tools to simulate all of these domains. The classic source in UNIX is the random data generator. Database fuzz is controversial.5. However. simply providing error status can cause resource problems or a crash.

Aditi Technologies

Basic Concepts of Software Testing

software is starting to be open-source, database-based security attacks are becoming more credible. A common problem with fuzz databases is buffer overrun. A common data dictionary, with some form of automated enforcement is quite helpful and entirely possible. To enforce this, normally all the database clients need to be recompiled and retested at the same time. Another common problem is that database clients may not understand the binary possibilities of the database field type, or, legacy software might have been ported to a new database system with different possible binary values. A normal, inexpensive solution is to have each program validate database inputs in the same fashion as user inputs. The normal way to achieve this is to periodically "clean" production databases with automated verifiers.

3. Manual Testing
3.1.
• • •

Facts
In India itself, Software industry growth has been phenomenal. IT field has enormously grown in the past 50 years. IT industry in India is expected to touch 10,000 crores of which software share is dramatically increasing.

3.2.
• • •

Software Crisis
Software cost/schedules are grossly inaccurate. Cost overruns of several times, schedule slippage’s by months, or even years are common. Productivity of people has not kept pace with demand. Added to it is the shortage of skilled people. Productivity of people has not kept pace with demand Added to it is the shortage of skilled people.

3.3.
• • • • • •

Software Myths
Software Management is different. Why change or approach to development? We have provided the state-of-the-art hardware. Problems are technical If project is late, add more engineers. We need better people.

3.3.1.Management Myths

3.3.2.Developers Myths
• • • • We must start with firm requirements Why bother about Software Engineering techniques, I will go to terminal and code it. Once coding is complete, my job is done. How can you measure the quality...it is so intangible.

Page 17 of 60

Aditi Technologies

Basic Concepts of Software Testing

3.3.3.Customer’s Myth
• • A general statement of objective is good enough to produce software. Anyway software is “Flex-ware”, it can accommodate my changing needs.

3.3.4.What do we do?
• • • • Use Software Engineering techniques/processes. Institutionalize them and make them as part of your development culture. Adopt Quality Assurance Frameworks : ISO, CMM Choose the one that meets your requirements and adopt where necessary.

3.4.

Software Quality Assurance:

The purpose of Software Quality Assurance is to provide management with appropriate visibility into the process being used by the software project and of the products being built. • Software Quality Assurance involves reviewing and auditing the software products and activities to verify that they comply with the applicable procedures and standards and providing the software project and other appropriate managers with the results of these reviews and audits.

3.4.1.Verification:
• • Verification typically involves reviews and meetings to evaluate documents, plans, code, requirements, and specifications. The determination of consistency, correctness & completeness of a program at each stage.

3.4.2.Validation:
• • Validation typically involves actual testing and takes place after verifications are completed The determination of correctness of a final program with respect to its requirements.

3.5.
• • • •

Software Life Cycle Models:
Prototyping Model Waterfall Model – Sequential Spiral Model V Model - Sequential

3.6.

What makes a good Software QA engineer?

The same qualities a good tester has are useful for a QA engineer. Additionally, they must be able to understand the entire software development process and how it can fit into the business approach and goals of the organization.

Page 18 of 60

Aditi Technologies

Basic Concepts of Software Testing

Communication skills and the ability to understand various sides of issues are important. In organizations in the early stages of implementing QA processes, patience and diplomacy are especially needed. An ability to find problems as well as to see 'what's missing' is important for inspections and reviews.

3.7.
• • • • • •

Testing:
An examination of the behavior of a program by executing on sample data sets. Testing comprises of set of activities to detect defects in a produced material. To unearth & correct defects. To detect defects early & to reduce cost of defect fixing. To avoid user detecting problems. To ensure that product works as users expected it to.

3.7.1.Why Testing?
• • • • To To To To unearth and correct defects. detect defects early and to reduce cost of defect fixing. ensure that product works as user expected it to. avoid user detecting problems.

3.8.
• • • • • • • •

Test Life Cycle
Identify Test Candidates Test Plan Design Test Cases Execute Tests Evaluate Results Document Test Results Casual Analysis/ Preparation of Validation Reports Regression Testing / Follow up on reported bugs.

3.9.
• • •

Testing Techniques
Black Box Testing White Box Testing Regression Testing

These principles & techniques can be applied to any type of testing.

3.10.

Test Plan:

A Test Plan is a detailed project plan for testing, covering the scope of testing, the methodology to be used, the tasks to be performed, resources, schedules, risks, and dependencies. A Test Plan is developed prior to the implementation of a project to provide a well defined and understood project roadmap.

Page 19 of 60

software.1. It provides a repeatable. and internal design specifications and other necessary documents. coverage analyzers. load. etc. etc. error classes Prepare test plan document and have needed reviews/approvals Write test cases Have needed reviews/inspections/approvals of test cases Prepare test environment and test-ware. set up logging and archiving processes. communications. required standards and processes (such as release processes. comprehensive definition of a testing campaign. and test ware through life cycle • • • • • • • • • • • • • • • • • • 4. problem/bug tracking. obtain needed user manuals/reference documents/configuration guides/installation guides. functional design.1. change processes. reporting requirements. timelines. and determine scope and limitations of tests. usability tests.) Determine test input data requirements Identify tasks. set up or obtain test input data Obtain and install software releases Perform tests Evaluate and report results Track problems/bugs and fixes Retest as needed Maintain and update test plans.) Identify application's higher-risk aspects.10. set up test tracking processes. Determine project-related personnel and their responsibilities. etc. Determine test environment requirements (hardware. A Test Specification is produced as the first step in implementing a Test Plan. test environment. set priorities. boundary value analyses. etc. Bug Tracking What's a 'test case'? Page 20 of 60 . test tracking. Test Specification: A Test Specification defines exactly what tests will be performed and what their scope and objectives will be. functional. Obtain budget and schedule requirements.unit.Aditi Technologies Basic Concepts of Software Testing 3. milestones Determine input equivalence classes. and labor requirements Set schedule estimates.) Determine test-ware requirements (record/playback tools. test cases. prior to the onset of manual testing and/or automated test suite development. 4. Testing Procedure The following are some of the steps to consider: • • Obtain requirements. those responsible for tasks. integration. Determine test approaches and methods . system.

Aditi Technologies Basic Concepts of Software Testing • • A test case is a document that describes an input. screen. The following are items to consider in the tracking process: Complete information such that developers can understand the bug. 'New'. For this reason. ID. fixes should be re-tested. 'Released for Retest'. feature.. action. module. get an idea of it's severity. A variety of commercial problem-tracking/management software tools are available (see the 'Tools' section for web resources with listings of such tools). it should encapsulate these processes. test case name. object. objective. input data requirements. used in test File excerpts/error messages/log file excerpts/screen shots/test tool logs that would be helpful in finding the cause of the problem Severity estimate (a 5-level range such as 1-5 or 'critical'-to-'low' is common Was the bug reproducible? Tester name Test date Bug reporting date Name of developer/group/organization the problem is assigned to Description of problem cause Description of fix Code section/file/module/class/method that was fixed Date of fix Application version that contains the fix Tester responsible for retest Retest date Retest results • • • • • • • • • • • • • • • • • • • • • • • • • • Page 21 of 60 . Note that the process of developing test cases can help find problems in the requirements or design of an application. since it requires completely thinking through the operation of the application. After the problem is resolved. etc. steps. or event and an expected response.) The application name or identifier and version The function. What should be done after a bug is found? • The bug needs to be communicated and assigned to developers that can fix it. A test case should contain particulars such as test case identifier. relevant hardware specifics Test case name/number/identifier One-line bug description Full bug description Description of steps needed to reproduce the bug if not covered by a test case or if the developer doesn't have easy access to the test case/test script/test tool Names and/or descriptions of file/data/messages/etc. etc. where the bug occurred Environment specifics. and reproduce it if necessary. etc. If a problem-tracking system is in place. Bug identifier (number. to determine if a feature of an application is working correctly.) Current bug status (e.g. platform. and determinations made regarding requirements for regression testing to check that fixes didn't create problems elsewhere. system. test conditions/setup. it's useful to prepare test cases early in the development cycle if possible. and expected results.

work already completed that may have to be redone or thrown out. Programming errors . like anyone else.Aditi Technologies Basic Concepts of Software Testing • • • • Regression testing requirements Tester responsible for regression tests Regression testing results A reporting or tracking process should enable notification of appropriate personnel at various stages. can make mistakes. rescheduling of engineers. client-server and distributed applications. enormous relational databases. Time pressures . data communications. often requiring a lot of guesswork. etc. Egos . mistakes will be made. For instance.programmers. If there are many minor changes or any major changes. Changing requirements .it's tough to maintain and modify code that is badly written or poorly documented. known and unknown dependencies among parts of the project are likely to interact and cause problems. In some fast-changing business environments. continuously modified requirements may be a fact of life. Software complexity . developers need to know when bugs are found and how to get the needed information. And the use of objectoriented techniques can complicate instead of simplify a project unless it is well engineered. until I take a close look at it' o 'we can't figure out what that old spaghetti code did in the first place' If there are too many unrealistic 'no problems'.people prefer to say things like: o 'no problem' o 'piece of cake' o 'I can whip that out in a few hours' o 'it should be easy to update that old code' Instead of: o 'that adds a lot of complexity and we could end up o making a lot of mistakes' o 'we have no idea if we can do that. the result is bugs. Enthusiasm of engineering staff may be affected. hardware requirements that may be affected. In many • • • • • • • Page 22 of 60 .as to specifics of what an application should or shouldn't do (the application's requirements). When deadlines loom and the crunch comes. Why does software have bugs? • • Miscommunication or no communication . effects on other projects. and the complexity of keeping track of changes may result in errors.redesign.the customer may not understand the effects of changes. Poorly documented code . and QA and test engineers must adapt and plan for continuous extensive testing to keep the inevitable bugs from running out of control. or may understand and request them anyway . In this case. and sheer size of applications have all contributed to the exponential growth in software/system complexity. the result is bugs.scheduling of software projects is difficult at best. we'll wing it' o 'I can't estimate how long it will take. management must understand the resulting risks. testers need to know when retesting is needed. Windows-type interfaces. and reporting/summary capabilities are needed for managers.the complexity of current software applications can be difficult to comprehend for anyone without experience in modern-day software development.

profiler. Software development tools . class libraries. AppPerfect DevSuite Suite of testing. Tag Libs. and a component recognition algorithm that takes into account a variety of attributes. Recorded GUI elements. and there's job security if nobody else can understand it ('if it was hard to write. Useful for testing CORBA. Introscope Performance monitoring tool from Wily Technology. it should be hard to read'). user actions and associated data are automatically integrated into an editable tree view reflecting the hierarchical structure of the application's GUI. scripting tools. without implementing test clients. tuning. often introduce their own bugs or are poorly documented. and contract (black box) test tool from TreborSoft. regression testing for JAVA VM upgrades.2.visual tools. Includes: Unit Tester. metrics. Enables test case and test script development without programming. Filters. and monitoring products for java development from AppPerfect Corp. GUI interface emphasizing ease of use. intuitive views of interrelation between system components and application infrastructure. regression. presents data in easy-to-use customizable dashboards which enable deep. Includes a natural user interface. etc. understandable code. In fact. compilers. 5. etc. EJBs. Testing Tools and Software 5. Java/J2EE Profiler and other modules. Java test Tools Java Development Tools Java coverage. Monitors applications as soon as installed no coding is needed. Intent is to allow fine-grained continuous testing of all files Page 23 of 60 . Included 'LeakHunter'identifies potential memory leaks. Test private and protected functions. execution and management of automated Java/Swing application tests. RMI. resulting in added bugs. Extensive documentation.Aditi Technologies Basic Concepts of Software Testing • organizations management provides no incentive for programmers to document their code or write clear. scripting capabilities. Code Analyzer. and other server technologies as well. GJTester Java unit. it's usually the opposite: they get points mostly for quickly turning out code. Cactus A simple open-source test framework for unit testing server-side java code (Servlets. 'Transaction Tracer' can provide detailed tracing of execution paths and component response times for individual transactions in production systems. and server application's modules. Load and Performance Test Tools AppPerfect DevSuite 5. qftestJUI Record/playback test tool from Quality First Software for creation. and clone detection tools from Semantic Designs.).1.

JUnit . Also available as plugins for JBuilder and Eclipse. Provides recording and playback capabilities. a script editor/recorder. Intended for use where there are performance/scalability requirements that need re-checking while refactoring code. Integrates with Ant and JUnit. etc) through an in-container approach. for which JUnit may be sufficient). which can then be run automatically and independent of other JUnit tests. HTML. using Ant. QStudio for Java Java code inspection tool from QA Systems allows automation of a major portion of code inspection process. For use by developers implementing unit tests in Java. capability of working directly on Java method binaries (no recompilation).awt. Free Open Source Software from SourceForge site. or from the command line. and session merging to allow compilation of overall results for distinct executions. Supports customizing existing rules and defining custom rules. licensed under the BSD License. TEXT) or custom report generation. Free Open Source Software released under the IBM Public License and hosted on SourceForge. LaTex. Site includes a large collection of extensions and documentation. Enables quick composition of a performance test suite. Abbot Java GUI Test Framework Testing framework by Timothy Wall provides automated event generation and validation of Java GUI components.Aditi Technologies Basic Concepts of Software Testing making up an application: source code but also meta-data files (such as deployment descriptors. Koalog Code Coverage Code coverage analyzer for Java applications from Koalog SARL. JUnitPerf Allows performance testing to be dynamically added to existing JUnit tests. for early detection of software defects and automatic assessment of code quality. Suitable for use both by developers for unit tests and QA for functional testing. Jemmy A Java library that is used to create automated tests for Java GUI applications. Couples advanced static analysis capabilities to ISO 9126 quality standard framework. predefined (XML. It uses JUnit and extends it. (Abbot = "A Better 'Bot').available under the GNU Lesser General Public License. CSV. From Apache Software Foundation. The framework may be invoked directly from Java code or accessed without programming through the use of scripts via 'Costello'. Integrates with leading Java Development Environments and platforms. Free . Includes: in-process or remote coverage computation. By Mike Clark/Clarkware Consulting.Robot class. improving upon the very basic functions provided by the java. jfcUnit Framework for developing automated testing of Java Swing-based applications at the UI layer (as opposed to testing at lower layers. Typically use within your IDE.Framework to write repeatable java unit tests A regression testing framework written by Erich Gamma and Kent Beck. Contains Page 24 of 60 .

TrueJ Source code audit and metrics tool from BlueBay systems. integrates with a variety of editors/IDE's. class. HTML. C. Fifty different audits and metrics. JBench Freeware Java benchmarking framework to compare algorithms.e.. Java Tool Suite from Man Machine Systems Includes JStyle. Available as binary distribution (including documentation). an intelligent Java code evolution analyzer that automatically analyzes multiple versions of a Java program and shows how various classes have evolved across versions. or via a Swing GUI. package. reView Java source code visualization tool from Headway Software. a syntax testing tool that automatically builds a Java-based test data generator. and dependencies for Java. Cyclomatic Number. Coverage API provided. it can be used separately as well as together with the NetBeans IDE. button pushing.Aditi Technologies Basic Concepts of Software Testing methods to reproduce all user actions which can be performed on Swing/AWT components (i. PDF. methods. JPretty reformats Java code according to specified options. JMSAssert. user-friendly performance diagnosis tool from Quest Software for Page 25 of 60 . for speed. . Clover Code coverage tool for Java from Cenqua. a Java source analyzer to generate code comments and metrics such as inheritance depth. JemmyTest is a program written in Java which uses the Jemmy API to test applications.). Shows all dependencies.. configurable. Fully integrated plugin for NetBeans. JEvolve. control flow analysis and diagramming. or jar file. integrates with build tools for quality gate and reporting. and C++ applications. and J_Playback for GUI operation capture and automatic playback. JBrowser class browser. text typing.. JBuilder. Gathers coverage measures of branches. at all levels and between all levels. method. virtual machines. etc. statements. tree node expanding. file. source distribution. PerformaSure Low-overhead. highly scalable. Panorama for Java Visual environment containing six integrated java tools from ISA. can 'reason' about selective need for regression testing Java classes. components. JVerify Java class/API testing tool uses an invasive testing model allowing access to internals of Java objects from within a test script and utilizes a proprietary OO scripting language. JCover Java code test coverage analysis tool from Codework Limited. JSynTest. Inc. J_DocGen for Java code static analysis. a tool and technique for writing reliable software. Halstead Measures. compiler-style output. JCover test coverage analyzer. Reverse engineer and automatically lay out and view code. Coverage difference comparison between runs. J_Diagrammer for Java code logic analysis. etc. etc. J_SQA for ObjectOriented software quality measurement. Works with source or compiled files. J_Test for test coverage analysis and test case minimization. classes. application. package and produces reports in multiple formats. and other IDE's. Seamless integration with projects using Apache ANT. J_Structure for Java code structure analysis and diagramming. View coverage data in XML.

includes Java support. JProbe Developer Suite Collection of Java debugging tools from Quest Software. includes JProbe Profiler and JProbe Memory Debugger for finding performance bottlenecks and memory leaks. VTune Intel's performance tuning tool for applications running on Intel processors. Includes Cyclomatic Complexity. complexity. Includes suggestions for optimization techniques. It automatically generates and executes JUnit tests and checks whether code follows 400 coding standards and can automatically correct for many. Sun's Java Test Tools As of February 4. Integrates with several Java IDE's. (Note: some other tools in these listings also handle testing. Enhanced Cyclomatic Complexity. JProfiler freeware version available. thread debugger. to diagnose and resolve performance bottlenecks. stalls.Aditi Technologies Basic Concepts of Software Testing distributed J2EE applications. Hundreds of easily-confugured run-time. servlets. written in Java. and size metrics related to reusability. and clarity. or are planning to add such capabilities. procedural. OS. thread and event analysis. and code coverage tool suite from Borland (formerly from VMGear). Check listed web sites for current information. testability. Jtest ParaSoft's Jtest is an integrated. management. maintainability.) Page 26 of 60 . LProbe Coverage code coverage tool. or load testing of java applets. LOC metrics and MOOD metrics. and race conditions. 2000 Sun discontinued accepting orders for these products. Halstead Software Science metrics. and JProbe Threadalyzer for finding deadlocks. TCAT for Java Part of Software Research's TestWorks suite of test tools. code coverage analyzer and code analysis for Java. coverage analysis. DevPartner Java Edition Compuware's (formerly NuMega) debugging/productivity tool to detect and diagnose Java bugs and memory and performance problems. automatic unit testing and standards compliance tool for Java. OptimizeIt Profiler. and applications. Traces and reconstructs execution path of end-user transactions across all components of a clustered multi-tieer J2EE system. Krakatau Metrics for Java Software metrics tool from Power Software includes more than 70 OO. Has online advisor for quality improvement. and network metrics.

for Windows. CSV. evaluation version available. Link Checker Pro Link check tool from KyoSoft. Ideal for dynamic sites requiring frequent link checking. Freeware 'REL Link Checker Lite' version available for small sites. Identifies orphan files and broken links when browsing files. For Windows platforms. detects and reports redirected URL.Aditi Technologies Basic Concepts of Software Testing 5. familiar interface for managing files. employs a simple. provides multiple-level undo/redo for all operations. For Windows. can be automatically scheduled. SiteAnalysis Hosted service from Webmetrics. Export to text. InfoLink Link checker program from BiggByte Software. HTTPS. Link Checking Tools HiSoftware Link Validation Utility Link validation tool. such as internal and external links. updates links to moved and renamed files. can also produce a graphical site map of entire web site.3. For Windows. Xenu's Link Sleuth Freeware link checker by Tilman Hausherr. supports SSL websites. several report formats available. Alert Linkrunner Link check tool from Viable Software Alternatives. Runs as often as every hour. Site Map. Excel. Site Audit Low-cost on-the-web link-checking service from Blossom Software. DNS servers and SSL certificates. Web Link Validator Link checker from REL Software checks links for accuracy and availability. ChangeAgent Link checking and repair tool from Expandable Language. Automatically-scheduled reporting by e-mail. replaces links but does not reformat or restructure HTML code. free trial period available. RTF.. Page 27 of 60 . and FTP protocols. finds broken links or paths and links with syntactic errors. or as infrequent as once a week. partial testing of ftp and gopher sites. fixes broken links with an easy. includes FTP link checking. free version or low-cost pro version. For Windows. customizable reports. HTML. 3-click process. domain names. Handles HTTP. previews files when fixing broken links and before orphan removal. multiple page list and site list capabilities. used to test and validate critical website components. Linkalarm Low cost on-the-web link checker from Link Alarm Inc.

binary avaialable for Linux. relocations. This site contains an interesting discussion on the use of META tags. For Windows. LinkScan Electronic Software Publishing Co.0 or 3.5.'s link checker/site mapping tool. Available as source code or binaries. capabilities include automated retesting of problem links. ability to check password-protected areas. 5. Web Functional and Regression Testing Tools IeUnit IeUnit is an open-source simple framework to test logical behaviors of web pages. For Windows. Has not been updated in recent years.net. Includes capabilities for central management of large multiple intranet/internet sites. support of proxy servers for remote URL checking. MOMspider Multi-Owner Maintenance Spider. Not updated in recent years. HTMLchek for awk or perl Old but still useful HTML 2. randomized order checking. by Francois Pottier. Churchyard. ID/Password entries. page size analysis. site has much documentation and related info. and finding problem HTML areas. Windows. For automatic fixing of HTML errors. but old versions still available as freeware. HTML syntax error checking. can check for bad links due to specified problems such as server-not-found. originally by Dave Raggett. HTML TIDY Free utility available from SourceForget. reports URLs changed since last checked. It helps users to create. Results stored in database. timeouts.Aditi Technologies Basic Concepts of Software Testing changed-link checking. Windows. configurable. Validates hyperlinks for all major protocols. CyberSpyder Link Test Shareware link checker by Aman Software.0 validator programs for AWK or PERL by H. Not updated in recent years. formatting disorganized editing. 5. results can be exported to database. unauthorized-access. Discontinued. reports of orphan files and files with mismatching case. Includes cross referenced and hyperlinked output reports. Utilizes the HTTP 'HEAD' request instead of the 'GET' request so that it does not require retreival of the entire html page. organize and Page 28 of 60 . Handles one URL at a time. Perl Testing Tools W3C Link Checker Link checker PERL source code. support for all standard server-side image maps.4. Available as source code. Big Brother Freeware command-line link checker for Unix. via the WWW Consortium (the folks who set web standards). capabilities include specified URL exclusions. allowing for customizable queries and reports. test resumption at interruption point. 'what's new' reporting. PERL script for a web spider for web site maintenance. Mac. for UNIX and PERL. link checker. LinkLint Open source Perl program checks local/remote HTML links. For all UNIX flavors. Distributed under Gnu General Public License. released under IBM's Common Public License. doc-not-found.

servlets.EXE files to enable running web macros on demand and integration into other software frameworks. includes web functional testing capabilities. Test Complete Enterprise Automated test tool from AutomatedQA Corp. supports ASP. Implemented in JavaScript for the Windows XP platform with Internet Explorer. files. HTML. Can be used to unit test any individual component with an HTTP interface (JSP. For Windows and MSIE. run-time debugging features. Enables creation of scenarios from spreadsheets. HTML-based test result reports can be generated.) or it can be used to create a suite of HTTP level functional or regression tests. Supports multiple OS's and browsers. that includes a web functional testing module. JSP. robust handling of page modifications. autocomplete. automatic recording of any Web browser events and translates into an Python editable scripts. PHP. actiWate Java-based Web application testing environment from Actimind Inc. Includes syntax-coloring editor with intellisense. QEngine Test tool from AdventNet enables functional testing of Web sites and Web-based applications. provision to add GUI. Record and playback capability. QEngine Web Test Studio Web functional test tool from AdventNet. Includes a test runner with GUI interface. Macro recorder transforms any click to a C# directive. Supports keyword-driven testing. built-in exception handling and reporting facility. retry on error. Test data from any database or Excel spreadsheet can be mapped to enter values automatically into HTML form controls. SSL. Shareware for Windows/MSIE. KUMO Editor Toolset from Softmorning LTD for creation and editing of web macros and automated web tests. Includes Script Editor. WebInject Open source tool in PERL for automated testing of web applications and services. HtmlUnit etc. Page 29 of 60 . Can export created . Advanced framework for writing test scripts in Java (similar to open-source frameworks like HttpUnit. Records browser interaction by element instead of screen coordinates. ASP. but with extended API). Supports handling dynamic content created by JavaScript.Web browser plug-in module to assist the test writing process. data-driven Test wizard to fetch script data from external source. Secure recording on password fields. cookies. JStudio SiteWalker Test tool from Jarsch Software Studio allows capture/replay recording. eastern and western European languages. and monitoring products from AppPefect Corp. JavaScript's Document Object Model enables full access to all document elements. HTML forms. tuning. Application Map Editor to view and edit the map object properties. AppPerfect DevSuite Suite of testing. etc. Works with a variety of browsers and OS's. fail definitions can be specified for each step of the automated workflow via JavaScript.Aditi Technologies Basic Concepts of Software Testing execute functional unit tests.DLL and . Free and professional versions available. Page objects navigator allows browsing of hierarchy of web objects in a page. integrates with a variety of IDE's. and loop. Scripting uses Jython. Works with Internet Explorer. CGI. page titles and HTML element properties. and Test Writing Assistant . records using page elements controls symbolically rather than with raw screen coordinate. Multilingual for Asian. Freeware. Database and File checkpoints and verify database tables.

Utilizes a distributed testing model and consists of three parts: STC Administrator. and other typical business web application features. Adaptable and MultiThreaded Playback Engine. Includes all of the typical functions that would be expected from JUnit and the PHPUnit ports. TestSmith Functional/Regression test tool from Quality Forge. Enables 'Persistent Acceptance Testing' that activates tests each time a web application is used. STC Master and STC Master Service. and can be adapted to any reporting style or requirements. Free including source code. Can group tests into a testsuite that again can be part of a bigger testsuite. TestCaseMaker/Runner Test case document driven functional test tool for web applications from Agile Web Development. can be inserted during a recording. Key features besides capture/playback include automatically detecting and capturing standard and custom content errors. Test results are reported in either plain text or XML format for later presentation via XSLT. Canoo WebTest Free Java Open Source tool for automatic functional testing of web applications. and Runner executes the test case document. This includes web page navigation. Standard reporting XSLT stylesheets included. until recording capabilities are added. test case documents are always synchronized with the application. Controls are recorded as individual objects independent of screen positions or resolution. WinTask Macro recorder from TaskWare. Handles Applets. SimpleTest Open source unit testing framework which aims to be a complete PHP developer test solution. such as bitmap or text matching. scripts have to be developed manually. TestAgent Capture/playback tool for user acceptance testing from Strenuus. Utilizes HttpUnit behind the scenes. Editable scripts can be recorded in SmithSript language or in Java. and a Data-Driven. but all recorded items are validated and logged 'on the fly'. Includes an Intelligent. Includes capability to expand scope of macros by editing and adding loops. 90-day evaluation copy available. Maker creates test case documents. C++ or C++/MFC. (300+ commands). cookie testing and form submission.Aditi Technologies Basic Concepts of Software Testing Site Test Center Functional and performance test tool from Alliance Software Engineering. but also adds mock objects. etc. ensure robustness of scripts with Synchronization commands. The simple navigation methods and ready-to-use assertions allow for more rapid test creation than using only JUnit and HttpUnit. Reports information needed to troubleshoot problems. automates repetitive tasks for Web site testing (and standard Windows applications). with its HTML objects recognition. Flash. Page 30 of 60 . animated bitmaps. Has an XMLbased scripting capability to enable modifying captured scripts or creating new scripts. etc. Fuzzy matching capabilities. LLC. jWebUnit Open source Java framework that facilitates creation of acceptance tests for web applications. Active-X controls. form entry and submission. XMLbased test script code is editable with user's preferred XML editor. validation of table contents. HTML/DOMAware and Object Mode Recording Engine. Provides a high-level API for navigating a web application combined with a set of assertions to verify the application's correctness including navigation via links. Special validation points. Includes a WinTask Scheduler. playback window/size can be different than in capture. has some JWebUnit functionality as well. branching statements.

Records HTTP messages by acting as a Web proxy. extensible IDE). Perl dbi database access. Includes capability for automated scripting. Perl module that allows a user to automate use of IE via Perl scripts. etc). many Perl cpan library functions. broken links and the structure of the crawled web. For Windows platforms. HTTP requests and responses are fully displayed in order to inspect and customize their content. Advanced object binding reduces script changes when Web-based apps change. It can test thousands of test scenarios without use of any scripts. PureTest Free tool from Minq Software AB. HTTP-WebTest A Perl module which runs tests on remote URLs or local Web files containing Perl/JSP/HTML/JavaScript/etc. Utilizes Collections. and parsing of response codes or parsing page content for expected or unexpected strings. recorded sessions can be saved as XML and reopened later. Supports HTTPS/SSL. Includes a scenario debugger including single step. QA Wizard Automated functional web test tool from Seapine Software. Includes a Task API for building custom test tasks. reporting various metrics. Testers enter test data into a spreadsheet used to populate objects that appear for the particular test scenario defined. Written in ActivePerl. and generates a detailed test report. and assertions to responses in order to validate a scenario during its playback. screen names. Events and Properties exposed by the DHTML Object Model. or logic associated with the engine. Allows creation of completely new test scenarios without ever having performed that test before. The Web Crawler is useful for verifying consistency of a static web structure. Create scenarios using the point and click interface. For Windows.GUI Unique test automation tool from Omsphere LLC. Free Demo and Test Script available. Free for most uses. Allows the attachment of extraction or replacement rules to any HTTP message content.. This module comes with a set of default Page 31 of 60 . allowing creation of more scripts in less time. Plugins can define test types and provide additional report capabilities. has an intelligent state machine engine that makes real-time decisions for navigating through the GUI portion of an application. dynamic Web applications. This module can be used "as-is" or its functionality can be extended using plugins. Uses IE's built in COM object which provides a reference to the DOM for each browser window or frame. allowing inheritance of all Perl functionality including regular expressions. Badboy Tool from Bradley Software to aid in building and testing dynamic web based applications. Multi-platform written in Java. Easy development and maintenance .'Simple Automated Module For Internet Explorer'. data driven scenarios. SAMIE Free tool designed for QA engineers . Methods. includes an HTTP Recorder and Web Crawler. Next-generation scripting language eliminates problems created by syntax or other language errors. testware architecture (object names. Supports unlimited set of ODBC-compatible data sources as well as MS Excel.Aditi Technologies Basic Concepts of Software Testing MITS. source code avalable. and more. all without changing tool. break points and response introspection. tab/comma delimited file formats. Combines sophisticated capture/replay ability with performance testing and regression features. Solex Web application testing tool built as a plug-in for the Eclipse IDE (an open.no need to keep track of GUI maps for each window. PAMIE Free open-source 'Python Automated Module For Internet Explorer' Allows control of an instance of MSIE and access to it's methods though OLE automation .

CSS. Records any combination of browsing. Playback can run in background while other tasks are performed on the same machine. and allows Java test code to examine returned pages as text. Works by remote controlling the browser. or MS VBA can be used for customized scripting. Utilizes multiple validation methods. and links.net/Open Source Development Network. For Windows and MSIE. utilizes a new approach to recording/playback of web browser scripts. or containers of forms. designed and implemented by Russell Gold. TestWeb Test tool from Original Software Group Ltd. The 'TestPartner Visual Navigator' can create visual-based tests. including form submission. page performance tuning. Solaris. It analyses the underlying intentions of the script and executes it by direct communication with web page elements. and webserver load and capacity analysis. assists user during the recording with visual feedback. from SourceForge. WML and XHTML coding standards or customized standards. but can be easily extended with third-party plugins.org. Includes ServletUnit to test servlets without a servlet container. cookies and automatic page redirection. Can handle data input from text files. includes an HTTP proxy recorder to automate test script generation. Compuware TestPartner Automated software testing tool from Compuware designed specifically to validate Windows. supports hyperlinks targeted at new instances of browser. component location and mouse movements for accurate replay. Maps and tests all possible paths through a dynamic site. Can extract web data and save as CSV file or process the data via a script. clicking. basic http authentication. Works as a proxy server. Open-source project maintained by Ilya Martynov. Allows creation of rules for automatic monitoring of dynamic page content. and static analysis test suite from ParaSoft. Emulates the relevant portions of browser behavior. HTTP-Redirects and cookies. an XML DOM. for easier script maintenance. Ideally suited for automated unit testing of web sites when combined with a Java unit test framework such as JUnit. or XML. JavaScript. Java.Aditi Technologies Basic Concepts of Software Testing plugins. MaxQ Free open-source web functional testing tool from Tigris. automates repetitious aspects of web site testing. and a mechanism for playing tests back from the GUI and command line. A command line interface allows for easy integration with other test software. Power users can manually edit a recorded macro. Jython is used as the scripting language. Linux. Rational Functional Tester Page 32 of 60 . and JUnit is used as the testing library. dynamic testing. For Windows. WebKing Web site functional. HttpUnit Open source Java program for accessing web sites without a browser. and web-based applications. databases. content validation. iOpus Internet Macros Macro recorder utility from iOpus Inc. can enforce over 200 HTML. IntelliScripting logic removes the reliance on specific browser window sizes. 508 compliance. written in Java. Inc that uses a 'Test Enabled Web Browser' test engine that provides browser-based client side quality checking. load. eValid Web test tool from Software Research. form filling. tables. thus automatically supports advanced features such as SSL. Can run load tests based on the tool's analysis of web server log files. script testing and information gathering.

DHTML. Java. Codenomicon HTTP Test Tool Tool for discovering and eradicating security-related flaws in HTTP implementations via robustness testing. For Windows and Linux. scripting language. Evaluation version available. protocol analyzers. includes support for testing Web. and record/playback. Assessment module can be used by auditors and compliance officers to conduct comprehensive audits. and more.NET. etc. proxies. PDAs and cell phones.) SecurityMetrics Appliance Page 33 of 60 . Java. test process management capabilities.6. ERP. HTML. Java beans. 5.NET and J2EE applications. SilkTest Functional test tool from Segue for Web. browsers. Enables data-driven testing. choice of scripting languages and editors. Java or traditional client/server-based applications. and to validate compliance with security requirements. Web Site Security Test Tools Watchfire's AppScan Tool suite from Watchfire automates web application security testing. ERP. Compuware's QARun QARun for functional/regression testing of web. running. and other applications. DOMbased testing and validation. (HTTP implementations may be utilized in web servers. and debugging scripts. QuickTest Pro Functional/regression test tool from Mercury. and IDE for developing. includes site monitoring and load testing capabilities. test plans. Includes full VBA script development environment and options such as javascript. network appliances. in order to induce component crashes. hanging. direct database access and validation. compiling. XML. 'Data Bank Wizard' simplifies creation of data-driven tests. Winrunner Functional/regression test tool from Mercury. and web-based applications. recovery system for unattended testing. . includes support for testing Web. editing. e-Test Suite Integrated functional/regression test tool from Empirix for web applications and services and . Handles ActiveX. etc. test planning and management. Java. produces defect analyses. Tool systematically generates very large numbers of protocol messages containing exceptional elements simulating malicious attacks. etc. and offers recommendations for fixing detected security flaws.Aditi Technologies Basic Concepts of Software Testing IBM's (formerly Rational's) automated tool for testing of Java. and denial-ofservice situations which may affect component/application security. Features include: test creation and customization. C++. etc.

inside and outside the firewall. Qualys Guard Online service that does remote network security assessments. and more for security vulnerabilities which may lead to interrupted service. and browser checkup tool.a set of scripts that scan a Unix system for security problems. provides proactive 'Managed Vulnerability Assessment'. Scheduled vulnerability scanning. Perimeter Check SecurityMetrics 'Perimeter Check' service analyzes external network devices like servers. CVE standards support. Freeware.Aditi Technologies Basic Concepts of Software Testing Integrated software and hardware device includes Intrusion Detection and Prevention Systems and Vulnerability Assessment. remote self scan and API facilities. remediation management of vulnerabilities. including SANS/FBI Top 20 Vulnerabilities Scan. Inc. SANS/ISTS certified. SARA 'Security Auditor's Research Assistant' Unix-based security analysis tool from Advanced Research Corp. asset management. network topology discovery and organizational executive reporting for hundreds of administrators via easy-to-use web interface. an upgrade to the TAMU 'tiger' program . firewalls. based on the SATAN model. Includes instructions to help immediately remedy security problems. updated bi-monthly. Win servers STAT Scanner Page 34 of 60 . MacAnalysis database is updated regularly with a "Vulnerability Update" function to update database of more than 100 new holes per month. Runs on Macintosh. Supports the FBI/SANS Top 20 Consensus. Qualys Free Security Scans Several free security scan services from Qualys. Mac. Lightning Console Security management tool from Tenable Network Security for multiple security and network administrators across multiple organizations. Also available is 'Tiger Analytical Research Assistant' (TARA). routers. data theft or system destruction. plug-in facility for third party apps. MacAnalysis Low cost Network Security audit tool from Lagoon Software. real-time IDS event analysis. network security scan. can audit UNIX. Provides detailed reports and vulnerability fix recommendations. websites. Operates as a Layer 2 Bridge no network configuration needed. vulnerability assessment scripts and program enhancements nightly. Automatically downloads latest IDS attack signatures. Can automatically schedule vulnerability assessment of designated IP addresses during low traffic times.

Aditi Technologies Basic Concepts of Software Testing Tool from Harris Corp. Single machine or full network scans. whereas the client is a frontend designed to collect the results. track vulnerability trends via analyses comparing current and previous assessments. and Nessus Attack Scripting Language. the server (nessusd) manages the 'attacks'. SAINT Security Administrator's Integrated Network Tool . Customizable reporting. 45 common web server vulnerability checks. by Renaud Deraison. reports specify severity levels of problems. adapting penetration strategy based on previous results. Capabilities include: scan and analyze an entire network domain and/or a single machine. CVE compatible. and SAINTbox scanner appliance. Utilizes comprehensive updatabale vulnerability databases to automatically detect vulnerabilities. Learns about network as it scans. Runs on many UNIX flavors. NMap Network Mapper Page 35 of 60 . NetRecon Network vulnerability assessment scanner from Symantec. retest corrected vulnerabilities immediately. correct vulnerabilities across the network with 'AutoFix' function. Works with a variety of operating systems. and a wide variety of other tests. Includes DoS testing.com for individual machines. An updated and enhanced version of the SATAN network security testing tool. denial-of-service checks. open-source remote network security auditing tool. Nessus is made up of two parts : a server and a client. Also available is 'WebSAINT' self-guided scanning service. Nessus Security Scanner Free. Limited free or full licensed versions available. Utilizes a root-cause and path-analysis engine to illustrate exact sequence of steps taken to uncover vulnerabilities. Updated regularly. Can scan a variety of operating systems.Security testing tool from SAINT Corporation. select or ignore specific vulnerabilities via configuration files. product runs on Windows. based on 'never trust the version number' and 'never trust that a given service is listening on the good port'. Includes more than 1000 tests in 23 vulnerability categories. web server requests-per-second benchmark. enabling identification of exactly where to correct vulnerabilities to enforce corporate security policies. analysis reports of vulnerabilities with detailed information relating to the name/description/risk level of each vulnerability. for security analysis of Windows/UNIX/Linux and other resources. Scans systems and services on the network and safely simulates common intrusion or attack scenarios. Port scans. Secure-Me Automated security test scanning service from Broadbandreports. eliminate vulnerabilities using recommended solutions with links to related websites and knowledge-base articles. customizable security reports for management and technical personnel.

etc. CyberCop ASaP Managed vulnerability assessment service from McAfee/Network Associates. Provides flexible risk management reports. etc. NetIQ Security Analyzer Multi-platform vulnerability scanning and assessment product. InternetScanner Tool from Internet Security Systems. DMZ and externally visible assets. electronic law. Scans any device on network regardless of platform. publications. Also includes an FTP site with a large collection of (mostly older) security-related utilities. remediation information. printers. scanners. what type of packet filters/firewalls are in use. Uses raw IP packets in novel ways to determine what hosts are available on the network. Page 36 of 60 . desktops. CERIAS Security Archive Purdue University's 'Center for Education and Research in Information Assurance and Security' site. and any other devices with an IP address on a network. organized by subject. servers. routers. to uncover and report systems vulnerabilities that might be open to attack.Aditi Technologies Basic Concepts of Software Testing Free open source utility for network exploration or security auditing. includes capabilities for checking and remediation of security problems of servers. intrusion detection tools. to hundreds of security information resources and tools. bv-Control for Internet Security Secutiry scanning tool from BindView. and many other characteristics. intrusion detection resources. Available as a hardware appliance. Remotely evaluates security of network perimeter. Systems are analyzed on demand or at scheduled intervals. workstations. software product. or managed service. etc. designed to rapidly scan large networks or single hosts. provides automated vulnerability assessment for measuring online security risks. routers. firewalls. Automatic update service allows updating with latest security tests. etc. hubs. prepares remediation advice. what services (ports) they are offering. 'hotlist' section includes extensive collection of links. Foundstone Vulnerability management software tools from McAfee/Network Associates can provide comprehensive enterprise vulnerability assessments. Includes a Software Developer's Kit to allow custom security test additions. Runs on most flavors of UNIX as well as Windows. Performs scheduled and selective probes of network services. operating systems. For Windows/Solaris/Linux. what operating system (and OS version) they are running.

and online service available.. complete inventory of Web sites and Comparison Inventory Reports to compare different versions of a Web site. works with a variety of web servers. for maintaining. site scores. webSensor Integrated site measurement and analysis tool from Moniforce BV. WebCEO Tool from Radiocom Ltd. (Includes various types of security tools. to enable detailed analysis of what is going on behind the scenes of Web operations. ManageEngine Applications Manager Site management tool from AdventNet. Includes link checker. Inc. traffic analysis. and trend analyses using intuitive browser-based reports. and Web Governance.roll-up of results from different business units or global Web sites for overall views of site compliance. combined utilities/tools. and OS's. Recorded transactions can then be analyzed when production errors occur and fed back into SilkPerformer for real-world performance testing scenarios. not just for testing.org. Similar managed service also available. SilkCentral Performance Monitor Tool from Segue Software. combining site content. server management and optimization tools. Capabilities include: high-level summary reports. and authoring/publishing/deployment tools that include significant site management or testing capabilities. database servers. analyzing web sites.7. Top 75 Security Tools Listing of 'top 75' network security tools from survey by Insecure. Passive monitoring records real user sessions and reliably detects and logs all error situations encountered by real-users.. Free and professional versions available. Information Assurance.Aditi Technologies Basic Concepts of Software Testing trend analyses and comprehensive data sets to support policy enforcement. actively monitors and evaluates the health of a site's live applications utilizing synthetic business transactions. FPT/publishing. structure and visitor traffic data into one searchable data base. Inc. Web Site Management Tools (This section includes products that contain: site version control tools. promoting. Maxamine Knowledge Platform Integrated site managment tool from Maxamine Inc. Integrates performance Page 37 of 60 . for monitoring compliance standards related to Privacy. Limitedcapability free version also available. service types. and site monitoring capabilities. Accessibility. Desktop product for multiple platforms.) COAST WebCentral Site management tool from Coast Software.) 5. WYSIWYG editor.

Asset Manager to securely centralize images. Cuevision Network Monitor Monitoring tool from Cuevision for monitoring website. Legacy-to-Web Tools can "bulk-load" online catalog from legacy Page 38 of 60 . pagers. Other capabilities include search engine optimization. and diagnostics. etc. page sizes. Site Manager to create and manage your web site. RedDot CMS Web content managment system from RedDot Solutions includes modules such as SmartEdit. checks network and servers for failures and fixes them automatically. customizable views of success/failure rates for key online business processes and other critical metrics. response errors. PROGNOSIS Comprehensive tool from Integrated Research Ltd. isolation. response times. and 'Real Scripts' automatically generated from recorded user sessions for use in specified other load testing tools. network errors. Freeware version of GFI Network Server Monitor is also available. eliminates need for programmers and special production staff to maintain catalogs. services. providing context and correlation data for application failure analysis. and popup. server.Aditi Technologies Basic Concepts of Software Testing and availability data with site traffic data. bandwidth usage. For Windows. visitor segmentation. and network. SMS. network management. automatically reboot servers. page aborts. Add-on capabilities include a 'Dashboard' to provide real-time. GFI Network Server Monitor Server management tool from GFI Software Ltd. restart apps and services. click path analysis. etc. Captures and monitors real user sessions. from AllScoop. restart services. real-time executive dash board. capabilities include notifications via email. suited to large systems. ContentStudio E-catalog management tool from TechniCon Systems with Win Explorer-type interface with drag and drop functionality. applications. Alerts via email.Free open-source website performance monitoring and uptime notification application in PERL. RealiTea Web application management solution that provides detailed visibility into availability and functionality issues to enable efficient problem identification. net send. Web Compliance Manager to manage integrity and accessibility. run scripts. and repair. for performance and availability monitoring. including server errors. Web Site Monitoring Performance Monitoring . includes modules to check HTTP and ICMP/ping for checking availability of HTTP and HTTPS sites. sends email notification if site is slow or down. and more.

FTP Assistant for Webmasters FTP client from Byteway. Constructioner Website development software with integrated content management system from Artware Multimedia GmbH. comprehensive Communications Gateway for inbound and outbound data. Receive instant notification by email whenever one of the sites is unavailable. HTML and GIF optimization. Message Board. upload resuming. Works on multiple platforms. All can be integrated without writing code. TestWEB Monitor Web site monitoring tool from Original Software checks 5 or more URL's up to every 30 seconds. Capabilities include defining intra-configuration rules. such as option compatibilities on a single product. etc. high-level functions save template coding time.Aditi Technologies Basic Concepts of Software Testing product data. Database Backup. Constructioner Light Edition available as Freeware. Search. additional features include manual or customizable automated control. detecting. Content and Table Management (WYSIWYG-Editor).com for web site updating. verifying content and functional integrity. load testing. SpinPike Flexible and scalable content management system from SavvyBox Systems. and more. Multilingualism. link verification. can manage all components across complex Web-enabled applications by measuring and monitoring performance. site cleanup. which hosts the management system application and the client's administrative interfaces and pushes the final assembled pages to client Web servers. Statistical Reports. Free for use on small sites. Includes: Ready-to-use Backoffice. PHP-Code Insertion. template-based dynamically-created content. Dynamic Menu. Trellian InternetStudio Page 39 of 60 . spatial relationships between products. low cost for large sites. CrownPeak CMS Content management service from CrownPeak Technology. and a robust API. WYSIWYG editor. scheduler. drag-and-drop. reporting and fixing problems before users see them. Provides complete software developers environment. Design/administrate database connected PHP web applications in combination with individual webdesign. WebLight HTML validator and link checking tool from Illumit LLC. based on database-driven. User Administration. Installer easily installs system on your server. Tonic Suite of web site management/monitoring/test tools from Tonic Software.

prices.V. integration with a variety of servers. and more. Update news flashes. globalization. Alerts by cell phone. and website standards compliance. support for more than 50 document formats. Serena Collage Content management tool from Serena. site mapper. and log events. Works with content from any platform or application. accessibility. image handling. pager. length. simply create an account and paste one line of javascript into your pages. payment processing. searchability. customer relationship management. product info. scalable content management platform for content contributors distributed across an organization. For Windows. stories. browser-based. image mapper. HTML editor. Watchfire WebXM Content analysis tool from Watchfire analyzes sites for slow loading pages. etc.Aditi Technologies Basic Concepts of Software Testing Suite of web site management utilities from Trellian including site upload/publishing tools. Easy to install. authoring tools. administration. renaming the files to match the convention. FlexWindow Tool from Digital Architects B. Web500 CMS Web content management and site maintenance solution from Web500. multi-lingual support. notifications. invalid chars). Add-on modules allow capabilities such as WAP. styles. templates. link checker. and DB servers. text editor. activity tracking. business process automation.. Enables collaboration. enables users to update their web site via e-mail. . e-mail. broken links. security. more. e-commerce. HTML validator. Alchemy Eye System management tool from Alchemy Lab continuously monitors server availability and performance. etc. then Page 40 of 60 . Can automatically run external programs. and more. site spider. HTML encryptor/optimizer. HTML Rename Site Migration/Batch processing tool from Expandable Language that enforces file naming conventions (case. security. e-commerce site designer/generator.capabilites/support include scalability. Documentum Enterprise content management product from EMC Corp. web servers. Basic accounts are free. version control. Use any e-mail client capable of producing HTML to format your content or use HTML tags in a plain text e-mail. advertisements. spell checker. approval workflow. XML-content-based multichannel delivery. privacy compliance. Runs with a variety of platforms.

conversion services. IP Check Server monitoring tool from Paessler GmbH. isolate. Page 41 of 60 . and archiving. integrates with other OpenView products to provide a variety of management and monitoring services and capabilities. where all content and content types are stored for management. and maintaining highly dynamic web sites. securing and sharing digital and paper-based documents and reports. content development. Enables services such as library services. Enables scheduling of content refreshes.. security. personalization. Inc. For Mac or Windows. Stellent Universal Content Management System Content management tool from Stellent. allows a distributed team of non-technical content experts to manage every aspect of site content. anticipate capacity shortfalls. HP OpenView Internet Services Internet services monitoring/management tool from HP. deploying. portals and scanned images. Alerts webmasters if a webserver is not working correctly because the web service is down. management of workflow. Enables end-user emulation of major business-critical applications as well as a single integrated view of the complete Internet infrastructure. diagnose and troubleshoot problem occurrences. It can constantly monitor any number of servers and ports. Eliminates problems encountered when moving files between Windows. documents. and UNIX systems and publishing to CD-ROM. Broadvision Suite of content and publishing management tools from Broadvision Inc. Manages Web content. 'Stellent Content Server' uses a web-based repository. and indexing content by means of a browser window or via MS Word. workflow. and services for collaborative environments and for digital asset and records management. production. editing. CGI scripts return errors or the SQL server is not reachable. index/search. managing and publishing Web content and supporting from one to thousands of Web sites. Rhythmyx Content Manager Web content management product from Percussion Software. and manage and report on service level agreements. reuse and access. Content Management Server Windows based content mgmt tool from Microsoft (formerly 'nResolution' from nCompass Labs). Other modules provide additional services such as: services for creating. Enterprise web content management system that enables quickly and efficiently building. digital assets. and customizable workflow. including creation. publishing. services for capturing. replication and administration. tracking of revisions. based on native XML and XSL technologies. Designed to help IT staff efficiently predict. staging. For Windows.Aditi Technologies Basic Concepts of Software Testing correcting the links to those files automatically. Mac. version control.

full-featured editor from Chami. Requires MSIE. and update websites. Over 400 free plugins available for extending and customizing HTML-Kit. Requires MSIE and Windows. Capabilities include notification by email and automatic reboot of web server. XHTML. lookup help. auto or manual submit of URL's to search engines. upload. for Windows. 'Active Protect MetaTags' allowing only search engine spiders to see front-page meta-tags. page. support more than 50 host file systems. Includes internal. provides notification by displaying a message or sending an e-mail. on web server and Windows client. meta tag creator. manage. searches for keywords. A1Monitor Utility from A1Tech for monitoring availability of web servers. WS_FTP Pro FTP/web publishing tool from Ipswitch. Ruby. WebSite Director Page 42 of 60 . FTP Workspace for uploading. automatically resume interrupted transfers.Aditi Technologies Basic Concepts of Software Testing HTML-Kit Free. validate. click paths. Searches top engines for keywords. dragand-drop files. Requires UNIX. For Windows. XSL. IBM Workplace Web Content Management IBM's web content management product for Internet. intranet. checks search engine placement including position. and 'Active Deny Access' to prevent particular IP addresses from accessing web site. and the ability to use hundreds of optional free add-ins through its open plugins interface. AgentWebRanking Freeware tool from AADSoft to monitor site's search engine position. rank on page. external. Finds errors and provides suggestions on how to create standards compliant pages. Uses a highly customizable and extensible integrated development environment while maintaining full control over multiple file types including HTML. XML. includes 'anti-caching technology' ensuring more reliable logging by blocking caching of site's pages by visitor's browsers. improve search engine ranks. format. preview and publish web pages. Also has keyword count for pages vs competitor's pages. and much more. Python. JavaScript. downloading and online editing of files. CSS. XHTML and XML authors to edit. submit URL's. Enhanced logging utilizing custom generated script uploaded to host. server-side and live preview modes. Java. extranet and portal sites. From Monocle Solutions. Validate XML documents using its DTD and/or check for well-formedness. seamless integration with the CSE HTML Validator. GUI support of W3C's HTML Tidy. WebLog Manager In addition to logging capabilities. SSI.com designed to help HTML. PERL. Perl. runs on both Lotus Domino and IBM WebSphere. Pro plugins available to paid registered users. WebCheck Windows application that runs in background and periodically checks a site for availability and correctness. 'Active Protect Images' to prevent other sites from "borrowing" images. can specify search depth.

alerting. content management and site visualization. access control. for periodic server monitoring for web server connection problems. Web based interface for load balancing administration. Includes a 'Database Import Wizard'.Aditi Technologies Basic Concepts of Software Testing Web-content workflow management system with browser-based interface includes configurable workflow management. HTML validation. Interwoven Team Site Web development. and platforms. monitoring. XMetal XML development tool from BlastRadius for XML-based web site authoring and validation. link checking. metrics. management. works with many servers. For Windows. requires Windows and MSIE. Macromedia Web Publishing System Macromedia's complete. Evaluation copy available. real-time server monitoring of server response time. and publishing control tool. For Windows. Page 43 of 60 . network management. etc. and publishing to websites within a centrally controlled. PowerMapper From Electrum Multimedia. WebTrends Analysis Suite Web site management tool from NetIQ includes log analysis. UNIX. OS's. For MS and Netscape web servers. allows defining and applying existing workflow and approval rules to web content management process. Supports multiple platforms and browsers. For Windows. link analysis and quality control. for customizable automated site mapping. and e-mail notifications. E-mail/pager notifications. scalable web content management solution that enables collaboration. e-mail submission of web content. server failure detection. server management. number of pending requests. proxy server traffic analysis and reporting. version control. link problems. and can automatically convert output to CALS or HTML table models or to XML. standards-based environment. logging capabilities. logging. For Windows. Unicenter TNG w/Web Management Option Site management application from Computer Associates includes access and security control. Site/C 'Set-and-forget' utility from Robomagic Software. Equalizer Load balancing server appliance and site management tool from Coyote Point Systems. monitoring and recovery.

Includes version control. browser extensions. etc. provides notifications of problems. graphics management. and encryption capabilities. Support for managing content stored in databases. spell checker. Monitors mimic users' end-to-end actions. API's. connections. browser interface. For Windows. links. For Windows.. and static files. logs. Microsoft FrontPage Microsoft's web site authoring and site management tool. link checking. OpenDeploy Interwoven's configurable control system for deploying from development to production environments. Server side compatible with many available web servers. global search-and-replace. HTML PowerTools HTML validator. From Talicom. Link checker. scheduled and on-demand reporting. page in screen is validated with results displayed below. comparison capabilitie. etc. variable lock controls. management.Aditi Technologies Basic Concepts of Software Testing SiteScope Mercury's product for agentless site monitoring and maintenance. layout editor. Validates against various HTML versions. file uploading. Page 44 of 60 . image tag checker. Supports a wide variety of web attributes. staging/publishing control. Content Management Server Vignette Corporation's product for web site collaborative content. thumbnail viewer. Includes published API for creating custom monitors. Runs on servers and monitors server performance. NetObjects Fusion Site authoring/management tool. For Windows. and maintenance. Meta manager. administration. HomeSite Macromeida's web site project management/authoring/validator tool. link checker. security. Visual site structure editor. Includes automated deployment. and management product for enterprise-wide internet and intranet projects. databases. XML repositories. has updateable rulebase. HTML-to-Text converter. For Windows or Unix. publishing. and servers. Date stamper. customizable reports. For Windows and Unix. file edit merging. includes site management capabilities. TeamSite Interwoven's collaborative web site production control. error info is linked to error in html.

SiteTimer service . Consists of 3 components. for automated recording. Extreme Web Analyzer Web site performance analysis tool by Dale Feiste for use in a development or controlled test environment. examine server's HTTP headers.Find out how long it takes various connection types to get a page. A Recorder records and synchronizes video and data. web standards and elastic design. Other Web Testing Tools Morae Usability test tool for web sites and software. how it interprets page's robot exclusion rules and more. check all the graphical links to ensure they're correct. Allows user to save and review relevant information for bug reports. to which links it extracts. and MS Excel for charting and modeling. more. Repro Manual testing 'helper' tool that records desktop video. where network traffic is captured over a LAN. and share with others. and compress the result into a very small file to replay. Enter URL and receive back report with screenshots taken in real time on real hardware. Perl. analyzing and sharing of usability data. Instruments in memory the target application at runtime so no changes are required to application under test. and system configuration information. Free. requires a system capable of running Ethereal and/or Sniffer.com Service from HREF Tools to check web page appearance in different Browser/OS combinations. URL2image. from TechSmith Corp. A Remote Viewer enables geographically dispersed observers to watch usability tests from any location. TestGen Free open-source web test data generation program that allows developers to quickly generate test data for their web-services before publicly or internally releasing the web service for production. upload to a bug tracking system. system operations in 7 different categories.8. For Windows. Any application which accepts an HTTP Proxy can be configured to run through Page 45 of 60 . can specify the screen width(s). from how it breaks down the HTML. Remote Viewer observers can set markers and add text notes. EngineViewer and SiteTimer Free basic services: EngineViewer . creating a digital record of system activity and user interaction. The predictable network performance of this environment enables reliable modeling of trace data.reports on how a search engine may view a webpage. Acts as an HTTP Proxy running on port 8888 of local PC.Aditi Technologies Basic Concepts of Software Testing 5. Fiddler An HTTP Debugging tool by Eric Lawrence. The Manager component includes integrated editing functionality for assembly of important video clips to share with stakeholders. For anyone interested in css. it displays test user's computer screen along with a picture-in-picture window displaying the test participant's face and audio. font magnification(s) and page position(s) for the proofs. system resource usage.

Aditi Technologies Basic Concepts of Software Testing Fiddler. tune-up wizard. manage and monitor throughput. FunnelIT Free utility from ByStorm Software helps streamline test reporting and analysis by gathering Windows platform environment/configuration information (running tasks. etc. Professional. and also allows gathering TCP/IP Address/Network Information. etc.NET event-based scripting subsystem. physical memory information. html. component details. Free. processes. device drivers. users can watch their web traffic as if they're watching a movie. Provides performance enhancing tips. loss. that depicts website visitors as animated characters in a virtual village. Free. data creation or capture and replay. Network Adaptor Information. can generate TCP/UDP connections using different IP addresses. loaded modules. SetSim Pro Northern Webs' free on-the-web meta tag checker. Designed to be much simpler than using NetMon or Achilles. Path Application Manager Page 46 of 60 . system file listings. Services information. Installed Software and Installed XP Updates. OS version. Sandra 'System ANalyser. environment settings. and delay. modules.) in small text files. and much more. Logs all HTTP traffic between between computer and the Internet. Also allows comparisons among results from multiple systems. drives. for Windows. and allows inspection of the HTTP data. set breakpoints. and includes a simple but powerful JScript.). ODBC sources. Full-featured version (not free) has configurable reporting. Reporting via save/print/fax/email in text. IP Traffic Test and Measure Network traffic simulation and test tool from Omnicor Corp. ports. more. file system and memory bandwidth benchmarking. VisitorVille Site traffic monitoring tool from World Market Watch Inc. virtual memory settings. and other versions available in multiple languages. Diagnostic and Reporting Assistant' utility from SiSoftware. Drive Free Space/Size/Used info. Will send a popup when one of the servers stops responding. XML. Provides large variety of information about a Windows system's hardware and software. memory details. processor information. mainboard. and "fiddle" with incoming or outgoing data. FREEping Free ping software utility from Tools4ever which will ping all your Windows-based servers (or any other IP address) in freely-definable intervals. services. includes additional search-enginerelated capabilities. etc. Available as an executable intended to leave no footprint. Includes CPU.

Split-screen display and dual logs for request and response data. originally designed for testing networking protocols. Can log captures to disk. any operating system. such as "Referrer" and "User Agent".com. Browser Cam Service for web developers and testers that creates screen captures of web pages loaded in any browser. For Windows. delays. Enables enhancement of QA. SpySmith can also spy on Windows objects. compliance. any version. Co-Advisor Tool from The Measurement Factory for testing quality of protocol implementations. Dummynet Flexible tool developed by Luigi Rizzo. Co-Advisor's current focus is on HTTP intermediaries such as firewalls. View all headers and data that travel between your browser and the server. and multipath effects. and XML switches. or on FreeBSD machines acting as routers or bridges. in most versions of every browser ever released. especially useful when testing web sites and web-based applications. can be used in testing to simulate queue and bandwidth limitations. binaries and source available.Aditi Technologies Basic Concepts of Software Testing Application Monitoring and management tool from Winmoore. analogous to running an MRI scan. Browser-based Documents (including those without a 'view source' command) to extract precise information about the DOM elements in an HTML source. CoAdvisor can test for protocol compatibility. Windows (on-demand). robustness. or source code. filters. and troubleshooting with code coverage capabilities. security. Can be used on user's workstations. HTTP Interceptor A real-time HTTP protocol analysis and troubleshooting tool from AllHTTP. Inc. Uses pattern recognition technology to peer deep inside customized or COTS applications. RAMP Section 508 and W3C Accessibility Guidelines tool from Deque Systems that automates analysis and remediation of non-compliant web functionality. available as on-line service. Free 90-day trial. freeware. testing. binaries. captures and displays packet data between local client and specified web server. Other info: runs on FreeBSD packages. packet losses. Linux.E. Interceptor also allows changing of select request headers on-the-fly. Also available is PocketXML-RPC and PocketHTTP. caching proxies. PocketSOAP Packet-capture tool by Simon Fell. Page 47 of 60 . and other quality factors. Linux RPMs. Macintosh. Allows viewing of web page appearance on Windows. It allows the user to peek inside I. SpySmith Simple but powerful diagnostic tool from Quality Forge. with GUI. For Windows.

and segments sent and received. can be used by setting browser to use it as a proxy server and then can monitor all traffic to and from browser. and any network. and mainframe applications. and various graphs.GUI XML Conformance Test Suite XML conformance test suites from W3C and NIST.comm Tool from Omsphere LLC for simulating virtually any software interface (internal or external). or WinDump. mailboxes. HiSoftware AccVerify Tool for testing site Accessibility & Usability. Allows developers to test down to the unit level by simulating the internal software interfaces (message queues.) Tool can learn what request/response scenarios are being tested for future tests and can work with any protocol. etc. tcptrace Tool written by Shawn Ostermann for analysis of TCP dumpfiles. ProxyTrace Tool by Simon Fell acts as a proxy server to allow tracing of HTTP data. Inc. Page 48 of 60 . This is a set of metrics for determining conformance to the listed W3C XML Recommendation. client/server. any message definitions. Runs on Windows platforms. Allows testing without pitfalls associated with live connections to other systems (TCP/IP. The test report contains background information on conformance testing for XML as well as test descriptions for each of the test files. allows monitoring web sites for changes or misuse of your intellectual property in metadata or in the presented document. Available for various UNIX flavors. For managing and developing test cases and scripts. Also available: MITS. etc). For automated testing of Web. Ethernet. link validation. Can crawl a site and report errors. HP Net Metrix. contains over 2000 test files and an associated test report (also in XML). For windows. for Windows. window advertisements.Aditi Technologies Basic Concepts of Software Testing TcpTrace Tool by Simon Fell acts as a relay between client and server for monitoring packet data. Overall Site Quality. Privacy and Intellectual Property policy verification. HiSoftware Web Site Monitor Tool allows user to monitor your server and send alerts. and as source code. Can produce various types of output with info on each connection seen such as elapsed time. Freeware. Works with all text-based IP protocols. freeware. and generating test scripts. MITs. bytes. etherpeek. Runs on Windows. retransmissions. freeware. can also programmatically fix most common errors found. round trip times. throughput. such as those produced by tcpdump. snoop. Certify Test automation management tool from WorkSoft. Searchability. Custom Checks and Test Suites to meet organization's standards. FTP.

Delphi. data generation interface to Segue SilkTest. and developers can then debug their respective code independently of one another no matter if the code units reside on the same servers or on different servers or on any combination thereof. Datatect Test data generator from Banner Software generates data to a flat file or ODBC-compliant database. WebBug Debugging tool from Aman Software for monitoring HTTP protocol sends and receives. CSS. handles HTTP 0. WebMetrics Web usability testing and evaluation tool suite from U. Windows. XHTML.Aditi Technologies Basic Concepts of Software Testing Web Optimizer Web page optimizing tool from Visionary Technologies intelligently compresses web pages to accelerate web sites without changing site's appearance. DLL. Hypertrak Suite of software protocol analyzers from Triometric accurately calculates end-to-end download speeds for each transaction. time period. includes capabilities such as scripting support that allows user to write VBScripts that modify data to create XML output. generates reports as web pages with GIF graphics on inbound and outbound traffic.S. VJ. Page 49 of 60 .9/1. ActiveX Exe. and HTML. HTML2TXT Conversion utility that converts HTML as rendered in MS Internet Explorer into ASCII text while accurately preserving the layout of the text. capability to read in existing database table structures to aid in data generation. T-SQL. Visual C++. VB. COM+. written in any language ( ASP. without ever attaching to process. XML. VC++. and Javascript and includes GIF and JPEG optimizer techniques. errors. Freeware. Source code available. CFML ). performance for each server. MTS. Remote code can pass messages and dialogs directly to your local machine via Team Remote Debugger component. etc. Govt. Thread. URL. Included with software are examples of using the control from within Visual Basic. comparison to SLA's. allows for entry of custom headers. wide variety of data types and capabilities for custom data types.free tool utilizing SNMP to monitoring traffic loads on network links. For UNIX. Windows. not just samples. COM. T-SQL.0/1. For Windows. Team Remote Debugger Debugging tool from Spline Technologies allows tracing of any number of code units of any kind ( ASP. produces a range of configurable reports that breaks down info into network and server speeds. client.1. CFML ) residing on multiple shared and dedicated servers at the same time. NIST. MRTG Multi Router Traffic Grapher . Removes unnecessary information in HTML. Runs on Solaris or Linux. For UNIX.

Why is it often hard for management to get serious about quality assurance? 5. What are 5 common problems in the software development process? 12. What is 'Software Quality Assurance'? Software QA involves the entire software development Process . Why does software have bugs? 6. What is 'good design'?Top of the Document 15. How can new Software QA processes be introduced in an existing organization? 7. What is verification and Validation? 8. Testing FAQ 1. It will depend on what best fits an organization's size and business structure. Also common are project teams that include a mix of testers and developers who work closely together. What is 'Software Quality Assurance'? 2. making sure that any agreed-upon standards and procedures are followed. What are some recent major computer system failures caused software bugs? by Page 50 of 60 . What is 'Software Testing'? 3. and ensuring that problems are found and dealt with. What is 'Software Testing'? Testing involves operation of a system or application under controlled conditions and evaluating the results (eg.Aditi Technologies Basic Concepts of Software Testing 6. What is the 'software life cycle'? 17. and does C. What is 'good code'? 14. It is oriented to 'detection'. What kinds of testing should be considered? 11. 'if the user is in interface A of the application while using hardware B.monitoring and improving the process. Will automated testing tools make testing easier? 1. The controlled conditions should include both normal and abnormal conditions. then D should happen'). What are some recent major computer system failures caused by software bugs? 4. What's an 'inspection'? 10. What is a 'walkthrough'? 9. What is SEI? CMM? CMMI? ISO? Will it help? 16. It is oriented to 'prevention'. (See the Books section for a list of useful books on Software Quality Assurance. with overall QA processes monitored by project managers. 3. Sometimes they're the combined responsibility of one group or individual.) 2. Organizations vary considerably in how they assign responsibility for QA and testing. What is software 'quality'? 13. Testing should intentionally attempt to make things go wrong to determine if things happen when they shouldn't or things don't happen when they should.

Articles about the incident stated that it took two weeks to fix all the resulting errors. Reportedly the original contract allowed for only 6 weeks of acceptance testing and the system was never tested for its ability to handle a rate increase. The bug was reportedly in one utility company's vendor-supplied power monitoring and management system. According to the report. portions of the project could be salvaged. In early 2004. and that the total cost of the incident could exceed $100 million. According to news reports in April of 2004. In July 2004 newspapers reported that a new government welfare management system in Canada costing several hundred million dollars was unable to handle a simple benefits rate increase after being put into live operation. that additional problems resulted when the incident drew a large number of e-mail phishing attacks against the bank's customers. forced shutdown of 100 power plants. which was unable to correctly handle and report on an unusual confluence of initially localized events. news reports revealed the intentional use of a software bug as a counter-espionage tool. according to mid-2004 news reports. the trains were started by altering the control system's date settings.Aditi Technologies Basic Concepts of Software Testing • • • • • • • • • • Media reports in January of 2005 detailed severe problems with a $170 million high-profile U. A bug in site management software utilized by companies with a significant percentage of worldwide web traffic was reported in May of 2004. A major U. in the early 1980's one nation surreptitiously allowed a hostile nation's espionage service to steal a version of sophisticated industrial software that had intentionally-added flaws. the vendor had reportedly delivered Page 51 of 60 . The bug resulted in performance problems for many of the sites simultaneously and required disabling of the software until the bug was fixed. The company found and reported the bug itself and initiated the recall procedure in which a software upgrade fixed the problems. In January of 2001 newspapers reported that a major European railroad was hit by the aftereffects of the Y2K bug.S. Millions of bank accounts were impacted by errors due to installation of inadequately tested software code in the transaction processing system of a major North American bank. if any. the worst power system failure in North American history. The error was found and corrected after examining millions of lines of code. News reports in September of 2000 told of a software vendor settling a lawsuit with a large mortgage lender. This eventually resulted in major industrial disruption in the country that used the stolen flawed software. Software testing was one of the five major problem areas according to a report of the commission reviewing the project. The failure involved loss of electrical power to 50 million customers. The company found that many of their newer trains would not run due to their inability to recognize the date '31/12/2000'. News stories in the fall of 2003 stated that a manufacturing company recalled all their transportation products in order to fix a software problem causing instability in certain circumstances. Studies were under way to determine which. a software bug was determined to be a major contributor to the 2003 Northeast blackout. government IT systems project. and economic losses estimated at $6 billion. retailer was reportedly hit with a large government fine in October of 2003 due to web site errors that enabled customers to view one anothers' online orders.S.

the district's CIO was fired.Aditi Technologies Basic Concepts of Software Testing • • • • an online mortgage processing system that did not meet specifications. Bugs in software supporting a large commercial high-speed data network affected 70. was delivered late. Why is it often hard for management to get serious about quality assurance? • Solving problems is a high-visibility process. the orbiter was to serve as a communications relay for the Mars Polar Lander mission. enormous relational databases.programmers. which was shut down for most of a week as a result of the outages. major problems were reported with a new computer system in a large suburban U.S. This is illustrated by an old parable: In ancient China there was a family of healers. futures exchange.the enduser may not understand the effects of changes.redesign. known and unknown dependencies among • • Page 52 of 60 . data communications. or may understand and request them anyway . preventing problems is lowvisibility. The problem went undetected until customers called up with questions about their bills.the complexity of current software applications can be difficult to comprehend for anyone without experience in modern-day software development. In early 2000.S. hardware requirements that may be affected. like anyone else.as to specifics of what an application should or shouldn't do (the application's requirements). Programming errors . effects on other projects. The school district decided to reinstate it's original 25-year old system for at least a year until the bugs were worked out of the new system by the software vendors. can make mistakes. In October of 1999 the $125 million NASA Mars Climate Orbiter spacecraft was believed to be lost in space due to a simple data conversion error. telecommunications company that resulted in no charges for long distance calls for a month for 400. If there are many minor changes or any major changes. Several investigating panels were convened to determine the process failures that allowed the error to go undetected. work already completed that may have to be redone or thrown out. one of whom was known throughout the land and employed as a physician to a great lord.000 customers. 5.000 business customers over a period of 8 days in August of 1999. and sheer size of applications have all contributed to the exponential growth in software/system complexity.000+ students. It was determined that spacecraft software used certain data in English units that should have been in metric units. Among those affected was the electronic trading system of the largest U.000 erroneous report cards and students left stranded by failed class registration systems. Multi-tiered applications. and didn't work. Changing requirements (whether documented or undocumented) . public school district with 100. Why does software have bugs? • • Miscommunication or no communication . January 1998 news reports told of software problems at a major U. problems included 10. Software complexity . which failed for unknown reasons in December 1999. Among other tasks. 4.S. etc. client-server and distributed applications. rescheduling of engineers.

etc. In fact. it's usually the opposite: they get points mostly for quickly turning out code. Enthusiasm of engineering staff may be affected. class libraries. understandable. continuously modified requirements may be a fact of life. management must understand the resulting risks. For small groups or projects.visual tools. scripting tools.scheduling of software projects is difficult at best. Time pressures . management and organizational buy-in and QA implementation may be a slower. and testers. also in Part 2 of the FAQ. until I take a close look at it' o 'we can't figure out what that old spaghetti code did in the first place' If there are too many unrealistic 'no problem's'.it's tough to maintain and modify code that is badly written or poorly documented. it should be hard to read'). the result is bugs. QA processes should be balanced with productivity so as to keep bureaucracy from getting out of hand. Where the risk is lower. mistakes will be made.people prefer to say things like: o 'no problem' o 'piece of cake' o 'I can whip that out in a few hours' o 'it should be easy to update that old code' instead of: o 'that adds a lot of complexity and we could end up making a lot of mistakes' o 'we have no idea if we can do that. feedback to developers. egos . Poorly documented code . In some fast-changing business environments. often introduce their own bugs or are poorly documented. resulting in added bugs. When deadlines loom and the crunch comes. depending on the type of customers and projects. and ensuring adequate communications among customers. complete. the result is bugs. a more ad-hoc process may be appropriate. In many organizations management provides no incentive for programmers to document their code or write clear. A lot will depend on team leads or managers. maintainable code. In this case. testable requirement • • • Page 53 of 60 . Also see information about 'agile' approaches such as XP. How can new Software QA processes be introduced in an existing organization? • A lot depends on the size of the organization and the risks involved. often requiring a lot of guesswork. step-at-a-time process. The most value for effort will often be in (a) requirements management processes. managers. and QA and test engineers must adapt and plan for continuous extensive testing to keep the inevitable bugs from running out of control . and there's job security if nobody else can understand it ('if it was hard to write. and the complexity of coordinating changes may result in errors. with a goal of clear. Software development tools . serious management buy-in is required and a formalized QA process is necessary.Aditi Technologies Basic Concepts of Software Testing • • • • • • parts of the project are likely to interact and cause problems. compilers.see 'What can be done if requirements are changing continuously?' in Part 2 of the FAQ. we'll wing it' o 'I can't estimate how long it will take. For large organizations with high-risk (in terms of lives or property) projects. developers. 6.

What kinds of testing should be considered? • • • Black box testing . Tests are based on coverage of code statements. Not always easily done unless the application has a well-designed architecture with tight code. as it requires detailed knowledge of the internal program design and code. paths. What is verification and validation? • Verification typically involves reviews and meetings to evaluate documents. 8. White box testing . and specifications. or that test drivers be developed as needed. Integration testing . to test particular functions or code modules.testing of combined parts of an application to determine if they function together correctly. (b) design inspections and code inspections. not to fix anything.continuous testing of an application as new functionality is added.the most 'micro' scale of testing. Tests are based on requirements and functionality. The 'parts' can be code modules. issues lists. reader. The result of the inspection meeting should be a written report. requirements. The term 'IV & V' refers to Independent Verification and Validation. branches. typically with 3-8 people including a moderator. The subject of the inspection is typically a document such as a requirements spec or a test plan. done by programmers or by testers. client and server applications on a network. This can be done with checklists. 9. or in 'agile'-type environments extensive continuous coordination with end-users. individual applications. most problems will be found during this preparation. may require developing test driver modules or test harnesses. • • Page 54 of 60 . What's an 'inspection'? • An inspection is more formalized than a 'walkthrough'. and the purpose is to find problems and see what's missing.not based on any knowledge of internal design or code. code. Incremental integration testing . plans. Validation typically involves actual testing and takes place after verifications are completed. conditions. Unit testing . Attendees should prepare for this type of meeting by reading thru the document. requires that various aspects of an application's functionality be independent enough to work separately before all parts of the program are completed. Typically done by the programmer and not by testers.Aditi Technologies Basic Concepts of Software Testing specifications embodied in requirements or design documentation. 10. and inspection meetings. walkthroughs. and a recorder to take notes.based on knowledge of the internal logic of an application's code. What is a 'walkthrough'? • A 'walkthrough' is an informal meeting for evaluation or informational purposes. Little or no preparation is usually required. 7. and (c) postmortems/retrospectives.

or interacting with other hardware. End-to-end testing . This type of testing is especially relevant to client/server and distributed systems.testing for 'user-friendliness'. Regression testing . involves testing of a complete application environment in a situation that mimics real-world use. such as testing of a web site under a range of loads to determine at what point the system's response time degrades or fails. the software may not be in a 'sane' enough condition to warrant further testing in its current state. and other techniques can be used.black-box type testing geared to functional requirements of an application. User interviews. It can be difficult to determine how much re-testing is needed. Page 55 of 60 .black-box type testing that is based on overall requirements specifications. Usability testing . or corrupting databases. such as interacting with a database. Compatability testing . Failover testing . Clearly this is subjective. Sanity testing or smoke testing . Load testing .testing of full. willful damage.term often used interchangeably with 'load' and 'performance' testing.term often used interchangeably with 'stress' and 'load' testing. the 'macro' end of the test scale.final testing based on specifications of the end-user or customer. Acceptance testing . input of large numerical values. may require sophisticated testing techniques.Aditi Technologies Basic Concepts of Software Testing • • • • • • • • • • • • • • • etc. this type of testing should be done by testers. For example. etc. Functional testing . Ideally 'performance' testing (and any other 'type' of testing) is defined in requirements documentation or QA or Test Plans. partial. Stress testing . especially near the end of the development cycle.re-testing after fixes or modifications of the software or its environment. Install/uninstall testing .similar to system testing. or systems if appropriate.testing an application under heavy loads.testing how well software performs in a particular hardware/software/operating system/network/etc. covers all combined parts of a system. video recording of user sessions. using network communications. Performance testing . or other catastrophic problems. hardware failures. and will depend on the targeted end-user or customer. or upgrade install/uninstall processes. or based on use by end-users/customers over some limited period of time. applications. if the new software is crashing systems every 5 minutes. large complex queries to a database system. environment.typically used interchangeably with 'recovery testing' Security testing . bogging down systems to a crawl. This doesn't mean that the programmers shouldn't check that their code works before releasing it (which of course applies to any stage of testing. etc. Recovery testing .testing how well the system protects against unauthorized internal or external access.) System testing . heavy repetition of certain actions or inputs. Automated testing tools can be especially useful for this type of testing. surveys. Also used to describe such tests as system functional testing while under unusually heavy loads. Programmers and testers are usually not appropriate as usability testers.testing how well a system recovers from crashes.typically an initial testing effort to determine if a new software version is performing well enough to accept it for a major testing effort.

clear. • • • • Page 56 of 60 . re-testing. changes. and be prepared to explain consequences. culture. intranet capabilities.testing driven by an understanding of the environment.Aditi Technologies Basic Concepts of Software Testing • • • • • • • • Exploratory testing . testing. make extensive use of group communication tools . detailed.similar to exploratory testing. Typically done by end-users or others.a method for determining if a set of test data or test cases is useful. Comparison testing . Mutation testing . Realistic schedules . In 'agile'-type environments. groupware.require walkthroughs and inspections when appropriate. etc.determining if software is satisfactory to an enduser or customer. User acceptance testing . not paper. re-test after fixes or changes. If possible.testing of an application when development is nearing completion. but often taken to mean that the testers have significant understanding of the software before testing it.allow adequate time for planning. 11. networked bug-tracking tools and change management tools. Beta testing . This will provide them a higher comfort level with their requirements decisions and minimize excessive changes later on. and documentation. insure that information/documentation is available and upto-date . Communication . Context-driven testing .start testing early on. the testing approach for life-critical medical equipment software would be completely different than that for a low-cost computer game. plan for adequate time for testing and bug-fixing. design. by deliberately introducing various code changes ('bugs') and retesting with the original test data/cases to determine if the 'bugs' are detected. promote teamwork and cooperation. bug fixing.comparing software weaknesses and strengths to competing products. testable requirements that are agreed to by all players. work closely with customers/end-users to manage expectations. cohesive. Proper implementation requires large computational resources.preferably electronic. complete. not by programmers or testers. 'Early' testing ideally includes unit testing by developers and built-in testing and diagnostic capabilities. Use prototypes to help nail down requirements. informal software test that is not based on formal test plans or test cases. not by programmers or testers. use protoypes if possible to clarify customers' expectations. For example. Alpha testing . Ad-hoc testing .often taken to mean a creative.. and intended use of software. they should be adequately reflected in related schedule changes.be prepared to defend against excessive changes and additions once development has begun.e-mail. Stick to initial requirements as much as possible . minor design changes may still be made as a result of such testing. testers may be learning the software as they test it. personnel should be able to complete the project without burning out. attainable.testing when development and testing are essentially completed and final bugs and problems need to be found before final release. Typically done by end-users or others. Adequate testing . continuous coordination with customers/end-users is necessary. If changes are necessary. What are 5 common problems in the software development process? • Solid requirements .

Use descriptive function and method names . customer acceptance testers. No matter how small. etc. avoid abbreviations. is bug free.) In adding comments. a common rule of thumb is that there should be at least as many lines of comments (including header blocks) as lines of code. can be used to check for problems and enforce standards. customer contract officers. Some organizations have coding 'standards' that all developers are supposed to adhere to. err on the side of too many rather than too few comments.the accounting department might define quality in terms of profits while an end-user might define quality as user-friendly and bug-free. delivered on time and within budget. It should be kept in mind that excessive use of standards and rules can stifle productivity and creativity. and is readable and maintainable. less than 100 lines of code is good.vertically and horizontally. quality is obviously a subjective term. Each line of code should contain 70 characters max. Coding style should be consistent throught a program (eg. future software maintenance engineers. A wideangle view of the 'customers' of a software development project might include end-users. It will depend on who the 'customer' is and their overall influence in the scheme of things. • 13. Use whitespace generously . use of brackets. Organize code for readability. Use descriptive variable names . less than 50 lines is preferable. such as McCabe Complexity metrics. One code statement per line. stockholders. What is software 'quality'? • Quality software is reasonably bug-free. avoid abbreviations. However. For C and C++ coding. Function descriptions should be clearly spelled out in comments preceding a function's code. be consistent in naming conventions. etc. use as many characters as necessary to be adequately descriptive (use of more than 20 characters is not out of line). What is 'good code'? • 'Good code' is code that works. indentations. Function and method sizes should be minimized.use both upper and lower case. and is maintainable.Aditi Technologies Basic Concepts of Software Testing 12. use as many characters as necessary to be adequately descriptive (use of more than 20 characters is not out of line). There are also various theories and metrics. etc. be consistent in naming conventions. customer management. an application should include documentaion of the overall program function and flow (even a few paragraphs is better than • • • • • • • • • • • • Page 57 of 60 . but everyone has different ideas about what's best. or what is too many or too few rules. here are some typical ideas to consider in setting rules/standards. the development organization's. naming conventions. meets requirements and/or expectations. 'buddy checks' code analysis tools. 'Peer reviews'. these may or may not apply to a particular situation: Minimize or eliminate use of global variables. Each type of 'customer' will have their own slant on 'quality' .use both upper and lower case. Management/accountants/testers/salespeople. magazine columnists.

realistic planning. Make extensive use of error handling procedures and status and error logging. It's a model of 5 levels of process 'maturity' that determine effectiveness in delivering quality software. Good internal design is indicated by software code whose overall structure is clear. and heroic efforts required by individuals to successfully complete projects. avoid too many levels of inheritance in class heirarchies (relative to the size and complexity of the application). some common rules-of-thumb include: The program should act in a way that least surprises the user It should always be evident to the user what can be done next and how to exit The program shouldn't let the users do something stupid without warning them. developed by the SEI. requirements management. CMM = 'Capability Maturity Model'. it's often a good idea to assume that the end user will have little computer knowledge and may not read a user manual or even the on-line help. 14. and works correctly when implemented. Minimize use of multiple inheritance. Level 3 . is robust with sufficient error-handling and status logging capability. or if possible a separate flow chart and detailed program documentation.) For C++.Aditi Technologies Basic Concepts of Software Testing • • • • nothing). Defense Department contractors. However. to minimize complexity and increase maintainability. Level 2 . Defense Department to help improve software development processes. periodic panics. Good functional design is indicated by an application whose functionality can be traced back to customer and end-user requirements. For C++.S.For programs that have a user interface.software project tracking. What is SEI? CMM? CMMI? ISO? IEEE? ANSI? Will it help? • • SEI = 'Software Engineering Institute' at Carnegie-Mellon University. and maintainable. and minimize use of operator overloading (note that the Java programming language eliminates multiple inheritance and operator overloading. keep class methods small.S.standard software development and maintenance processes are integrated throughout an organization. successful practices can be repeated. easily modifiable. • • • 15. Organizations can receive CMMI ratings by undergoing assessments by qualified auditors. For C++. What is 'good design'? • 'Design' could refer to many things. and if reasonably applied can be helpful. successes may not be repeatable. now called the CMMI ('Capability Maturity Model Integration'). less than 50 lines of code per method is preferable. make liberal use of exception handlers. initiated by the U. Level 1 . but often refers to 'functional design' or 'internal design'. a Software Engineering Process • • • Page 58 of 60 . It is geared to large organizations such as large U. and configuration management processes are in place. many of the QA processes involved are appropriate to any organization. understandable. Few if any processes in place.characterized by chaos.

4% at 5. 2% at 4. updates. Note that ISO certification does not necessarily indicate quality products . creates standards such as 'IEEE Standard for Software Test Documentation' (IEEE/ANSI Standard 829). Bootstrap. Trillium. testing.metrics are used to track productivity. and others. and other aspects. ISO = 'International Organization for Standardization' . development. 62% were at Level 1. (c)Q9004-2000 . and CobiT. production. In the U. the most problematical key process area was in Software Quality Assurance. Also see http://www. requirements analysis.ch/ for the latest information. Perspective on CMM ratings: During 1997-2001. and other processes. after which a complete reassessment is required..Quality Management Systems: Requirements. integration. Level 5 . maintenance. phase-out.org/ IEEE = 'Institute of Electrical and Electronics Engineers' . a third-party auditor assesses an organization.S.it indicates only that documented processes are followed. and products.) The median size of organizations was 100 software engineering/maintenance personnel. installation. test planning. The impact of new processes and technologies can be predicted and effectively implemented when required. (For ratings during the period 1992-96. the primary industrial standards body in the U. Other software development/IT management process assessment methods besides CMMI and ISO 9000 include SPICE. federal contractors or agencies. 39% at 2. 'IEEE Standard for Software Quality Assurance Plans' (IEEE/ANSI Standard 730). 16. (b)Q90002000 . and it applies to many kinds of production and manufacturing organizations. 6% at 4. What is the 'software life cycle'? • The life cycle begins when an application is first conceived and ends when it is no longer in use. Project performance is predictable. document preparation. and 0.asq.The ISO 9001:2000 standard (which replaces the previous standard of 1994) concerns quality systems that are assessed by outside auditors. publishes some software-related standards in conjunction with the IEEE and ASQ (American Society for Quality).S. testing. ITIL. Will automated testing tools make testing easier? Page 59 of 60 . 17. processes.Aditi Technologies Basic Concepts of Software Testing • • • • • • • Group is is in place to oversee software processes. and training programs are used to ensure understanding and compliance.Quality Management Systems: Fundamentals and Vocabulary.Quality Management Systems: Guidelines for Performance Improvements. and certification is typically good for about 3 years. servicing. TickIT. and 5% at 5. ANSI = 'American National Standards Institute'. The full set of standards consists of: (a)Q9001-2000 . 'IEEE Standard of Software Unit Testing (IEEE/ANSI Standard 1008). It includes aspects such as initial concept. 13% at 3.S. 32% of organizations were U. 23% at 3. internal design. MOF.iso. and quality is consistently high.the focus is on continuous process improvement. Level 4 . functional design. design. not just software. 27% were rated at Level 1. For those rated at Level 1. To be ISO 9001 certified. documentation planning. retesting.among other things. 1018 organizations were assessed. It covers documentation. Of those. coding. 23% at 2. the standards can be purchased via the ASQ web site at http://e-standards.

vyomworld.these tools check which parts of the code have been exercised by a test. a tester could click through all combinations of menu choices. logs. the time needed to learn and implement them may not be worth it. or on-going long-term projects they can be valuable. development. If new buttons are added. Another common type of approach for automation of functional testing is 'data-driven' or 'keyword-driven' automated testing. Memory analyzers . This document is for internal purposes only.to check that links are valid. documentation management. etc.) can be a difficult task. and maintenance of automated tests/test cases. For example. Additionally. or some underlying code in the application is changed. the primary being: http://www. Page 60 of 60 . adherence to standards. path coverage. interpretation and analysis of results (screens. in an application GUI and have them 'recorded' and the results logged by a tool. Other automated tools can include: Code analyzers . documentation. Test drivers can be in the form of automated test tools or custom-written testing software. buttons. etc. HTML code usage is correct.monitor code complexity. and may be oriented to code statement coverage.since they are separate from the test drivers. Note that there are record/playback tools for text-based interfaces also. and comparing the logging results to check effects of the changes. The same has then been reviewed and restructured for better reading and understanding. etc. a web site's interactions are secure. Other tools . The 'recording' is typically in the form of text based on a scripting language that is interpretable by the testing tool. The data and actions can be more easily maintained .such as via a spreadsheet . in which the test drivers are separated from the data and/or actions utilized in testing (an 'action' would be something like 'enter a value in a text box'). data. and configuration management.Aditi Technologies Basic Concepts of Software Testing • • • • • • • • • • Possibly For small projects. This approach can enable more efficient control. Load/performance test tools .such as bounds-checkers and leak detectors. bug reporting. condition coverage. The problem with such tools is that if there are continual changes to the system being tested. and for all types of platforms. The test drivers 'read' the data/action information to perform specified tests. Coverage analyzers . For larger projects. etc. etc. the application might then be retested by just 'playing back' the 'recorded' actions. dialog box choices.com/testing/. All contents of this document have been collated from various resources. Web test tools . client-side and server-side programs work. A common type of automated tool is the 'record/playback' type.for test case management. the 'recordings' may have to be changed so much that it becomes very time-consuming to continuously update the scripts.for testing client/server and web applications under various load levels.

Sign up to vote on this title
UsefulNot useful