Visual studio Team suite 2008

Just came across the visual studio team suite 2008 edition. I have installed this. this is a becoming very handy webtesting tool for the testers as well. It is having my cool features integrated into single suite

Supports different test types such as

a. Unit test: Use a unit test to create a programmatic test in C++, Visual C# or
Visual Basic that exercises source code.

b. Web Test: Web tests consist of an ordered series of HTTP requests that you
record in a browser session using Microsoft Internet Explorer. You can have
the test report specific details about the pages or sites it requests, such
as whether a particular page contains a specified string.

c. Load Test: You use a load test to encapsulate non-manual tests, such as
unit, Web, and generic tests, and then run them simultaneously by using
virtual users. Running these tests under load generates test results,
including performance and other counters, in tables and in graphs.

d. Generic testA generic test is an existing program wrapped to function as a
test in Visual Studio.

e. Manual test: The manual test type is used when the test tasks are to be
completed by a test engineer as opposed to an automated script.

And also VS TFS supports Profiling/code coverage/ Load testing/ data driven test. It is having inbuilt bug tracking system/Project management system everything in one tool

Click here to download


i am loving'it :-)

Screen Capture utilties

Many users are trying to grab the screen capture utilities. This post belongs to them

For freeware and shareware screen capture utilities follow below link

http://www.etrusoft.com/screen-capture-software-reviews/

Another awesome add in for firefox users - Yslow

Yslow for firebug is a great utility for analyzing the web pages and based on some set of rules


To download
http://developer.yahoo.com/yslow/

One URL covers many tools

Just found one URL which can cover more than 100 tools

Here we go....

http://tester.jonasjohn.de/

SQL query optimization testing

Most of the present website uses the big big queries to get the data from the database. But are we testing how much time it will take to get the values from the data, can we improve website performance by using proper queries. For those who want to test this type of functionality there is one utility. This utility can be used as a SQL query stress tool

Download this utility Click here

Bad boy automated tool

Bad boy is the automation regression tool which works with view state and lots of the features in it.

To download it http://www.badboy.com.au/

It is a good record and play back tool with load testing feature also i.e we can simulate the 1000 users at a time

It not commercial tool or open source tool cheap to use

Malicious code injection : Not through Sql

All code injection attacks work on the same principle: a hacker piggybacks malicious code onto good code through an input field in the application. Therefore, the protection instead has to come from the code within the application itself.The root of all code injection problems is that developers put too much trust into the users of applications. A developer should never trust the user to operate the application in a safe manner. There will always be someone who is looking to use malicious code in an exploitative manner.

Aside from SQL injections, there are several other types of malicious code injection attacks with which developers must become familiar. Three of these types of dangerous malicious code injections are
1.XPath injection
2.LDAP injection,
3.command execution injection.

XPath Injection:

The attacker inputs a string of malicious code meant to trick the application into providing access to protected information. If your website uses an XML (Extensible Markup Language) document to store data and user input is included in an XPath query against that document, you may be vulnerable to an XPath injection.

For example, consider the following XML document used by an e-commerce website to store customers’ order history:


< orders >
< customer id = " 1" >
< name > Bob Smith
bob.smith@bobsmithinc.com
1234567812345678


1
10.00
Sprocket


2
9.00
Cog



…


The website allows its users to search for items in their order history based on price. The XPath query that the application performs looks like this:

string query = "/orders/customer[@id='" +
customerId + "']/order/item[price >= '" +
priceFilter + "']";

If both the customerId and priceFilter values have not been properly validated, an attacker will be able to exploit the XPath injection vulnerability. Entering the following value for either value will select the entire XML document and return it to the attacker:

'] | /* | /foo[bar='

Find more