Black box testing techniques are important to test the functionality of the system without knowing its inner detail which makes sure correct, consistent, complete and accurate behavior or function of a system. Black box testing strategies are used to test logical, data or behavioral dependencies, to generate test data and quality of test cases which have potential to guess more defects. Black box testing strategies play pivotal role to detect possible defects in system and can help in successful completion of system according to functionality. The studies of five companies regarding important black box testing strategies are presented in this thesis. This study explores the black box testing techniques which are present in literature and practiced in industry as well. Interview studies are conducted in companies of Pakistan providing solutions to finance industry, which is an attempt to find the usage of these techniques. The advantages and disadvantages of identified Black box testing strategies are discussed, along with it; the comparison of different techniques with respect to most defect guessing, dependencies, sophistication, effort, and cost is presented as well.

S vývojem informací, komunikací a technologií se moderní průmyslové řídicí systémy (ICS) potýkají čím dál více s otázkami automatického testováni pro zabezpečení stability a bezpečnosti systému. Z tohoto důvodu se testování stalo jednou z nejdůležitějších částí životního cyklu všech softwarů. V této diplomové práci budu zvažovat možnost využití stávajících zkušebních metod a nástrojů pro získání dostatečné jakosti a bezpečnosti softwaru v kontinuálních integračních systémech.

No description available.

Made available in DSpace on 2014-12-17T15:47:51Z (GMT). No. of bitstreams: 1 ClevertonHA.pdf: 1775580 bytes, checksum: 9e49f67c9b7fbb459e2b24f568db691b (MD5) Previous issue date: 2010-03-01 / Coordena??o de Aperfei?oamento de Pessoal de N?vel Superior / Some programs may have their entry data specified by formalized context-free grammars. This formalization facilitates the use of tools in the systematization and the rise of the quality of their test process. This category of programs, compilers have been the first to use this kind of tool for the automation of their tests. In this work we present an approach for definition of tests from the formal description of the entries of the program. The generation of the sentences is performed by taking into account syntactic aspects defined by the specification of the entries, the grammar. For optimization, their coverage criteria are used to limit the quantity of tests without diminishing their quality. Our approach uses these criteria to drive generation to produce sentences that satisfy a specific coverage criterion. The approach presented is based on the use of Lua language, relying heavily on its resources of coroutines and dynamic construction of functions. With these resources, we propose a simple and compact implementation that can be optimized and controlled in different ways, in order to seek satisfaction the different implemented coverage criteria. To make the use of our tool simpler, the EBNF notation for the specification of the entries was adopted. Its parser was specified in the tool Meta-Environment for rapid prototyping / Alguns programas podem ter sua entrada formalizada atrav?s de gram?ticas livres de contexto. Esta formaliza??o facilita a utiliza??o de ferramentas na sistematiza??o e na eleva??o da qualidade do seu processo de teste. Dentro desta categoria de programas os compiladores foram os primeiros a utilizar este tipo de ferramenta para a automa??o de seus testes. Neste trabalho apresentamos uma abordagem para a defini??o de testes a partir da descri??o formal das entradas do programa. A gera??o das senten?as ? realizada levando em considera??o aspectos sint?ticos definidos pela especifica??o da entrada, a gram?tica. Por quest?es de otimiza??o s?o utilizados crit?rios de cobertura para limitar a quantidade de testes sem diminuir a sua qualidade. Nossa abordagem utiliza estes crit?rios no direcionamento da gera??o de maneira a produzir senten?as que satisfa?am um crit?rio de cobertura especifico. A abordagem apresentada se baseia na utiliza??o da linguagem Lua, se apoiando fortemente em seus recursos de corotinas e constru??o din?mica de fun??es. Com estes recursos, propomos uma implementa??o compacta e simples que pode ser otimizada e controlada de formas variadas, com o intuito de buscar a satisfa??o dos diferentes crit?rios de cobertura implementados. Para tornar simples o uso de nossa ferramenta foi adotada a nota??o EBNF para a especifica??o das entradas. O seu parser foi especificado na ferramenta Meta-Environment por esta favorecer a r?pida prototipa??o

This master thesis addresses the issue of software testing. It discusses different types and forms of testing such as white-box testing, black-box testing, unit testing, integration testing and regression testing. Further it deals with the specific problems of testing network applications and automation of the testing process. To solve these issues, the thesis presents a language based on XML for describing testing cases. The following chapter describes the design of this language interpreter. The thesis also deals with problems occurring during implementation phase of similar tools and their possible solutions. Functionality demonstration of designed tool helped to discover an error in product of AVG Technologies CZ, s.r.o..

The widespread usage of smartphones and mobile applications in Sweden exposes the users to potential risks if not adequate security standards are implemented. An insecure application that is exploited by an adversary could potentially compromise the users private data and integrity. As such, this report aims to examine and evaluate the security of ten commonly used mobile applications in Sweden. Using the OWASP Mobile Security Testing Guide (MSTG) and conducting penetration testing, the applications were assessed in regards of strengths and weaknesses. The results presents nine potential vulnerabilities of which three were successfully exploited with the use of brute-force and session hijack attacks. Even though all examined applications adopt industry security standards of various degrees, our findings shows that a few applications are susceptible to vulnerabilities. / Det breda användadet av smarta telefoner och mobila applikationer i Sverige utsätter användare för potentiella risker om inte tillräckliga nivåer av säkerhetsstandarder implementeras. En osäker applikation som utnyttjas av en person med onda avsikter skulle kunna leda till dataintrång hos en användare. Därav siktar denna rapport på att utvärdera säkerheten hos tio vanligt förekommande mobila applikationer i Sverige. Med hjälp av OWASP Mobile Security Testing Guide (MSTG) och utförandet av penetrationstester så har applikationernas styrkor och svagheter utvärderats. Resultatet som presenteras visar på nio potentiella sårbarheter varav tre kunde verifieras genom lyckade brute-force och session hijack attacker. Även om de utvärderade applikationerna implementerar en viss nivå av säkerhetsstandarder, så visar vårt resultat att vissa av applikationerna är utsatta för sårbarheter.

Cieľom tejto práce je vývoj nástroja na automatické generovanie testov pre aplikácie s grafickým užívateľským rozhraním v~prostredí GNOME. Na generovanie testov sú použité metadáta asistenčných technológií, konrétne AT-SPI. Navrhnutý generátor testov využíva dané metadáta na vytvorenie modelu testovanej aplikácie. Model mapuje sekvencie udalostí, ktoré generátor vykoná na testovanej aplikácii počas generovania testov. Súčasťou procesu generovania je zároveň detekcia závažných chýb v testovaných aplikáciách. Výstupom procesu generovania sú automatizované testy, ktoré sú vhodné na regresné testovanie. Funkčnosť implementovaného generátora testov bola úspešne overená testovaním 5 aplikácií s otvoreným zdrojovým kódom. Počas testovania aplikácií navrhnutým nástrojom sa preukázala schopnosť detekovať nové chyby.

Zariadenia, na ktoré sa každodenne spoliehame, sú stále zložitejšie a využívajú zložitejšie protokoly. Jedným z týchto protokolov je Wi-Fi. S rastúcou zložitosťou sa zvyšuje aj potenciál pre implementačné chyby. Táto práca skúma Wi-Fi protokol a použitie fuzz testingu pre generovanie semi-validných vstupov, ktoré by mohli odhaliť zraniteľné miesta v zariadeniach. Špeciálna pozornosť bola venovaná testovaniu Wi-Fi v systéme ESP32 a ESP32-S2. Výsledkom práce je fuzzer vhodný pre testovanie akéhokoľvek Wi-Fi zariadenia, monitorovací nástroj špeciálne pre ESP32 a sada testovacích programov pre ESP32. Nástroj neodhalil žiadne potenciálne zraniteľnosti.

Model-based testing (MBT) is a black-box software testing technique that focuses on specification of the system-under-test (SUT) and/or its environment. It uses models to automatically generate a large number of tests. To the best of our knowledge, no study has investigated the correlation of model coverage with SUT coverage using more advanced coverage criteria (such as edge-pair coverage) and the correlation of coverage (at model level and SUT level) with test suite effectiveness using non-adequate test suites in the context of MBT despite the prominence of non-adequate test suites in industry. To carry out the investigation, we extend an existing open-source MBT tool called Modbat to measure edge-pair coverage at model level, implement a new tool called PaCovForJbc to measure edge-pair coverage, edge coverage and node coverage at SUT level. Finally, we perform an experiment using these tools applied on three projects: “ArrayList”, and “LinkedList” of Java standard library, and “Apache ZooKeeper”. Overall, the results suggest the following: Edge and edge-pair coverage at model level often have a moderate to high correlation with the same type of coverage at SUT level, while that link between model and SUT for node coverage is weaker. Moreover, coverage criteria at SUT level often have a moderate to high correlation with test suite effectiveness, and a coverage criterion at SUT level has a slightly higher correlation with test suite effectiveness than the same type of coverage at model level. Regarding coverage at model level, edge and edge-pair coverage at model level have a slightly higher correlation with test suite effectiveness than node coverage at model level. Note that the mentioned suggestions need to be taken with discretion, because results vary depending on the project and/or coverage criterion under investigation. / Modellbaserad testning (MBT) är en black-box-testteknik som fokuserar på specifikation av system-under-test (SUT) och/eller dess miljö. MBT använder modeller för att generera ett stort antal tester automatiskt. Såvitt vi vet, finns ingen studie som undersökt korrelationen mellan modelltäckning och täckning av SUT med hjälp av mer avancerade täckningskriterier såsom kantparstäckning. Dessutom finns ingen studie som undersökt korrelationen mellan täckning (på modellnivå och SUT-nivå) och effektivitet av icke- adekvata testsviter som genereras med hjälp av MBT trots betydelsen av icke-adekvata testsviter i industrin. För att utföra undersökningen, utökar vi ett ”open-source” MBT-verktyg som kallas för Modbat för att mäta kantparstäckning på modellnivå. Dessutom implementerar vi ett nytt verktyg som kallas för PaCovForJbc för att mäta kantpars-, kant- och nodtäckning på SUT-nivå. Till slut utför vi experiment genom att applicera Modbat och PaCovForJbc på tre projekt: ”ArrayList” och ”LinkedList” av Javas standardbibliotek samt ”Apache ZooKeeper”. Sammantaget indikerar resultaten följande: Kant- och kantparstäckning på modellnivå har ofta en måttlig till hög korrelation med samma typ av täckning på SUT- nivå, medan länken mellan modell och SUT för nodtäckning är svagare. Dessutom har täckningskriterier på SUT-nivå ofta en måttlig till hög korrelation med testsvitseffektivitet, och ett täckningskriterium på SUT-nivå har en aning högre korrelation med testsvitseffektivitet än samma typ av täckning på modellnivå. Angående täckning på modellnivå har kant- och kantparstäckning på modellnivå en aning högre korrelation med testsvitseffektivitet än nodtäckning på modellnivå. Observera att de nämnda förslagen måste tas med diskretion, eftersom resultaten varierar beroende på projektet och/eller täckningskriteriet som undersöks.