Windows Steps Recorder - For Problem Reporting

Question:

I work in QA department, where reporting issues and defects with all supporting details to well describe the problem is key. We usually use a screen capture tool to capture the images, but then to assemble them as a problem report, we need to depend upon MS Word or such other tool. I am writing to you to check if there is a better tool that helps to perform this task even better.

By: Krishnan Sadasivam

Response:

If you are asking about a tool for screen capture, Snipping tool, which is part of Windows OS from version 7 onwards is a nice tool to capture parts of the screen. There is another tool which again is part of the Windows OS from version 7 upwards, which is called 'Steps Recorder'. This tool captures your actions and associated screen and produce a descriptive output, which will make it a lot easier for the problem reporter and the problem sover. Here is how it works in Windows 8 or 8.1:

• Press Windows Key+Q to bring up the search panel on the right.
• Type steps and you will see the "Steps Recorder" tool show up in the search results
• Click on it and it will launch the Steps Recorder Tool

• Click on the Record button and then start reproducing the problem you want to report. 
• As the recording is in progress, you have the option of adding comments to certain specific area of screen by highlighting it.
• Once done click on stop recording and your actions is compiled as multiple steps and optionally as a slide show.

• You have option to save the steps as a compiled html and email it as well.

This free tool will certainly be handly for reporting computer software problems.

Error connecting to SMTP Server

Problem:

All of you would have faced issues when connecting to a remote server on ceertain ports. The issue will be strange to trouble shoot as the same connection works from a different network or on the server and so on. I came across such a situation when building and testing a mailing component and I experienced that the .NET SmtpClient component was encountering exception. It took considerable time for me to trouble shoot and get it resolved.

Solution:

My first take was to try whether the credentials that I have used is just fine, by creating an email account in outlook and that worked fine. I just wanted to isolate various probable areas of concern. As such I then tried using an online SMTP server test service, which was showing an error that the client must first check for incoming mails. Telnet to the mailserver on port 25 also gave an error. I then examined our mail server, whether it has any such restrictions, but I could not find any specific restriction that could cause this issue.

My next step was to examine the details of the exception for any possible clues. The inner exception nested couple of levels deep revealed the error as "An attempt was made to access a socket in a way forbidden by its access permissions"

I then tried looking for solutions online there were many posts and one solution was about to try the following and one of that could solve this issue:

• Restart the windows firewall service
• Reboot the problematic machine
• Restart the “TCP/IP stack”. Run CMD as administrator, type “netsh int ip reset resetlog.txt” to reset TCP/IP.
• Try to temporarily disable antivirus.

After a bit of analysis, I could find that in my case it was the McAfee Endpoint Protection. I could find that the rule "Prevent mass mailing worms from sending mail" was set to block connections on port 25 with certain exceptions. I added the VWDExpress.exe to the exception list and then it started working fine.

Continuous Integration in Agile Software Development

Question:

I am a fresher and have recently joined an IT firm as a .NET developer. After 15 days of orientation and training I am not part of a project team. I have been hearing a lot about Continuous Integration. Can you help me understand what it is and how does it help the project execution?

By: Rajesh Narayanan

Answer:

One of the important reason behind the software project failure was that the defects or issues discovered in the later phases proving to be too expensive to address and thus adding to the time and cost of the project. The industry has come up with different methodologies to address such issues and thus Agile Methodology has gained much adoption and recognition. As you may be aware, one of the key principles of Agile is to put in processes and techniques, so that the defects or issues are detected early on and thus giving opportunity to address sooner. Practices like SCRUM, Pair Programming, Test Driven Development are all expected to address this issue of catching the defects early on. On the same lines Continuous Integration and Deployment also contributes towards offering an opportunity to discover issues early on by offering the customer a working software product every now and then.

Traditionally, developers work on building components or modules independently and there will be a phase which will be fairly closer to UAT for integrating these modules together. No wonder, the development teams will discover many inconsistencies leading to the modules not working in tandem as intended. This calls for rework on one or more of the already built modules.

Continuous Integration addresses this problem by ensuring that every time the developer checks-in the code changes, the code modules are integrated with other related modules and deployed as well. This activity is best achieved by automating the build and deployment process. That means, the developer as he checks in code changes, will see the build and deployment errors and or warnings, which are expected to be resolved then and there, so that every code change that is checkedin does not break the working product. Thus the end customer will be able to see a working product always and able to validate the change as it is implemented.

The following are some of the key practices that makes the Continuous Integration workable and useful as well:

• Maintain a Single Code Repository - Continuous Integration won't work if developers maintain isolated code repositories for different component or modules. There are plenty of open source and commercial source code control tools that offers robust conflict resolution techniques and facilitates usage of single code repository.
• Build Automation - The Continuous build and deployment activity is best accomplished by automating the same. Most of the programming languages support this requirement and tools like CruiseControl are also very useful to accomplish this.
• Test Automation - The automation process shall also execute the basic tests by itself. this where Test Drivent Development is in use. The developers, as they write code are also expected to create test scripts, so that these will also be executed during the automated build process.
• Frequent Code Commits - The developers should commit the code more frequently and at the least every day. They should commit the code after every logical completion of a code change, so that the build does not break. This where, the Agile principles revolves around braking the coding tasks into smaller units, so that such tasks typically take 8 or 16 hours to complete.
• Automated Deployment - Coupled with build automation, the code should also be deployed on to the test environment, so those involved in testing see the latest changes as soon as they are committed into the repository.

Hope the above explains the purpose and the principles of Continuous Integration. You can look up Martin Fowler's article on the subject to know more.

Web Application - Vulnerability Testing

Question:

I am a software tester with 11 months experience. I want to explore security testing area and would like to know more about vulnerability testing more specifically about SQL injection attack. Also guide me as to how these testing can be performed manually.

By: Saran Satyan

Answer:

Vulnerability Testing is a practice area for security professionals. There is no simple or one solution that will work in all cases. One has to go through a structured approach to accomplish this testing. The high level steps include scoping, information gathering, tool selection, and then performing the scanning. Most of the vulnerabilities require in-depth knowledge on the internals of the web application like its design and architecture in addition to the tools and technology used in its build. Manual methods or techniques may not help in identifying most of the vulnerabilities.

As we all know, SQL query language is used to retrieve data from the databases and a technique to exploit the the query language to fetch unintentional data by injecting unexpected input data is referred to as SQL Injection attack. As an example, typical where clause in a query used to authenticate a user would be like where userid = <user_id> and password = <password>. The user id and password as entered by the user would be substituted in this where clause in run time before execution. Programmers adopt different techniques to dynamically bind the input variables to build the needed where clause. One such simple method of dynamically building the where clause is by concatenating the input data like "... where userid = " + user_id + " and password = " + password = ";" In this case for instance, if the user inputs the password with something followed by "or 1=1" then the where clause of the final query will look like where userid = user_id and password = password = password or 1=1; As we all know, this query when executed will retrieve all the rows in the user table because of the condition or 1=1.

Here is an article worth referring to know more about SQL injection attacks.You may also check out the following links to know more about vulnerability testing:

Web Application Security Testing Cheat Sheet
The world's most advanced Open Source vulnerability scanner and manager
Web application security: Testing for vulnerabilities

Hope you will find this response useful.

Website Scalability Test - JMeter Listeners

Question:


I am on a task to perform a scalability test of a website. I am new to JMeter and I want to know how to capture and analyze the test results using JMeter. More specifically I need to capture the response time of the pages that I would be testing.

By: Saran Sathyan


Answer:

You need to add a listener and configure to write the test results into a Log file. You have the option of using a csv or xml file format. You can do this visually, by right clicking on your test project shown in the left explorer bar and then add-> Listner->... JMeter provides many listeners and you may just choose either Simple Data Writer or View Results in a Table. In the resulting window, you will find options to specify the output file location and configure the data elements that you want to capture. JMeter captures two time fields, one being the elapsed time and the other being latency. While the latency indicates the time to the first response, the elapsed time indicates the total time to load the page completely. With this listener, all your test results will be logged, and you may use simple tools like excel or import into MS Access or such other database as you may be comfortable and then get the necessary summary data by grouping on appropriate fields.


Generally to assess the scalability of your website, you also need to monitor and collect stats from the server(s) on which your website is running at the same time your tests are run. You may have to engage your system administrators to help you in collecting the performance statistics on server resource utilization like, CPU, Memory, Network bandwidth, Disk IO, etc. As you simulate more load from JMeter, the utilization of the resources on the server will go up. The ideal approach is to plan to have multiple tests starting with 50 or 100 users and ramp up the load until you the resource utilization on the server hits the maximum (say 90%). This way you may also benchmark the site performance on the given server hardware and network bandwidth.

Your report should also report the server utilization details in addition to the page response time and the bytes received so as to make it useful for the report users to make further decisions. Also be aware that if you perform the load tests from one location, your test results might be biased as you may hit the bandwidth limitation on your end. Hope this helps.

For more details on JMeter listeners, check out the documentation available online at http://jmeter.apache.org/usermanual/listeners.html

Testing SOAP Webservice APIs

Question:

I am working on an integration project where the components that we build need to consume a set of Webservice APIs. While the vendor has shared the documentation and test accounts for us, I am curious if there would be a simple tool which help me to browse through the various methods and test the same on the fly. I know that we can quickly build a test driver using the proxy class for the given wsdl. However, a generic tool might be of great use as it saves time and it can be used for different services as well.

By: Kathiravan Venkatesan

Response:

As you have acknowledged, it is quite easy to quickly build a proxy component and then write simple methods around the exposed web methods to test the webservice APIs. And yes there are tools to test SOAP web services as well that can be used to test a multitude of service APIs. One such tool that I have used in the past is SoapUI by SmartBear, which has a professional and a free open source edition. The free version is good enough to browse through the various web methods and test them as well.

I would suggest you to explore the features of SoapUI to know more about the tool's capabilities. The usage is simple and straight forward. Once you create a new project the tool helps build a tree of web methods based on the wsdl of the service. You can create as many test data against each services and execute instantly to see the output as well Moreover, the test data can be dynamic from a wide range of external data sources. Thus this tool can be very handy for performing the functional testing of webservices.

In addition, the tool can be used to perform load testing and security testing as well. The tool can also supports simulation, i.e. mock the services, which will be very useful during the development stage. There is more to it and I would suggest you to explore, though some of the features are part of the pro version.

JMeter for Scalability Testing

Question:

In on of your own blog post, you have indicated the use of JMeter for Stress Testing a Game Application. I have a web application to be tested for its scalability. Do you recommend using JMeter for simulating load? You may also share some thoughts on its ease of setting up and usage and generally about Scalability testing. You may also recommend using any other tools together with JMeter.

Question By: Natarajan Ganesh

Response:

Scalability testing is about testing how the application scales in or out under different load conditions, and yes we need tools to simulate the load. It is about specifically testing the deployment model of the application as to how it makes use of additional computing resources when the load increases. Needless to mention, it involves testing both scale up and scale down. The actual test cases for scalability testing depend on the application design and architecture as to how it is expected to scale.

For example, in case of a cluster of application servers used, the test case should be to verify that the load on all the servers in the cluster are evenly distributed or as designed and that no server in the cluster is idles out when one or more other servers are peaking beyond a threshold. Another related test case could be to examine the application behavior when one of the server in the cluster is pulled out.

Thus scalability testing involves in addition to simulating required load or stress on the application, examining whether the scale up or down happens as designed or architected.

Yes, JMeter is a good tool for simulating the necessary load or stress on the application. Setting up JMeter and using it is easy and intuitive. The following simple steps would help you to get JMeter up and running the tests on a Windows box:

1. Make sure that you have JRE or JDK installed the bin folder is included in the system path.
2. Navigate to the bin folder of the JMeter installation folder and run the JMeter.bat. Just in case if it errors out, view or edit the JMeter.bat file to see if there is any other settings that need to be modified.
3. Right Click on the Test Plan in the vertical explorer pane on the left and add a Thread Group (Add -> Threads -> Thread Group).
4. Right Click on the newly added thread group and add a Sampler -> HTTP Request. In the resulting window make sure that you fill out appropriate vaules. Repeat this step to add as many HTTP Requests to be sampled.
5. Use an appropriate Listener to gather the data. This can be done again by adding a Listener to the Thread Group.

You could observe from the Add menu that you have options to add configuration elements, pre and post processors, assertions and logic controllers. Depending on your test scenario, use a combination of these components an build your test plan accordingly. Consult the JMeter documentation to to know more about effectively using JMeter.

While JMeter is just a tool simulate the stress or load, you need tools to gather server perormance data and as well as the application performance. While the native performance monitoring tools on Windows could b very useful, for Linux, you can try out NewRelic, a hosted remote monitoring tool. As I have described in one of my blog post, the application should have been designed to generate necessary data for further review and examination to spot probable or potential bottlenecks that need to be further tweaked.

Good luck with your testing.