Real Browser Research Articles

Методика автоматического тестирования развивающегося веб-приложения

The article is devoted to the technique of automated testing of NSUts – automatic assessment system for programming tasks developed at NSU. The main priority for this technique is to test both the old and the new versions of the application, so that the same or minimally modified tests could be executed on two versions of the system with different architectures. This could be useful while organizing the development process for other applications with a long life cycle. To test not only the server but also the client side of the web application, we suggest using tools like Selenium WebDriver to simulate user actions by sending commands to real browsers. We use the well-known Page Object design pattern to handle differences in HTML layout and functionality, and describe a number of ways to make developed tests less fragile and easily adapt those to work with the new version of the system. The article also describes the use of this technique to organize automated testing of the NSUts system and analyzes its effectiveness. The analysis shows that the estimated code coverage by these tests is quite high, and therefore the technique can be considered effective and applied to other similar web applications.

Security testing technology based on the provisions of the simulation models scaling theory

The simulation model of web- application security testing technologies is improved in the work. The basis of the development is the basic provisions of the theory of scaling imitation models in the framework of algorithmic simplification based on the evaluation of transitive dependence on management and data. A distinctive feature of the developed simulation model is the adaptation of the choice of input control-flow statements and data to an increase in the requirements for the speed of development and implementation of the model, which resulted in the implementation of the procedure for interacting with a real browser using browser automation tools and generating attack data in several dialects. In order to reduce the time spent on simulation modeling, it was decided to conduct scaling by replacing the information exchange procedures with the server using an HTTP client with the procedures of interacting with a real browser using browser automation tools. In addition to the main purpose of scaling, this replacement will increase the reliability of the result of testing the attack with the injection of JavaScript code. In this case, the Selenium Webdriver library was chosen as a mean of browser automation. One of the difficulties of testing vulnerability to SQL injections is a large number of SQL dialects depending on the database management system used. This fact forces the generation of data for an attack in several dialects to maximize coverage of attack vectors. On the one hand, this increases the amount of input data of the simulation model, increases the complexity of the project and negatively affects the overall time characteristics of implementation and testing of the vulnerability. On the other hand, using the proposed scaling approach, the complexity of the project can be significantly reduced without degrading the qualitative characteristics. The proposed approach of algorithmic simplification of simulation modeling is based on advanced procedures for estimating transitive control and data dependencies. The admissibility and expediency of using the estimation of the transitive dependency has been determined, which will reduce the computational complexity of the implemented algorithms in comparison with the algorithms for estimating the direct dependency up to 1,5 times.

ИМИТАЦИОННАЯ МОДЕЛЬ ТЕХНОЛОГИИ ТЕСТИРОВАНИЯ БЕЗОПАСНОСТИ WEB-ПРИЛОЖЕНИЙ

Разработана имитационная модель технологии тестирования безопасности на основе положенийтеории масштабирования имитационных моделей, отличающаяся от известных адаптацией выбора входных операторов управления и данных к повышению требований оперативности разработки и реализациимодели, что выразилось в реализации процедуры взаимодействия с реальным браузером с использованиемсредств автоматизации браузера и формировании данных для атаки на нескольких диалектах.

Web browsing automation for applications quality control

Context: Quality control comprises the set of activities aimed to evaluate that software meets its specification and delivers the functionality expected by the consumers. These activities are often removed in the development process and, as a result, the final software product usually lacks quality. Objective: We propose a set of techniques to automate the quality control for web applications from the client-side, guiding the process by functional and nonfunctional requirements (performance, security, compatibility, usability and accessibility). Method: The first step to achieve automation is to define the structure of the web navigation. Existing software artifacts in the phase of analysis and design are reused. Then, the independent paths of navigation are found, and each path is traversed automatically using real browsers while different kinds of assessments are carried out. Results: The processes and methods proposed in this paper have been implemented by means of a reference architecture and open source tools. A laboratory experiment and an industrial case study have been performed in order to validate the proposal. Conclusion: The definition of navigation paths is a rich approach to model web applications. Grey-box (black-box and white-box) methods have been proved to be very valuable for web assessment. The Chinese Postman Problem (CPP) is an optimal way to find the independent paths in a web navigation modeled as a directed graph.

Testing, Measuring, and Diagnosing Web Sites from the Users' Perspective

Users perceive good Internet performance as characterized by low latency, high throughput and high availability. When browsing the Web, users are concerned with the performance of entire pages. Understanding and identifying the sources of the performance problems are very important issues, especially for e-business. Therefore, there is the need to have a service for testing and measuring e-business Web site performance from the perspective of the end-users. We present our contribution in this area, that is, the Wing free service that has been developed for the purpose of Web transaction visualization. Our Web client that probes a target Web site is a real Web browser (MS IE), so the user can observe how a particular browser uses the network. Such known tools use their own Web browsing methods. Therefore, the solutions can be different from that used by real browsers, and the results can be inadequate. Wing helps identify inefficient network usage by the browser and helps to tune Web pages to use the network efficiently. Therefore, Wing can be a good analysis tool for Web page and network application developers.

IMAGIS, a PACS software solution for the National Health System in Cuba

Elastic Internet applications have the greatest share in the traffic transported over the Internet today. Web access and e-mail are the most popular applications among most people using the Internet. Although these applications can well adapt to a wide range of bandwidths, their performance is an issue to people using services interactively.In this paper, we use sophisticated application-level evaluations to extract traffic characteristics and performance measures for HTTP, SMTP and POP3 from traffic traces. The process of loading Web pages by real browsers using persistent and parallel connections is studied in detail, revealing statistics about the elements in Web pages as well as the number of parallel connections and the accumulated waiting time during Web page loads.The main results are: (1) High variance distributions are not only found as expected in file sizes, but also in the number of items in a Web page, the number of e-mails transmitted in one connection, the duration of SMTP command exchanges or even the users' viewing times for Web pages. (2) Web browsers utilize more parallel connections than usually expected to simultaneously load items. (3) A large portion of the delay in Web page retrievals or e-mail transfers is due to serial waiting and can therefore not be significantly reduced by increasing bandwidths. Therefore, low latency is as much an issue in access systems as high bandwidth.

Observed performance of elastic Internet applications

Elastic Internet applications have the greatest share in the traffic transported over the Internet today. Web access and e-mail are the most popular applications among most people using the Internet. Although these applications can well adapt to a wide range of bandwidths, their performance is an issue to people using services interactively. In this paper, we use sophisticated application-level evaluations to extract traffic characteristics and performance measures for HTTP, SMTP and POP3 from traffic traces. The process of loading Web pages by real browsers using persistent and parallel connections is studied in detail, revealing statistics about the elements in Web pages as well as the number of parallel connections and the accumulated waiting time during Web page loads. The main results are: (1) High variance distributions are not only found as expected in file sizes, but also in the number of items in a Web page, the number of e-mails transmitted in one connection, the duration of SMTP command exchanges or even the users' viewing times for Web pages. (2) Web browsers utilize more parallel connections than usually expected to simultaneously load items. (3) A large portion of the delay in Web page retrievals or e-mail transfers is due to serial waiting and can therefore not be significantly reduced by increasing bandwidths. Therefore, low latency is as much an issue in access systems as high bandwidth.