Test Automation Forum

Welcome to TAF - Your favourite Knowledge Base for the latest Quality Engineering updates.

Test
Automation
Forum

(Focused on Functional, Performance, Security and AI/ML Testing)

Brought to you by MOHS10 Technologies

Sumitra Sahoo

image

VAPT to Safeguard your Healthcare Apps

Introduction : In an era where cyber threats are increasingly sophisticated, ensuring the security of healthcare applications is paramount. This article outlines the process of conducting a vulnerability assessment and gray-box penetration testing on a healthcare application using Burp Suite Professional, OWASP ZAP, and manual testing techniques. The primary objective was to identify potential vulnerabilities that could be exploited by attackers and provide recommendations for mitigating these risks.  Purpose of testing : The purpose of this security testing was to identify vulnerabilities in the healthcare application and ensure its robustness against cyber threats. By uncovering weaknesses, we aim to enhance the application’s security posture, protect sensitive health data, and ensure compliance with industry standards (OWASP Top10 issues).  Scope of testing : The scope encompassed both automated and manual testing techniques. The testing focused on identifying critical vulnerabilities, including OWASP Top 10 issues, SQL injection, Cross-Site Scripting (XSS), and other common security flaws. The testing was divided into two main phases:  Vulnerability assessment  Penetration Testing  Tools and techniques : Vulnerability assessment:- Automated scanning tools, such as Burp Suite Professional and OWASP ZAP, were employed to systematically identify common security vulnerabilities. These tools were chosen for their robust capabilities in detecting a wide range of security issues efficiently. The automated phase involved:  Burp Suite professional: Used for its extensive functionality in identifying and exploiting vulnerabilities, Burp Suite provided comprehensive coverage of the OWASP Top 10 issues.  OWASP ZAP: Utilized for its user-friendly interface and effective automated scanning capabilities, OWASP ZAP was instrumental in the initial identification of vulnerabilities.  The automated scans targeted various components of the healthcare application to uncover vulnerabilities such as:  SQL Injection   Cross-Site Scripting (XSS)   OWASP Top 10 issues   Other critical vulnerabilities  These automated scans provided a comprehensive overview of the existing security weaknesses within the healthcare application, setting the stage for the subsequent penetration testing phase.  Penetration testing :- The manual testing phase involved a more detailed and nuanced examination of the system. This included:  Thorough manual assessment: We began with a meticulous manual review of the application to identify potential vulnerabilities. This involved examining the architecture and functionality to pinpoint key fields and components susceptible to attacks.  Exploitation of vulnerabilities: Based on the findings from the manual assessment and automated scans, we attempted to exploit identified vulnerabilities to understand their potential impact.  Identification of additional vulnerabilities: Manual testing also focused on discovering vulnerabilities that automated tools might have missed, ensuring a comprehensive assessment.  Findings and Analysis: The combination of automated and manual testing techniques provided a full view of the healthcare application’s security posture. Key findings included:  High severity issues: The assessment revealed that cloud metadata was potentially exposed, posing a significant risk to the confidentiality and integrity of sensitive data stored in the cloud environment.  Medium severity issues:  CSP (Content Security Policy) wildcard directive: The presence of wildcard directives in the Content Security Policy could weaken security controls and increase the risk of cross-site scripting (XSS) attacks.  Hidden file found: Discovery of hidden files within the application’s directory structure could indicate potential security risks or unauthorized access.  TLS certificate issues: Weaknesses in the Transport Layer Security (TLS) certificate configuration could expose sensitive data to interception or unauthorized access.  Strict transport security not enforced: Failure to enforce Strict Transport Security (HSTS) could leave the application vulnerable to protocol downgrade attacks and unauthorized access.  Low severity issues: The assessment also identified areas for improvement in data protection measures, although these were classified as low severity Recommendations : Based on the findings, we provided the following recommendations to mitigate identified risks:  High severity issues:  Cloud metadata exposure: Implement stringent access controls and encryption for cloud metadata to prevent unauthorized access. Regularly review and update cloud security configurations to ensure compliance with best practices.  Medium severity issues:  CSP Wildcard directive: Remove wildcard directives from the Content Security Policy. Define specific sources for content to minimize the risk of XSS attacks.  Hidden file found: Conduct a thorough audit of the application’s directory structure to identify and secure hidden files. Implement access controls to restrict unauthorized access.  TLS certificate issues: Review and strengthen the TLS certificate configuration. Ensure the use of strong, up-to-date certificates and enforce proper TLS protocols to protect data in transit.  Strict transport security not enforced: Enable and enforce HTTP Strict Transport Security (HSTS) to prevent protocol downgrade attacks and ensure secure communication.  Low severity issues:  Data protection improvements: Enhance data protection measures, including data encryption and secure storage practices. Regularly review and update security policies to align with industry standards. Conclusion : The vulnerability assessment and penetration testing of the healthcare application highlighted critical security issues and provided valuable insights into the application’s security. By addressing the identified vulnerabilities and implementing the recommended security measures, the healthcare application can significantly enhance its defence against potential cyber threats, ensuring the safety and integrity of sensitive health data.  5+

Enhance Your Efficiency with Cutting-Edge Automation tool Cypress

Introduction: In today’s fast-paced software development landscape, automated testing plays a crucial role in ensuring the quality and reliability of applications. With numerous automation frameworks available, Cypress has emerged as a popular choice among developers due to its simplicity, speed, and powerful features. In this article, we will explore the basics of Cypress automation and how it can streamline your testing efforts. What is Cypress? Cypress is an open-source JavaScript-based end-to-end testing framework designed to simplify the process of testing web applications. Unlike traditional testing frameworks, Cypress operates directly in the browser, allowing for real-time test execution and comprehensive debugging capabilities. Its unique architecture enables developers to write faster, easier-to-understand tests while providing fast feedback during the development process. Key Features of Cypress: 1. Real-time reloading: Cypress’s live reloading feature enables developers to see the changes in their application and test code in real-time as they make edits. This capability significantly speeds up the development and debugging process. 2. Time-travel: Cypress allows you to step through each step of your test suite’s execution, giving you the ability to view and verify the state of your application at any given point. This feature is particularly useful for troubleshooting and understanding how your application behaves during tests. 3. Automatic waiting: Cypress automatically waits for elements to appear on the page before performing actions, eliminating the need for explicit waits or sleeps. This behavior ensures that your tests are more reliable and resistant to flakiness. 4. Easy setup and installation: Cypress has a simple installation process and requires minimal configuration, allowing developers to quickly get started with writing tests. It also provides excellent documentation and a vibrant community that actively contributes plugins and support. Best Practices for Writing Effective Cypress Tests: 1. Keep tests focused: Write tests that target specific functionalities or user flows. This ensures that tests are more maintainable and easier to debug. 2. Use descriptive test names: Give your tests clear and descriptive names that reflect their purpose and what they are testing. This makes it easier to understand the intent of the test when reviewing or debugging. 3. Utilize Cypress commands: Cypress provides a rich set of commands that make test code more expressive and readable. Take advantage of these commands to write concise and efficient tests. 4. Use test fixtures: Test fixtures are a powerful feature in Cypress that allow you to set up a known state before running tests. This helps create more reliable and isolated tests. Writing Tests with Cypress: Cypress provides an intuitive API for writing tests, allowing developers to express their testing scenarios in a readable and understandable manner. Here’s an example of a simple Cypress test: In the above example, we use the `visit` command to navigate to a website and then use the `title` command to assert that the page title contains the expected value. Advantages of Cypress over other testing frameworks: 1. Architecture: Cypress’s unique architecture, operating directly in the browser, provides better control and visibility into the application under test. This results in faster test execution and improved debugging capabilities. 2. Automatic waiting: Cypress’s automatic waiting for elements eliminates the need for explicit waits, making tests more reliable and resistant to flakiness. This reduces the effort required to handle asynchronous behavior. 3. Real-time reloading: Cypress’s live reloading feature provides immediate feedback during test development, making it easier to iterate and debug tests. Integrations and Extensibility: Cypress seamlessly integrates with various popular testing frameworks, build systems, and CI/CD tools. It provides plugins and APIs to extend its functionality, allowing you to integrate it into your existing development workflow. Whether you use JavaScript, TypeScript, or other frameworks like React or Angular, Cypress can easily be incorporated into your testing process. 1. Testing Framework Integrations: Cypress seamlessly integrates with popular testing frameworks like Mocha and Jest , enabling you to leverage their rich ecosystems and features. You can use Cypress alongside these frameworks to benefit from their advanced assertion libraries, test reporters, and other testing utilities. 2. Build Systems and CI/CD Tools: Cypress integrates smoothly with various build systems and continuous integration/continuous deployment (CI/CD) tools. Whether you use tools like Webpack, Gulp, or Jenkins, you can incorporate Cypress into your build and deployment pipelines effortlessly. This integration enables you to trigger test runs automatically, generate test reports, and incorporate Cypress into your overall release process. 3. Custom Plugins: Cypress provides a plugin architecture that allows you to extend its functionality and customize your testing experience. You can create custom plugins to add new commands, modify behavior, or integrate with external services. The Cypress community actively contributes plugins, which you can leverage to enhance your testing capabilities or integrate with specific tools or services. 4. TypeScript Support: Cypress has excellent support for TypeScript, a popular statically typed superset of JavaScript. You can write your Cypress tests using TypeScript, benefiting from features such as static type checking, autocompletion, and enhanced code navigation. TypeScript integration ensures robust and scalable test code. 5. Browser Compatibility: Cypress supports major web browsers like Chrome, Firefox, and Edge. This compatibility allows you to run your tests on different browsers and ensure cross-browser compatibility for your web applications. Cypress manages browser versions and dependencies, providing a seamless testing experience across different environments. 6. Custom Test Reporting: Cypress offers flexibility in generating test reports. You can integrate it with various test reporting frameworks or services, such as Mochawesome, Allure, or custom reporting tools. This integration enables you to generate detailed reports, visualize test results, and track test coverage easily. Running and Debugging Tests: Cypress provides a powerful test runner that allows you to run tests in a browser, view test results, and debug failures. It offers features like test retries, snapshots, and video recordings, which aid in identifying and troubleshooting issues quickly. With its built-in Developer Tools integration, developers can leverage browser debugging tools to inspect and debug their tests and application simultaneously. Conclusion: Cypress automation has revolutionized the way developers approach end-to-end testing. With its developer-friendly API, real-time feedback, and

img

Enabling reliable end-to-end testing for enterprise Web Apps using Playwright

Introduction: End-to-end testing is a process used to test an application’s behaviour on different platforms and browsers. End-to-end testing helps ensure that an application works as expected across all platforms, browsers, and devices. It can also be used to validate changes made during development so that they’re not lost during deployment. Introduction to end-to-end test automation End-to-end testing is the process of testing a Web App from start to finish. It involves running all the code, in order, and making sure that it works as expected across different browsers, platforms and devices. Cross browser testing ensures that your app works on all browsers without any errors or issues. This includes mobile devices like smartphones and tablets as well as desktop computers with different operating systems (OS). End-to-end tests require you to write code for every device and OS that your users will use when they access your site or app online. This can be difficult because it involves coding each test separately depending on which platform/device you want to test against; however with Playwright we’re able to automate these tasks so they are done automatically! Challenges with existing solutions The current testing solutions available to enterprises are not flexible enough to support the needs of today’s enterprise web apps. They’re too rigid and inflexible, making it difficult for teams to implement them in a way that works best for their particular project. These existing solutions aren’t easy to use or understand: they require multiple tools, which can be confusing and time-consuming. That makes them hard for nontechnical users like business analysts or product managers who need access immediately after launch—they’ll have no idea how much time has passed since then before getting started on something else! Existing solutions aren’t cost effective: if you’re paying $100-$200 per test run with no guarantee that it will pass all tests successfully every time (and there is), then why do something so inefficient? Plus there are other costs associated with implementation such as maintenance costs down the road when things go wrong due solely because of poor testing practices by developers instead of any technical issues along those lines.”  Playwright for enterprise web apps Playwright is a browser test automation framework that enables developers to write tests for web applications. Playwright supports cross browser testing and can run tests in multiple browsers and platforms. Playwright is built on top of Selenium Webdriver, which makes it easy to write automated tests for your app or other web application. Benefits of Playwright for enterprise Web Apps Playwright is an easy to use, cloud-based solution that allows you to test your enterprise web applications from a single product. You can use it for all types of testing: functional, performance and security testing. Playwright has the following features: Single platform – The Playwright platform is the only one you need to deploy on any environment (Dev/Test/Prod). This means that you don’t have to worry about different tools or platforms for each stage in your project lifecycle. All tests are executed in parallel so there are no bottlenecks caused by slow running tests as they run on separate instances of Amazon Web Services. Flexible license terms – Our licensing model allows companies with varying budgets and needs access to our premium features at different price points based on their level of investment into quality assurance efforts. Access via DevOps toolsets such as Chef or Ansible – Make sure all your developers have access without managing servers yourself! Is Playwright right for your enterprise Web App? Playwright is a solution for end-to-end testing of enterprise web applications. It supports all browsers and platforms, including Internet Explorer 9+, Firefox 5+, Chrome 29+, Safari 6+. Playwright is easy to get started with because it provides you with everything you need to write your first test in minutes: A fast and intuitive API for creating tests (no guesswork!) A toolset that makes it easy to run your tests on real devices or emulators A library of functionalities that can be used by developers without having any programming experience The evolution of web applications Web applications have evolved from simple static websites to complex, dynamic applications that are used by millions of people. The evolution of web applications has been led by the introduction of new technologies like AJAX and HTML5. The changes in these technologies have created an environment where it is now possible for developers to build rich user experiences using client-side frameworks like AngularJS or ReactJS. These frameworks allow you to write code once but run it on multiple browsers at once! Web applications today are much more powerful than ever before. Before you can start building your next web app, you need to understand how the end-to-end testing process works. Web applications today are much more complex than ever before. They’re also much more powerful and interactive than they were even a few years ago—and they’re getting even better at handling large amounts of data and responding quickly to user requests. This makes it difficult for developers and testers alike to determine whether their apps are working correctly across various devices and browsers (or even multiple versions). End-to-end testing is essential for these apps to ensure that they work as expected across all browsers on every platform. End-to-end testing ensures that the application works as expected across all browsers on every platform. Need for cross browser support for testing and development We need cross browser support for testing and development. Most developers use multiple browsers to test their applications, but end users also use different browsers depending on what device they’re using (e.g., desktop vs mobile). Also, some browsers are more popular than others in some regions or countries. There are many factors that can affect whether a browser has good support for features like HTML5 or CSS3: Popularity of the platform as measured by market share or usage on devices; The level of support from vendors like Microsoft, Apple and Google; Whether the vendor provides proprietary extensions for

image

Enabling 100% coverage for file upload and download using AutoIt in Selenium

Introduction: A web application has not limited itself to work always within the web. Sometimes there is a need for interaction of the web with the local system for uploading and downloading files. Automating this type of workflow is a bit complex with Selenium as the scope of Selenium is limited within the web.  Let’s learn how AutoIt helps in enabling 100% file upload and download in Selenium. Business case Our client has a background remover application, that uses AI to remove the background and reduce editing time which will help the users to add or remove the background of an image if they want to. Challenges for optimization of testing Every release requires testing, and manual testing was time-consuming. The team has recently implemented an agile process, where the functionality is changing frequently which is a challenge for optimizing the whole testing process. Our automation testing approach Automation helped the customer to verify/test different types of files within a short period. QA team developed a test plan by integrating Selenium with AutoIt Platform for uploading the image from the local system and validating its result. Automation helped the team complete tests faster, reducing overall testing efforts by 25%. Using our internal Selenium-based hybrid framework, we provided the results and records in well-documented formats. We implemented shift-left by integrating the testing environment with Jenkins. Testing Tools used Selenium: We used Selenium as it is an open-source automation testing tool to demonstrate web applications across different browsers and platforms. A wide range of programming languages like Java, Python, Ruby, c#, R-Data, PHP, Perl, etc are supported by Selenium. It supports a variety of operating systems—Windows, Mac, or Linux and browsers like Mozilla Firefox, Internet Explorer, Google Chrome, Safari, or Opera.  Selenium can be integrated with tools such as TestNG and JUnit for managing test cases and generating reports. It is integrated with Maven, Jenkins, and Docker to achieve continuous testing. Selenium focuses on automating web-based applications. Need for third-party tool in Selenium A web application is not limited to functioning entirely within the web. Sometimes, there is a need for the website to interact with the local system for the uploading and downloading of files. Automating this type of workflow can be complex with Selenium, as Selenium’s scope is limited to within the web browser itself. If you need to automate a workflow that will go from the browser to the desktop and from the desktop to Selenium, then the AutoIt tool may be a solution to your problem. What is AutoIt? AutoIt is an open-source scripting language that is designed for automating windows GUI and general scripting. It is a fusion of mouse movement, simulated keystrokes, and window control manipulation to automate a task that is not possible by the selenium Web driver. AutoIt is also very small, self-contained, and will run on all versions of Windows out-of-the-box with no annoying “runtimes” required! An AutoIt automation script can be converted into a compressed, stand-alone executable that can be run on computers even if they do not have the AutoIt interpreter installed. Language used Java: All are very familiar with the term “Java”. It is a high-level, class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible. Most developers use java for coding web applications. It has been a popular choice among IT Professionals for over two decades, with millions of Java applications in use today. It is owned by Oracle, and it is used by more than 3 billion devices. Java is a multi-platform and network-centric language that can be used as a platform in itself. It is a fast, secure, reliable programming language for coding everything from mobile apps and enterprise software to big data applications and server-side technologies. In the current job market, the demand for java is significant. Java applications are typically compiled to byte code that can run on any Java virtual machine (JVM) regardless of the underlying computer architecture. The syntax of Java is similar to C and C++ but has fewer low-level facilities than either of them. The Java runtime provides dynamic capabilities (such as reflection and runtime code modification) that are typically not available in traditional compiled languages. What is TestNG?  TestNG is an open-source test automation framework for Java. It is developed on the same lines as JUnit and NUnit. A few advanced and useful features provided by TestNG make it a more robust framework than its peers. The NG in TestNG stands for ‘Next Generation. Created by Cedric Beust, it is used more frequently by developers and testers in test case creation, owing to its ease of using multiple annotations, grouping, dependencies, prioritization, and parameterization features. Using TestNG, you can generate a proper report, and you can easily come to know how many test cases are passed, failed, and skipped. You can execute the failed test cases separately. Why use TestNG in Selenium? By default, Selenium tests do not generate a proper format for the test results. Using TestNG in Selenium, we can generate test results. Feature of TestNG Multiple Before and After annotation options XML-based test configuration Dependent methods Groups/groups of groups Data-driven testing Multithreaded execution Better reporting key benefits With Selenium-based hybrid framework and use of reusable methods, allowed the QA Team to reduce the automation effort by 25%. 40% reduction of the overall testing cost. CI and CD with test automation helped to identify errors and defects. Provides improved accuracy by around 96% Reduces the time by 50%.  Results In recent times, the web GUI has become so much more complex with the integration of several native third-party elements which makes it challenging for the test automation engineers to achieve 100% automation coverage. This problem statement needs a QA org to invest more by procuring additional third-party platforms that can ensure better automation coverage. Using an open-source platform like Selenium, the above automation approach (AutoIT integrated with Selenium) has helped our team to improve the overall project quality and reduce the cost and time as well. The result was a

Submit your article summary today!

[wpforms id="2606"]
Contact Form

Thank you for your interest in authoring an article for this forum. We are very excited about it!

Please provide a high level summary of your topic as in the form below. We will review and reach out to you shortly to take it from here. Once your article is accepted for the forum, we will be glad to offer you some amazing Amazon gift coupons.

You can also reach out to us at info@testautomationforum.com