• Verified that the link takes you to the page it said it would.
  • Ensure to have no orphan pages (a page that has no links, on buttons, tabs
  • etc to it)
  • Ensure that all referenced links or email addresses must be hyperlinked.
  • Check all mailto links and whether it reaches properly
  • Ensure that all the data’s inside combo/list box must be arranged in chronological order.
  • Check the maximum field lengths to ensure that there should not any truncated characters.
  • Assure that leap years are validated correctly & do not cause errors/miscalculations.
  • Include value zero in all calculations.
  • Assure that upper and lower values in ranges are handled correctly. (Using BVA)
  • Each field should get highlighted when the cursor is in that field.
  • Default values on page load/reload (Also terms and conditions should be disabled)
  • Ensure that division by zero does not occur.
  • Navigation should work correctly with the input methods offered by the device.
  • An application for a touch device should use touch interaction to navigate all functions/screens of the application, e.g. tapping buttons, navigating lists etc.
  • Ensure that all interactive elements such as buttons must respond to touch interaction on first use. It must not be difficult to touch an interactive element, such as a button, link, image, etc.
  • Checks weather all requirements and checkpoints are covered.
  • Give multiple inputs (Text inputs) at a time and the app should work according to that.
  • Check the app weather it syncs with native functionalities.
  • Whether checks for optional and mandatory fields carried out like a mandatory field should not be left blank and an optional should allow the user to skip the field.
  • Closing of the application should result in “Are you sure?” message.(Depends upon app)
  • Verify if the application continuous from the same place after minimizing and restarting it.
  • Ensure that home page of an app should be loaded quickly within 8 seconds.
  • If the device is tilted from portrait mode to landscape mode and vice versa, the app should self adjust as per the device resolution (condition: if the application supports both landscape and portrait modes).
  • If the device is tilted from portrait mode to landscape mode, the screen should display an error message asking the user to switch the device back to landscape mode or the screen resolution should not change (condition: if the application supports only portrait mode)
  • If the device is tilted from landscape mode to portrait mode, the screen should display an error message asking the user to switch the device back to portrait mode or the screen resolution should not change (condition: if the application supports only landscape mode)
  • Verify the functionality for the Background music [If any]
    • When music running in the background of the App/game
    • App goes into idle mode
    • When app comes from the idle mode

Expected behavior: Background music should be running.

  • When the Application uses network capabilities, it must be able to handle network delays and any loss of connection.
    Launch the Application.
    Start the network access from the Application.
    Put the phone in a place where there connection will be lost.
    Observe the result.
    Expected behavior: The Application will work until time out and then give an error message to the user indicating there was an error with the connection.
  • When the Application uses network capabilities, it must be able to handle the device being in Airplane mode.
    Set the device to Airplane mode
    Start the Application.
    Observe the result.
    Expected behavior: The Application will give a meaningful error message to indicate that the device is in Airplane mode and the application cannot run successfully.
  • Verify for the Network Reachebility.
    Expected behavior: Popup should be detect when the network is unavailable and provide a (pop-up) message informing the user.
  • Verify the Materials or Advertisements.
    Expected behavior: Marketing materials or advertisements should not be there at the app (app will be rejected)
Advertisements

Test Cases for Android Apps (Test Cases Regarding External Influence):

Senario no.1

Ensure that the Application works correctly following a memory card insertion action when the Application is suspended and resumed.

Steps to Scenario:

1. Launch the Application.

2. Suspend Application

3. Insert the memory card into the phone, and mount the card.

4. Fill the card to its capacity

5. Unmount the memory card.

6. Resume and operate the Application

Expected Result:

The Application continues to operate as designed based on the Application specification and is not affected by the memory card insertion or mounting/unmounting.

Scenario no.2

Ensure that the Application works correctly during a memory card insertion and removal.

Steps to Scenario:

1. Launch the Application.

2. Insert and remove the memory card.

3. Verify that Application works correctly.

Expected Result:

1. The Application should work correctly following memory card insertion.

2. The Application should work correctly with memory card removed.

Scenario no.3

Ensure that the Application with memory card functional screens works correctly with memory card inserted and removed.

Steps to Scenario:

1. Launch the Application.

2. Navigate to screen where Application works with memory card.

3. Insert the memory card.

4. Verify that Application works correctly.

5. Remove the memory card.

Expected Result:

1. The Application should work correctly following memory card insertion.

2. The Application should work correctly following memory card removal.

Test Cases for Android Apps (Test Cases Regarding Storage):

a) Storage/Cache (verification points)

Go to the Device>Settings> App>

Here, all the Downloaded apps will be listed. It will show the location of app whether its Downloaded on internal memory, SD Card or currently in Running status.

Test Cases for category a):

1. Verify how much memory space (internal/SD Card) occupied by app.

(Occupied space shown just below the App name.)

2. Click on the app> it will redirect to the ‘App Info’ page

(I) we can verify here whether the App name and App version is as per the requirement

(ii) Under ‘Storage’ section:

a) Verify the ‘Total’ space occupied by the App, it should be as per the requirement

b) Verify ‘App’ storage, it should be as per the requirement

c) USB storage app: verify whether it occupies the space as expected

d) Data: verify whether the app uses the defined limit of data while running

e) SD Card: If app is installed in SD Card, very that app occupy as per the expected space

f) Cache: verify that cache space should be as expected (notice the behavior of app if cache space exceeded)

b ) App Storage

Test Cases for category b)

1.On installing the app into device, it should occupy the expected space

2.On moving app to SD Card, it should release the internal memory

3.On uninstalling the app from the device, it should released all the occupied memory (saved files that contain games level, application setting etc should be released)

4.If cache exceeded from expected memory, check the behaviour of app

5.If app provide the upgrade option (like Skype, Facebook etc) then check whether app provide the details of the size which it suggest for upgrading (if device memory will be less and we start upgrading then check whether app prompt the message regarding less memory or app crashes out)

Some Important Questions on Scecurity Testing :

Questions-Answer:

1. What is Authorization?

a) Authorization means checking permission

b) Authorization means checking credential.

c) Authorization means checking proper navigation

d) Authorization means checking approval

Ans:  a

2. What is Authentication?

a) Authentication means checking permission

b) Authentication means checking credential.

c) Authentication means checking proper navigation

d) Authentication means checking approval

Ans:  b

3. Why we do security testing?

a) To maintain Quality

b) To check authorized activities

c) To make application secure and maintains functionality as intended

d) To remove vulnerabilities

Ans:  d

4. Which methods/techniques are used for security testing?

a) Functional and Risk based  security testing

b) XSS and SQL injection

c) Password cracking and URL Manipulation

d) Get and Post

Ans:  b

 5. What is “Vulnerability”?

a) Bugs in the application

b) Cause in the web application

c) Weakness in the web application

d) Change in the application

Ans:  c

 6. Security Tests are created on the basis of:

a) More faults

b) Approches

c) Methods

d) Roles

Ans:  d

7. Security Testing is a type of:

a) Review Testing

b) Recovery Testing

c) Performance Testing

d) Functionality Testing

Ans:  a

8. Static analysis is best described as:

a) The analysis of batch programs

b) The reviewing of test plans.

c) The analysis of program code.

d) The use of black box testing.

9. Which symbol is used to test SQL injection?

a) Hash

b) Double Quotes

c) Ampersand

d) Single Quote

10. What is the full form of XSS?

a) Cross-Site Scripting

b) Cross-Side Scripting

c) Xml-Site Scripting

d) Xml-Side Scripting

Ans: a

1. Where cookies are store?

a)  Web browser

b) Web server

c) Remote server

d) All of above

Ans: a)

2. Can two different browsers share same cookies?

a) Yes

b) No

Ans: b)

3. Use of too many cookies slow down the:

a) System

b) Server

c) Browse

Ans: c)

4. Can one domain access another’s domains cookies?

a) Yes

b) No

Ans: b)

5. Tester can test which cookies?

a) Session

b) Persistent

c) Third party

d) All of above

Ans: d)

6. How many cookies are supported by one domain?

a) 50

b) 300

c) 250

d) 70

Ans: a)

7. Cookie testing is a kind of:

a) Functional testing

b) Security testing

c) Load testing

d) a and b both

Ans: d)

8. Which one field never stored in the cookie even not in the encrypted form?

a) User id

b) Session id

C) credit card no

d) All of above

Ans: c)

9. Is cookies require server resources?

a) Yes

b) No

c) May be in some particular cases

Ans: b)

10. Which tools are used for cookie testing?

a) MAXA and Bosch Power

b) OWASP

c) Paros Dynamic

d) Web Scarab

Ans: a)

Cookie:
Cookie is small bit of information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve information from that machine. Generally cookie contains personalized user data or information that is used to communicate between different web pages.

Why Cookies are used?
Cookies are nothing but the user’s identity and used to track where the user navigated throughout the web site pages. The communication between web browser and web server is stateless.

For example if you are accessing domain http://www.example.com/1.html then web browser will simply query to example.com web server for the page 1.html. Next time if you type page as http://www.example.com/2.html then new request is send to example.com web server for sending 2.html page and web server don’t know anything about to whom the previous page 1.html served.

What if you want the previous history of this user communication with the web server? You need to maintain the user state and interaction between web browser and web server somewhere. This is where cookie comes into picture. Cookies serve the purpose of maintaining the user interactions with web server.

Cookie Detective Work

How can you tell if the Web system you are testing uses cookies? Simply read the website design documents, functional specs, etc. – if such documents are available. A more direct approach, especially useful in the likely absence of such documentation, is:

Find the folder on your PC where cookies are stored.

Delete all of the existing cookies. In Internet Explorer, the cache files are stored in the same folder as the cookies. Clearing the browser cache in IE can make finding the cookies easier, but isn’t strictly necessary.

Set your browser’s cookie options to “prompt me” In Internet Explorer, choose Tools | Internet Options, navigate to the Security tab, click Custom Level and select the “Prompt” radio button under “Allow cookies that are stored on your computer”. Also do the same under “Allow per –session cookies (not stored).”

Navigate through all of the major features and functions on the site to see where cookies are employed.

How do you know where cookies are used? Whenever the site attempts to record state information in a cookie on your PC, you will be prompted with a message. Internet Explorer’s prompt looks like this:

Every time this dialog appears, record the cookie details and what action(s) cause the cookie to be created or modified. Then, click Yes to accept the cookie. Personally, I find it easier to accept the cookie, open the cookie file and copy/paste the cookie details into a “cookie log” with my observations for later analysis. Save this data, including the cookie names and contents, creating a log of cookie activity correlated to your activities on the website. A word of warning: some sites are highly active with cookies, setting or modifying them on every page you visit. Creating the cookie log on these types of sites will be time consuming and drive you to a certain level of insanity. Getting as much info as possible in advance about cookie activity from the developers is usually your best bet.

How cookies work?
The HTTP protocol used to exchange information files on the web is used to maintain the cookies. There are two types of HTTP protocol. Stateless HTTP and Stateful HTTP protocol. Stateless HTTP protocol does not keep any record of previously accessed web page history. While State full HTTP protocol do keep some history of previous web browser and web server interactions and this protocol is used by cookies to maintain the user interactions.

Whenever user visits the site or page that is using cookie, small code inside that HTML page (Generally a call to some language script to write the cookie like cookies in JAVAScript, PHP, Perl) writes a text file on users machine called cookie.

Here is one example of the code that is used to write cookie and can be placed inside any HTML page:

Set-Cookie: NAME=VALUE; expires=DATE; path=PATH; domain=DOMAIN_NAME;

When user visits the same page or domain later time this cookie is read from disk and used to identify the second visit of the same user on that domain. Expiration time is set while writing the cookie. This time is decided by the application that is going to use the cookie.

Generally two types of cookies are written on user machine.

1) Session cookies: This cookie is active till the browser that invoked the cookie is open. When we close the browser this session cookie gets deleted. Some time session of say 20 minutes can be set to expire the cookie.
2) Persistent cookies: The cookies that are written permanently on user machine and lasts for months or years.

Where cookies are stored?
When any web page application writes cookie it get saved in a text file on user hard disk drive. The path where the cookies get stored depends on the browser. Different browsers store cookie in different paths. E.g. Internet explorer store cookies on path “C:\Documents and Settings\Default User\Cookies”
Here the “Default User” can be replaced by the current user you logged in as. Like “Administrator”, or user name like “Vijay” etc.
The cookie path can be easily found by navigating through the browser options. In Mozilla Firefox browser you can even see the cookies in browser options itself. Open the Mozila browser, click on Tools->Options->Privacy and then “Show cookies” button.

 

How cookies are stored?
Lets take example of cookie written by rediff.com on Mozilla Firefox browser:
On Mozilla Firefox browser when you open the page rediff.com or login to your rediffmail account, a cookie will get written on your Hard disk. To view this cookie simply click on “Show cookies” button mentioned on above path. Click on Rediff.com site under this cookie list. You can see different cookies written by rediff domain with different names.

Site: Rediff.com Cookie name: RMID
Name: RMID (Name of the cookie)
Content: 1d11c8ec44bf49e0… (Encrypted content)
Domain: .rediff.com

Path: / (Any path after the domain name)
Send For: Any type of connection
Expires: Thursday, December 31, 2020 11:59:59 PM

Since per-session cookies aren’t written to the hard drive, examining the cookie content can be done only through the actual Netscape prompt.

Cookies text file looks like this:

What’s Inside a Cookie?

.amazon.com is the domain this cookie is valid for.

TRUE is a flag indicating whether or not all machines in the domain can access the cookie.

/ is the path the cookie is valid for.

FALSE is a secure flag indicating whether or not a secure (encrypted) connection is needed to access the cookie.

994320128 is the UNIX expiration time of the cookie.

session-id is the name of the variable stored by this cookie.

102-7224116-8052958 is the value of this variable.

Applications where cookies can be used:

1) To implement shopping cart:
Cookies are used for maintaining online ordering system. Cookies remember what user wants to buy. What if user adds some products in their shopping cart and if due to some reason user don’t want to buy those products this time and closes the browser window? When next time same user visits the purchase page he can see all the products he added in shopping cart in his last visit.

2) Personalized sites:
When user visits certain pages they are asked which pages they don’t want to visit or display. User options are get stored in cookie and till the user is online, those pages are not shown to him.

3) User tracking:
To track number of unique visitors online at particular time.

4) Marketing:
Some companies use cookies to display advertisements on user machines. Cookies control these advertisements. When and which advertisement should be shown? What is the interest of the user? Which keywords he searches on the site? All these things can be maintained using cookies.

 5) User sessions:
Cookies can track user sessions to particular domain using user ID and password.

DisAdvantages of cookies:

1) Too many Cookies:
If you are writing too many cookies on every page navigation and if user has turned on option to warn before writing cookie, this could turn away user from your site.

2) Security issues:
Some times users personal information is stored in cookies and if someone hack the cookie then hacker can get access to your personal information. Even corrupted cookies can be read by different domains and lead to security issues.

3) Sensitive information:
Some sites may write and store your sensitive information in cookies, which should not be allowed due to privacy concerns.

How do I enable cookie support in my browser?

Cookies are enabled by default in most browsers, however if you think your browser has cookie support disabled then please follow these instructions:-

For Internet Explorer:
1. Left Click the ‘Tools’ menu.
2. Left Click ‘Internet Options’.
3. Left Click ‘Privacy’ tab.
4. Left Click the ‘Sites’ button.
5. Type http://www.weighin.net into the top box.
6. Left Click the ‘Allow’ button.
7. Left Click the ‘Ok’ button.
8. Left Click the ‘Ok’ button.

To enable cookies in Internet Explorer 7 or 8:

  1. Click Start > Control Panel. (With Windows XP Classic View, click the Windows Start button > Settings > Control Panel).
  2. Double-click the Internet Options icon.
  3. Select the Privacy tab.
  4. Click Advanced.
  5. Select “Override automatic cookie handling” under the “Cookies” section in the Advanced Privacy Settings window.
  6. Select the “Accept” or “Prompt” option under “First-party Cookies.”
  7. Select the “Accept” or “Prompt” option under “Third-party Cookies.” (If you select the “Prompt” option, you’ll be asked for approval every time a website attempts to send you a cookie.)
  8. In the Internet Options window, click OK to exit.

For Mozilla Firefox:

1. Left Click the ‘Tools’ menu.
2. Left Click ‘Options’.
3. Left Click ‘Privacy’ tab.
4. Left Click ‘Exceptions’ button.
5. Type http://www.weighin.net into the top box.
6. Left Click the ‘Allow’ button.
7. Left Click the ‘Close’ button.
8. Left Click the ‘Ok’ button.

To enable cookies in Chrome for Windows:

  1. Click the Tools menu.
  2. Select Options.
  3. Click the Under the Hood tab.
  4. Click Content settings in the “Privacy” section.
  5. Select Allow local data to be set to allow both first-party and third-party cookies. If you only want to accept first-party cookies, check the box next to “Block all third-party cookies without exception.”

Important Scenarios to test cookie testing for websites:

Test cases: 

1) As a Cookie privacy policy make sure from your design documents that no personal or sensitive data is stored in the cookie.

2) If you have no option than saving sensitive data in cookie make sure data stored in cookie is stored in encrypted format.

3) Make sure that there is no overuse of cookies on your site under test. Overuse of cookies will annoy users if browser is prompting for cookies more often and this could result in loss of site traffic and eventually loss of business.

4) Disable the cookies from your browser settings: If you are using cookies on your site, your sites major functionality will not work by disabling the cookies. Then try to access the web site under test. Navigate through the site. See if appropriate messages are displayed to user like “For smooth functioning of this site make sure that cookies are enabled on your browser”. There should not be any page crash due to disabling the cookies. (Please make sure that you close all browsers, delete all previously written cookies before performing this test)

5) Accepts/Reject some cookies: The best way to check web site functionality is, not to accept all cookies. If you are writing 10 cookies in your web application then randomly accept some cookies say accept 5 and reject 5 cookies. For executing this test case you can set browser options to prompt whenever cookie is being written to disk. On this prompt window you can either accept or reject cookie. Try to access major functionality of web site. See if pages are getting crashed or data is getting corrupted.

6) Delete cookie: Allow site to write the cookies and then close all browsers and manually delete all cookies for web site under test. Access the web pages and check the behavior of the pages.

7) Corrupt the cookies: Corrupting cookie is easy. You know where cookies are stored. Manually edit the cookie in notepad and change the parameters to some vague values. Like alter the cookie content, Name of the cookie or expiry date of the cookie and see the site functionality. In some cases corrupted cookies allow to read the data inside it for any other domain. This should not happen in case of your web site cookies. Note that the cookies written by one domain say rediff.com can’t be accessed by other domain say yahoo.com unless and until the cookies are corrupted and someone trying to hack the cookie data.

8 ) Checking the deletion of cookies from your web application page: Some times cookie written by domain say rediff.com may be deleted by same domain but by different page under that domain. This is the general case if you are testing some ‘action tracking’ web portal. Action tracking or purchase tracking pixel is placed on the action web page and when any action or purchase occurs by user the cookie written on disk get deleted to avoid multiple action logging from same cookie. Check if reaching to your action or purchase page deletes the cookie properly and no more invalid actions or purchase get logged from same user.

9) Cookie Testing on Multiple browsers: This is the important case to check if your web application page is writing the cookies properly on different browsers as intended and site works properly using these cookies. You can test your web application on Major used browsers like Internet explorer (Various versions), Mozilla Firefox, Netscape, Opera etc.

10) If your web application is using cookies to maintain the logging state of any user then log in to your web application using some username and password. In many cases you can see the logged in user ID parameter directly in browser address bar. Change this parameter to different value says if previous user ID is 100 then make it 101 and press enter. The proper access message should be displayed to user and user should not be able to see other users account.