Sh00t - defcon presentation
•
0 likes•285 views
Security Testing is not as simple as right click > Scan. It's messy, a tough game. What if you had missed to test just that one thing and had to regret later? Sh00t is a highly customizable, intelligent platform that understands the life of bug hunters and emphasizes on manual security testing.
Report
Share
Report
Share
Download to read offline
Recommended
Selenium done right
This document summarizes the improvements made to an organization's Selenium test automation over the past year. Some key points:
- Originally there were 1500 tests with a pass rate below 70% that took 3.5 hours to run. Now there are over 3000 tests with a pass rate above 99% that take less than 15 minutes to run.
- A focus on short, stable test flows and improved visualization of test results helped drive these gains. Architectural changes like implementing the WWHB (What, Where, How, Browser) design pattern also contributed significantly.
- Maintaining clean, well-architected code is important to ensure the reliability and sustainability of test automation. The document emphasizes treating automation tests as
Beer & Beta by Flockler - Feb 4th 2016
This document discusses how to move fast and fix things by removing fear through automated testing, easy access to browsers and devices from any location, and error notifications. It recommends using CircleCI to automatically run tests before deployment, BrowserStack for remote testing on actual devices from any location, and Opbeat for real-time error reporting with details to help fix issues. The overall message is that these tools can help developers deploy code quickly through continuous integration and testing, while also quickly catching and fixing bugs in production.
Insights on Protractor testing
Protractor is an end-to-end testing framework developed by Google for testing Angular applications. While powerful, it has some limitations including being slow to write tests for, not working well for complex user interactions, and only working optimally with Chrome. The document provides tips for writing more effective Protractor tests such as using explicit waits, avoiding direct abstraction to page objects, and handling asynchronous code carefully.
Fast end-to-end-tests
This document summarizes Lars Thorup's presentation on fast end-to-end tests. It discusses the drawbacks of traditional end-to-end tests like being slow, imprecise, complicated and fragile. Unit tests are faster but rely on mocked dependencies. The presentation demonstrates a way to automatically generate mocks to test applications from end-to-end very quickly while avoiding the downsides of mocks. The demo shows a Node.js app with front-end and back-end tested at almost 100 end-to-end tests per second.
Automated Performance Testing
If you are like most test driven developers, you write automated tests for your software to get fast feedback about potential problems. Most of the tests you write will verify the functional behaviour of the software: When we call this function or press this button, the expected result is that value or that message.
But what about the non-functional behaviour, such as performance: When we perform this query the expected speed of getting results should be no more than that many milliseconds. It is important to be able to write automated performance tests as well, because they can give us early feedback about potential performance problems. But expected performance is not as clear-cut as expected results. Expected results are either correct or wrong. Expected performance is more like a threshold: If the performance is worse than this, we want the test to fail.
Introduction to Automated Testing
Learn about the benefits of writing unit tests. You will spend less time fixing bugs and you will get a better design for your software. Some of the questions answered are:
Why should I, as a developer, write tests?
How can I improve the software design by writing tests?
How can I save time, by spending time writing tests?
When should I write unit tests and when should I write system tests?
Making Software Management tools work for you - 2011 PHPBenelux Conference
With the advent of such rich open source tools such as Subversion, Git, Trac, CruiseControl, and Review Board, managing software projects of any size has become much easier than ever. But how do you best use these tools in your organization? Picking the tool for you team is not a trivial task, and it requires insight into your team’s size, dynamic, and experience level; these tools are far from one-size-fits-all solutions. In this talk we’ll look at how these tools can fit into any software project and how to pick the right tool for your project, helping you make your team more efficient than before.
Automated Security Testing (2)
This document discusses automated security testing. It begins with an agenda that includes what security testing is, why testers need to worry about it, why automate it, how to automate it, a demo, and resources. Security testing reveals flaws in security mechanisms and is part of software testing. Automated security testing can detect vulnerabilities early, reduce costs by lessening the need for security professionals, and use existing automated functional tests with attack proxies and scans. The document demonstrates how attack proxies work and provides resources for security testing tools.
Recommended
Selenium done right
This document summarizes the improvements made to an organization's Selenium test automation over the past year. Some key points:
- Originally there were 1500 tests with a pass rate below 70% that took 3.5 hours to run. Now there are over 3000 tests with a pass rate above 99% that take less than 15 minutes to run.
- A focus on short, stable test flows and improved visualization of test results helped drive these gains. Architectural changes like implementing the WWHB (What, Where, How, Browser) design pattern also contributed significantly.
- Maintaining clean, well-architected code is important to ensure the reliability and sustainability of test automation. The document emphasizes treating automation tests as
Beer & Beta by Flockler - Feb 4th 2016
This document discusses how to move fast and fix things by removing fear through automated testing, easy access to browsers and devices from any location, and error notifications. It recommends using CircleCI to automatically run tests before deployment, BrowserStack for remote testing on actual devices from any location, and Opbeat for real-time error reporting with details to help fix issues. The overall message is that these tools can help developers deploy code quickly through continuous integration and testing, while also quickly catching and fixing bugs in production.
Insights on Protractor testing
Protractor is an end-to-end testing framework developed by Google for testing Angular applications. While powerful, it has some limitations including being slow to write tests for, not working well for complex user interactions, and only working optimally with Chrome. The document provides tips for writing more effective Protractor tests such as using explicit waits, avoiding direct abstraction to page objects, and handling asynchronous code carefully.
Fast end-to-end-tests
This document summarizes Lars Thorup's presentation on fast end-to-end tests. It discusses the drawbacks of traditional end-to-end tests like being slow, imprecise, complicated and fragile. Unit tests are faster but rely on mocked dependencies. The presentation demonstrates a way to automatically generate mocks to test applications from end-to-end very quickly while avoiding the downsides of mocks. The demo shows a Node.js app with front-end and back-end tested at almost 100 end-to-end tests per second.
Automated Performance Testing
If you are like most test driven developers, you write automated tests for your software to get fast feedback about potential problems. Most of the tests you write will verify the functional behaviour of the software: When we call this function or press this button, the expected result is that value or that message.
But what about the non-functional behaviour, such as performance: When we perform this query the expected speed of getting results should be no more than that many milliseconds. It is important to be able to write automated performance tests as well, because they can give us early feedback about potential performance problems. But expected performance is not as clear-cut as expected results. Expected results are either correct or wrong. Expected performance is more like a threshold: If the performance is worse than this, we want the test to fail.
Introduction to Automated Testing
Learn about the benefits of writing unit tests. You will spend less time fixing bugs and you will get a better design for your software. Some of the questions answered are:
Why should I, as a developer, write tests?
How can I improve the software design by writing tests?
How can I save time, by spending time writing tests?
When should I write unit tests and when should I write system tests?
Making Software Management tools work for you - 2011 PHPBenelux Conference
With the advent of such rich open source tools such as Subversion, Git, Trac, CruiseControl, and Review Board, managing software projects of any size has become much easier than ever. But how do you best use these tools in your organization? Picking the tool for you team is not a trivial task, and it requires insight into your team’s size, dynamic, and experience level; these tools are far from one-size-fits-all solutions. In this talk we’ll look at how these tools can fit into any software project and how to pick the right tool for your project, helping you make your team more efficient than before.
Automated Security Testing (2)
This document discusses automated security testing. It begins with an agenda that includes what security testing is, why testers need to worry about it, why automate it, how to automate it, a demo, and resources. Security testing reveals flaws in security mechanisms and is part of software testing. Automated security testing can detect vulnerabilities early, reduce costs by lessening the need for security professionals, and use existing automated functional tests with attack proxies and scans. The document demonstrates how attack proxies work and provides resources for security testing tools.
Extreme Programming - to the next-level
This document discusses taking extreme programming principles to the next level by turning traditional practices "up to 11". It explores several ideas for achieving faster feedback including mob programming, continuous deployment, hypothesis-driven user stories, shared product ownership, monitoring-driven development, and continuous learning. The author asks the reader to consider which ideas may work to implement in their organization this month.
Instant LAMP Stack with Vagrant and Puppet
Do you enjoy installing and configuring Apache, PHP, and MySQL every time you reinstall your OS or switch to a new machine? Neither do I. And we never have to do it again. Vagrant can use the VirtualBox API and configuration defined in Puppet to spin up a development VM in a couple of minutes. And it's really easy to do. I'll start with the simplest possible example and work up to a cluster of VM's. Feel free to bring your laptop and follow along.
Starting Test Automation In Your Project - Webinar by 99X Technology
This document provides guidance on starting test automation in a project. It discusses why automation is important, how to select scenarios to automate, how to choose a testing tool, how to create a proof of concept, how to implement an automation framework, and how to stabilize automated tests. Key steps include selecting high value scenarios, analyzing testing tools, creating sample automated tests with different tools, finalizing an automation framework, integrating tests with continuous integration, and ensuring tests are stable across environments.
Making cross browser tests beautiful
How many times have your Selenium test suites run beautifully on one browser, only to fail when run in any other browser? This is an extremely common problem faced when incorporating cross-browser tests into your test runs. Not all browser drivers are created equally, but that doesn’t mean you can’t create a robust suite of cross-browser tests.
This presentation shares strategies for making cross-browser tests invincible. It focuses on topics such as using as choosing the best locators for all browsers, explicit vs. implicit waits and how to leverage cloud-based testing tools.
This presentation was given at SeleniumConf London in November 2016.
WSO2Con Asia 2014 - Agile DevOps in the Cloud
This document discusses agile DevOps in the cloud. It covers topics like automation, monitoring and analytics, agile delivery, tools and utilities, scaling into the cloud, and DevOps practices at WSO2. Automation is discussed in the context of performing repetitive tasks, connecting process flows, and triggering actions. Monitoring and analytics are about discovering normal vs abnormal behavior, understanding data, gaining insights, and performing root cause analysis. Agile delivery focuses on discovering, testing and deploying in small increments to improve quality. Tools and utilities are discussed as a way to streamline processes from development to production while enforcing standards. Scaling into the cloud allows for automatic failure detection and self-healing systems. DevOps at WSO2
Engineers need to learn UXR
Learn about the basics of UXR, a use case around Usability testing, and Tells & Smells that things are going well or badly, and resources to learn more!
Unit testing for WordPress
This document appears to be a presentation about unit testing for WordPress. Some key points:
- The presenter has over a decade of PHP experience and 8 years experience with WordPress.
- Different types of testing are covered, including unit, integration, and functionality testing. PHPUnit is introduced as a tool for unit testing.
- Examples are provided for writing basic unit tests for PHP code using PHPUnit, including setting up tests, mocking WordPress functions, and testing exceptions.
- Tips are given for unit testing WordPress plugins and themes, such as using WordPress mocking libraries and focusing tests on application code rather than WordPress core functions.
Evil testers guide to technical testing
This document outlines Alan Richardson's webinar on technical testing. It discusses why technical testing is important given increasing technical complexity. It describes what technical testing entails, such as understanding databases and code. The document provides examples of technical testing concepts like boundary value analysis. It also discusses how to identify technical testing and what barriers may exist, emphasizing personal motivation. Finally, it suggests that with the right approach, anyone can learn technical testing and offers resources for further reading.
DaKiRY_BAQ2016_QADay_Яків Крамаренко "Автоматизація - це просто! (C#)"
This document discusses automation testing and provides tips for getting started with test automation. It recommends starting with end-to-end smoke tests using an easy language and tools. Specific suggestions include using C# with the nSelene library or Java with Selenide. The document emphasizes that automation is a tool to help testers do their work more efficiently, and that one can start automating even without manual testing experience if they have support and learn the basics.
Ukoug webinar - testing PLSQL APIs with utPLSQL v3
Slides from my webinar on testing PLSQL APIs with utPLSQL v3, presented at UKOUG Webinar on 24th Ocrober 2018
Intro to devops - Begin with End in Mind
Presented at Agile Day KL 2015 workshop organized in UTM. Part of this workshop was a hands-on session using Vagrant to provision a machine in AWS.
Unit testing
This document provides an overview of unit testing and guidelines for writing unit tests. It discusses why unit tests are important for catching errors, helping write code, speeding up development, and covering configurations and new team members' code. It defines what a unit test is and what they don't cover. Guidelines provided include automating tests, letting code just pass tests, testing boundaries and randomness, keeping tests at a unit level, and knowing passed tests don't guarantee correctness. It also mentions the XCTest framework and provides a tutorial project and instructions for writing sample unit tests for email and password validation.
Advanced Bootstrapping and Integrations - Chennai OutSystems User Group 27th ...
https://usergroups.outsystems.com/events/details/outsystems-inc-chennai-presents-advanced-bootstrapping-and-integrations
Automated testing in Drupal
This document discusses automated testing in Drupal using SimpleTest, a PHP testing framework. It provides an overview of what SimpleTest is, why automated testing is important, how to install SimpleTest, how tests are structured and run, and the various assertions and helper functions available. Automated testing helps ensure code works as intended, makes development and refactoring easier, and prevents regressions.
testmon for Python
testmon for Python concepts and IndieGoGo campaign. Slides for presentation on a local Ruby and Python meet-up.
Accomplishment report at QNAP
This document summarizes a QNAP intern's report on using the Robot Framework for automated regression testing. It discusses how the framework allows tests to be written once and run every time with each new build. Test cases are stored as text files for version control and can be executed from the command line. The intern demonstrated how automated regression testing found issues across multiple builds and shortened the regression cycle to improve software quality while relieving testers. In conclusion, experienced testers' knowledge was translated to Robot Framework scripts to continue benefiting future testing efforts.
Andy Glover - Testing is evolving, but where is the evidence - EuroSTAR 2012
The document discusses how software testing is evolving and the need for evidence in highly regulated environments. It notes that testers' mindsets need to change from just passing tests to documentation and validation. Both informal and formal testing processes are discussed, and it is suggested to manage informal testing through sessions and add more variety like automation and collaboration. The challenges of transitioning to agile methodologies are also presented. Overall, it argues for a balanced, evidence-based approach to testing through various techniques and an emphasis on continuous learning.
BSides 2015 Intro to Web App Pen Testing with Mutillidae
Mutillidae is an OWASP project that provides a web application designed for penetration testing. It focuses on the OWASP Top 10 vulnerabilities and testing methodologies. The application is quick to set up and allows users to learn testing techniques by starting with easy vulnerabilities and increasing difficulty levels. The document discusses recommended tools for testing like Burp Suite or ZAP, lists resources for learning techniques, and provides a link for a demo of exploiting XSS vulnerabilities on Mutillidae.
Drulenium - Testing Made Easy
Want to automate testing on your site? don't know coding? No Problem! Selenium to your rescue!!
Drupal + Selenium = Drulenium
In this session I will demonstrate how Selenium can be used to
- Build the site
- Generate test content
- Deploy Dev -> Stage -> Prod
- Automate Testing
Selenium IDE is an integrated development environment for Selenium scripts. It is implemented as a Firefox extension, and allows you to record, edit, and debug tests. Selenium IDE includes the entire Selenium Core, allowing you to easily and quickly record and play back tests in the actual environment that they will run."
Experience Level: Beginner
Demise of test scripts rise of test ideas
Tired of doing upfront test script creation in your testing efforts? Feeling bad for demotivating your testers? Want something to replace this sickening approach to software testing? This presentation outlines why test scripts are not useful, and how test ideas are the new way forward to better testing. Coverage, traceability, reporting, automation and skills are all covered. Take a quick look and see if you can see there is another way to do software testing that is actually pure common sense.
Services, tools & practices for a software house
An overview of simple tools, practises and services any software house or development team should consider - add to its work cycle.
Ui Testing with Ghost Inspector
Jay Luker will be presenting an introduction to Ghost Inspector, a cloud-based web UI testing service that takes some (some!) of the pain away from creating browser-based, web application tests. Think Selenium, but for projects that are short on the resources, infrastructure and/or coding expertise to confidently develop and manage a suite of fully automated, “good-enough” UI tests.
Jay is a Senior Software Engineer at Harvard DCE where he works on back-end applications and software for analytics data collection, deployment automation, and integration testing for the Extension School’s video processing and delivery system. Previously he has been an IT Specialist at the Smithsonian Astrophysics Data System, and a Software Developer at Ex Libris.
More Related Content
What's hot
Extreme Programming - to the next-level
This document discusses taking extreme programming principles to the next level by turning traditional practices "up to 11". It explores several ideas for achieving faster feedback including mob programming, continuous deployment, hypothesis-driven user stories, shared product ownership, monitoring-driven development, and continuous learning. The author asks the reader to consider which ideas may work to implement in their organization this month.
Instant LAMP Stack with Vagrant and Puppet
Do you enjoy installing and configuring Apache, PHP, and MySQL every time you reinstall your OS or switch to a new machine? Neither do I. And we never have to do it again. Vagrant can use the VirtualBox API and configuration defined in Puppet to spin up a development VM in a couple of minutes. And it's really easy to do. I'll start with the simplest possible example and work up to a cluster of VM's. Feel free to bring your laptop and follow along.
Starting Test Automation In Your Project - Webinar by 99X Technology
This document provides guidance on starting test automation in a project. It discusses why automation is important, how to select scenarios to automate, how to choose a testing tool, how to create a proof of concept, how to implement an automation framework, and how to stabilize automated tests. Key steps include selecting high value scenarios, analyzing testing tools, creating sample automated tests with different tools, finalizing an automation framework, integrating tests with continuous integration, and ensuring tests are stable across environments.
Making cross browser tests beautiful
How many times have your Selenium test suites run beautifully on one browser, only to fail when run in any other browser? This is an extremely common problem faced when incorporating cross-browser tests into your test runs. Not all browser drivers are created equally, but that doesn’t mean you can’t create a robust suite of cross-browser tests.
This presentation shares strategies for making cross-browser tests invincible. It focuses on topics such as using as choosing the best locators for all browsers, explicit vs. implicit waits and how to leverage cloud-based testing tools.
This presentation was given at SeleniumConf London in November 2016.
WSO2Con Asia 2014 - Agile DevOps in the Cloud
This document discusses agile DevOps in the cloud. It covers topics like automation, monitoring and analytics, agile delivery, tools and utilities, scaling into the cloud, and DevOps practices at WSO2. Automation is discussed in the context of performing repetitive tasks, connecting process flows, and triggering actions. Monitoring and analytics are about discovering normal vs abnormal behavior, understanding data, gaining insights, and performing root cause analysis. Agile delivery focuses on discovering, testing and deploying in small increments to improve quality. Tools and utilities are discussed as a way to streamline processes from development to production while enforcing standards. Scaling into the cloud allows for automatic failure detection and self-healing systems. DevOps at WSO2
Engineers need to learn UXR
Learn about the basics of UXR, a use case around Usability testing, and Tells & Smells that things are going well or badly, and resources to learn more!
Unit testing for WordPress
This document appears to be a presentation about unit testing for WordPress. Some key points:
- The presenter has over a decade of PHP experience and 8 years experience with WordPress.
- Different types of testing are covered, including unit, integration, and functionality testing. PHPUnit is introduced as a tool for unit testing.
- Examples are provided for writing basic unit tests for PHP code using PHPUnit, including setting up tests, mocking WordPress functions, and testing exceptions.
- Tips are given for unit testing WordPress plugins and themes, such as using WordPress mocking libraries and focusing tests on application code rather than WordPress core functions.
Evil testers guide to technical testing
This document outlines Alan Richardson's webinar on technical testing. It discusses why technical testing is important given increasing technical complexity. It describes what technical testing entails, such as understanding databases and code. The document provides examples of technical testing concepts like boundary value analysis. It also discusses how to identify technical testing and what barriers may exist, emphasizing personal motivation. Finally, it suggests that with the right approach, anyone can learn technical testing and offers resources for further reading.
DaKiRY_BAQ2016_QADay_Яків Крамаренко "Автоматизація - це просто! (C#)"
This document discusses automation testing and provides tips for getting started with test automation. It recommends starting with end-to-end smoke tests using an easy language and tools. Specific suggestions include using C# with the nSelene library or Java with Selenide. The document emphasizes that automation is a tool to help testers do their work more efficiently, and that one can start automating even without manual testing experience if they have support and learn the basics.
Ukoug webinar - testing PLSQL APIs with utPLSQL v3
Slides from my webinar on testing PLSQL APIs with utPLSQL v3, presented at UKOUG Webinar on 24th Ocrober 2018
Intro to devops - Begin with End in Mind
Presented at Agile Day KL 2015 workshop organized in UTM. Part of this workshop was a hands-on session using Vagrant to provision a machine in AWS.
Unit testing
This document provides an overview of unit testing and guidelines for writing unit tests. It discusses why unit tests are important for catching errors, helping write code, speeding up development, and covering configurations and new team members' code. It defines what a unit test is and what they don't cover. Guidelines provided include automating tests, letting code just pass tests, testing boundaries and randomness, keeping tests at a unit level, and knowing passed tests don't guarantee correctness. It also mentions the XCTest framework and provides a tutorial project and instructions for writing sample unit tests for email and password validation.
Advanced Bootstrapping and Integrations - Chennai OutSystems User Group 27th ...
https://usergroups.outsystems.com/events/details/outsystems-inc-chennai-presents-advanced-bootstrapping-and-integrations
Automated testing in Drupal
This document discusses automated testing in Drupal using SimpleTest, a PHP testing framework. It provides an overview of what SimpleTest is, why automated testing is important, how to install SimpleTest, how tests are structured and run, and the various assertions and helper functions available. Automated testing helps ensure code works as intended, makes development and refactoring easier, and prevents regressions.
testmon for Python
testmon for Python concepts and IndieGoGo campaign. Slides for presentation on a local Ruby and Python meet-up.
Accomplishment report at QNAP
This document summarizes a QNAP intern's report on using the Robot Framework for automated regression testing. It discusses how the framework allows tests to be written once and run every time with each new build. Test cases are stored as text files for version control and can be executed from the command line. The intern demonstrated how automated regression testing found issues across multiple builds and shortened the regression cycle to improve software quality while relieving testers. In conclusion, experienced testers' knowledge was translated to Robot Framework scripts to continue benefiting future testing efforts.
Andy Glover - Testing is evolving, but where is the evidence - EuroSTAR 2012
The document discusses how software testing is evolving and the need for evidence in highly regulated environments. It notes that testers' mindsets need to change from just passing tests to documentation and validation. Both informal and formal testing processes are discussed, and it is suggested to manage informal testing through sessions and add more variety like automation and collaboration. The challenges of transitioning to agile methodologies are also presented. Overall, it argues for a balanced, evidence-based approach to testing through various techniques and an emphasis on continuous learning.
BSides 2015 Intro to Web App Pen Testing with Mutillidae
Mutillidae is an OWASP project that provides a web application designed for penetration testing. It focuses on the OWASP Top 10 vulnerabilities and testing methodologies. The application is quick to set up and allows users to learn testing techniques by starting with easy vulnerabilities and increasing difficulty levels. The document discusses recommended tools for testing like Burp Suite or ZAP, lists resources for learning techniques, and provides a link for a demo of exploiting XSS vulnerabilities on Mutillidae.
Drulenium - Testing Made Easy
Want to automate testing on your site? don't know coding? No Problem! Selenium to your rescue!!
Drupal + Selenium = Drulenium
In this session I will demonstrate how Selenium can be used to
- Build the site
- Generate test content
- Deploy Dev -> Stage -> Prod
- Automate Testing
Selenium IDE is an integrated development environment for Selenium scripts. It is implemented as a Firefox extension, and allows you to record, edit, and debug tests. Selenium IDE includes the entire Selenium Core, allowing you to easily and quickly record and play back tests in the actual environment that they will run."
Experience Level: Beginner
What's hot (19)
Starting Test Automation In Your Project - Webinar by 99X Technology
Starting Test Automation In Your Project - Webinar by 99X Technology
DaKiRY_BAQ2016_QADay_Яків Крамаренко "Автоматизація - це просто! (C#)"
DaKiRY_BAQ2016_QADay_Яків Крамаренко "Автоматизація - це просто! (C#)"
Ukoug webinar - testing PLSQL APIs with utPLSQL v3
Ukoug webinar - testing PLSQL APIs with utPLSQL v3
Advanced Bootstrapping and Integrations - Chennai OutSystems User Group 27th ...
Advanced Bootstrapping and Integrations - Chennai OutSystems User Group 27th ...
Andy Glover - Testing is evolving, but where is the evidence - EuroSTAR 2012
Andy Glover - Testing is evolving, but where is the evidence - EuroSTAR 2012
BSides 2015 Intro to Web App Pen Testing with Mutillidae
BSides 2015 Intro to Web App Pen Testing with Mutillidae
Similar to Sh00t - defcon presentation
Demise of test scripts rise of test ideas
Tired of doing upfront test script creation in your testing efforts? Feeling bad for demotivating your testers? Want something to replace this sickening approach to software testing? This presentation outlines why test scripts are not useful, and how test ideas are the new way forward to better testing. Coverage, traceability, reporting, automation and skills are all covered. Take a quick look and see if you can see there is another way to do software testing that is actually pure common sense.
Services, tools & practices for a software house
An overview of simple tools, practises and services any software house or development team should consider - add to its work cycle.
Ui Testing with Ghost Inspector
Jay Luker will be presenting an introduction to Ghost Inspector, a cloud-based web UI testing service that takes some (some!) of the pain away from creating browser-based, web application tests. Think Selenium, but for projects that are short on the resources, infrastructure and/or coding expertise to confidently develop and manage a suite of fully automated, “good-enough” UI tests.
Jay is a Senior Software Engineer at Harvard DCE where he works on back-end applications and software for analytics data collection, deployment automation, and integration testing for the Extension School’s video processing and delivery system. Previously he has been an IT Specialist at the Smithsonian Astrophysics Data System, and a Software Developer at Ex Libris.
Lessons Learned When Automating
I attended the Tabara de Testare testing group on 3rd February 2015 to present "Lessons Learned When Automating. A live stream from UK to Romania.
http://compendiumdev.co.uk/page/tabaradetestare201602
I've been asked some very challenging questions about lessons learned, and how decisions are made during the process of automating and performing technical testing. In this webinar I'm going to answer them based on my experience. We'll discus how we know 'what to automate' which means we have to split our analysis into 'detection' and 'testing'. We'll cover lessons learned from solving problems, and making mistakes, and steps we can take during the problem solving process e.g. for intermittent failures, and possible tool bugs. We'll discuss abstraction levels and the different levels of the technology stack to automate: how to do it, and how we make the decisions. We'll discuss coding primarily the differences, and the overlap, between the needs for coding for testing and coding for production deployment. We'll also cover some WebDriver specific answers to some of these questions. I'm also going to describe books and techniques that have helped me over the years when trying to deal with these questions on production projects.
Sh00t - nullhyd version
1. The document introduces a security testing tool called SH00T that was created to help address issues the author saw in their work such as disorganized notes across multiple apps and missing test cases.
2. SH00T is designed to logically separate different security projects and types of tests, populate dynamic test cases to prevent missing tests, and use customizable bug templates and flags for automated and manual tests.
3. The author provides a demo of SH00T and details how to install, use, and get support for the tool via its GitHub page.
Put "fast" back in "fast feedback"
One of the cornerstones in Agile development is fast feedback. For engineering, "fast" means "instantly" or "in 5 minutes", not "tomorrow" or "this week". Your engineering practices should ensure that you can answer yes to most of the following questions:
- Do we get all test results in less than 5 minutes after a commit?
- Is our code coverage more than 75% for both front-end and back-end?
- Can we start exploratory testing in less than 15 minutes after a commit?
- Do all our tests pass more than 90% of our commits?
This talk will give you practical advice on how to get to "yes, we get fast feedback".
Agile testing (n)
The document discusses agile testing principles and practices. Some key points:
1. Agile testing follows a whole-team approach where quality is a shared responsibility, with testers providing continuous feedback.
2. Testers adopt a flexible mindset focused on delivering value to customers through practices like test-driven development, automated regression testing, and exploratory testing.
3. Success requires building a foundation of core practices like continuous integration, managing technical debt, and developing incrementally in small stories to maintain quality.
Usable Software Design
How to improve software design by using UX mindset, techniques and practices, given that the user of software design is the developer.
Test automation - Building effective solutions
This presentation is answering the questions: how to build an effective test automation framework, select the right tools and organize to whole process?
1x10 - QA Engineer Role in JIRA
This document discusses the role of a QA Engineer in an agile team working on the JIRA project. It describes how the QA Engineer works closely with developers throughout the development process, providing guidance on testing and quality assurance. Key responsibilities of the QA Engineer include risk identification, automation testing, code reviews, and demoing new features to gain confidence before being marked as complete. The document advocates for an approach where developers take responsibility for testing their own code, with QA Engineers acting as assistants to help educate on quality best practices rather than doing all the testing themselves.
Owasp tds
Test-driven security involves writing security-focused test cases to test for vulnerabilities during the development process. This helps enable continuous deployment by ensuring new code does not introduce security bugs. The key aspects discussed are:
1) Having developers or security experts write test cases to validate common vulnerabilities like authentication failures, input validation, and authorization checks.
2) Involving non-technical team members like project managers in writing test cases using plain language to specify scenarios.
3) Integrating security testing into continuous integration pipelines to automatically catch issues during code reviews.
Best practices for JavaScript RIAs
This document discusses best practices for building JavaScript rich internet applications (RIAs). It covers topics like testing techniques, design patterns, testing tools, and approaches like test-driven development. Some of the key recommendations include writing code for humans rather than machines, keeping servers simple as an event bus between clients, and focusing on concepts rather than specific tools. Test-driven development is emphasized as important for code quality and maintainability.
Web Application Security: Introduction to common classes of security flaws an...
Web Application Security
Introduction to common classes of security flaws and testing methodologies
Cade Cairns
Feb 2014
Tw noche geek quito webappsec
The document discusses common web application security vulnerabilities and tools for testing them. It begins with an introduction to common classes of security flaws like injection, cross-site scripting, and broken authentication. The document then outlines a testing methodology including information gathering, analysis, automated scanning, and testing authentication, access controls, and input validation. It demonstrates several tools like Burp Suite, ZAP, sqlmap, and shows examples of vulnerabilities like SQL injection and cross-site scripting. The goal is to help developers and testers harden web applications against attacks.
Software Testing Basic Concepts
The document discusses testing concepts such as code with tests vs without tests, test-oriented development, and different types of testing including unit testing, integration testing, and acceptance testing. It provides examples of test-driven development (TDD) and behavior-driven development (BDD) processes. The document also discusses tips for testing, including only testing what is necessary and identifying the appropriate types of testing for an application. Frameworks and tools for test automation and continuous integration are also mentioned.
Functional Prototyping For Mobile Apps
This document discusses functional prototyping for mobile apps. It begins by defining various types of prototypes like paper drawings, wireframes, and mockups. It then outlines several popular prototyping tools like POP, Balsamiq, Flinto, and Marvel. The document emphasizes that prototyping can save significant money on app development projects by clarifying requirements and creating a unified vision. It also argues for cross-functional teams that include disciplines like security, testing, and operations from the beginning rather than as an afterthought. Finally, it provides some resources for prototyping with Sketch and Framer.
High Performance Software Engineering Teams
Based on my experiences building high performance engineering teams, this presentation focuses on the technical practices required. These practices centers around automation (build, test and deployment) and increased collaboration between Engineering and QA (TDD, exploratory testing, prioritization, feedback cycles).
1×10 rola QA w tworzeniu Atlassian JIRA
This document discusses the role of a QA Engineer in JIRA. It notes that the QA Engineer works with a team of 15 people including developers, product managers, UX designers, and other QAs. It emphasizes that with Agile development, testing is now a shared responsibility of developers rather than being isolated to testers. Developers are expected to write and execute both manual and automated tests as part of development. The document outlines the development and release process at JIRA, with major releases every 2-3 months and bugfix releases every 2 weeks for the on-demand product. It stresses testing early and often through the development cycle rather than relying on testing at the end. Automated regression tests run on every code change to prevent
20150128 angular js_headless_testing
This document discusses automated testing for AngularJS applications. It introduces unit testing and end-to-end testing and the tools needed for testing AngularJS apps, including Jasmine, Protractor, and Selenium. Protractor examples are provided to demonstrate how to write end-to-end tests. The document also covers running tests in a headless setup to save resources and discusses some limitations of testing, such as not being able to control operating system windows and events. It concludes by providing contact information for the author and a note about job opportunities.
Quality Assurance: An Overview
The document discusses quality assurance (QA), which aims to prevent defects by ensuring systems meet requirements, work as expected, and satisfy stakeholders. It defines verification as confirming correct development and validation as building the right product. Key QA activities include technical reviews of work products and software testing approaches like unit, integration, and regression testing. The goals of QA are to verify that software meets its design specifications and works as intended.
Similar to Sh00t - defcon presentation (20)
Web Application Security: Introduction to common classes of security flaws an...
Web Application Security: Introduction to common classes of security flaws an...
Recently uploaded
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Maruthi Prithivirajan, Head of ASEAN & IN Solution Architecture, Neo4j
Get an inside look at the latest Neo4j innovations that enable relationship-driven intelligence at scale. Learn more about the newest cloud integrations and product enhancements that make Neo4j an essential choice for developers building apps with interconnected data and generative AI.
Building RAG with self-deployed Milvus vector database and Snowpark Container...
This talk will give hands-on advice on building RAG applications with an open-source Milvus database deployed as a docker container. We will also introduce the integration of Milvus with Snowpark Container Services.
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
Leonard Jayamohan, Partner & Generative AI Lead, Deloitte
This keynote will reveal how Deloitte leverages Neo4j’s graph power for groundbreaking digital twin solutions, achieving a staggering 100x performance boost. Discover the essential role knowledge graphs play in successful generative AI implementations. Plus, get an exclusive look at an innovative Neo4j + Generative AI solution Deloitte is developing in-house.
National Security Agency - NSA mobile device best practices
Threats to mobile devices are more prevalent and increasing in scope and complexity. Users of mobile devices desire to take full advantage of the features
available on those devices, but many of the features provide convenience and capability but sacrifice security. This best practices guide outlines steps the users can take to better protect personal devices and information.
A tale of scale & speed: How the US Navy is enabling software delivery from l...
Rapid and secure feature delivery is a goal across every application team and every branch of the DoD. The Navy’s DevSecOps platform, Party Barge, has achieved:
- Reduction in onboarding time from 5 weeks to 1 day
- Improved developer experience and productivity through actionable findings and reduction of false positives
- Maintenance of superior security standards and inherent policy enforcement with Authorization to Operate (ATO)
Development teams can ship efficiently and ensure applications are cyber ready for Navy Authorizing Officials (AOs). In this webinar, Sigma Defense and Anchore will give attendees a look behind the scenes and demo secure pipeline automation and security artifacts that speed up application ATO and time to production.
We will cover:
- How to remove silos in DevSecOps
- How to build efficient development pipeline roles and component templates
- How to deliver security artifacts that matter for ATO’s (SBOMs, vulnerability reports, and policy evidence)
- How to streamline operations with automated policy checks on container images
Full-RAG: A modern architecture for hyper-personalization
Mike Del Balso, CEO & Co-Founder at Tecton, presents "Full RAG," a novel approach to AI recommendation systems, aiming to push beyond the limitations of traditional models through a deep integration of contextual insights and real-time data, leveraging the Retrieval-Augmented Generation architecture. This talk will outline Full RAG's potential to significantly enhance personalization, address engineering challenges such as data management and model training, and introduce data enrichment with reranking as a key solution. Attendees will gain crucial insights into the importance of hyperpersonalization in AI, the capabilities of Full RAG for advanced personalization, and strategies for managing complex data integrations for deploying cutting-edge AI solutions.
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Discover how MongoDB Atlas and vector search technology can revolutionize your application's search capabilities. This comprehensive presentation covers:
* What is Vector Search?
* Importance and benefits of vector search
* Practical use cases across various industries
* Step-by-step implementation guide
* Live demos with code snippets
* Enhancing LLM capabilities with vector search
* Best practices and optimization strategies
Perfect for developers, AI enthusiasts, and tech leaders. Learn how to leverage MongoDB Atlas to deliver highly relevant, context-aware search results, transforming your data retrieval process. Stay ahead in tech innovation and maximize the potential of your applications.
#MongoDB #VectorSearch #AI #SemanticSearch #TechInnovation #DataScience #LLM #MachineLearning #SearchTechnology
20 Comprehensive Checklist of Designing and Developing a Website
Dive into the world of Website Designing and Developing with Pixlogix! Looking to create a stunning online presence? Look no further! Our comprehensive checklist covers everything you need to know to craft a website that stands out. From user-friendly design to seamless functionality, we've got you covered. Don't miss out on this invaluable resource! Check out our checklist now at Pixlogix and start your journey towards a captivating online presence today.
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
How to Get CNIC Information System with Paksim Ga.pptx
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
Mind map of terminologies used in context of Generative AI
Mind map of common terms used in context of Generative AI.
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...Edge AI and Vision Alliance
For the full video of this presentation, please visit: https://www.edge-ai-vision.com/2024/06/building-and-scaling-ai-applications-with-the-nx-ai-manager-a-presentation-from-network-optix/
Robin van Emden, Senior Director of Data Science at Network Optix, presents the “Building and Scaling AI Applications with the Nx AI Manager,” tutorial at the May 2024 Embedded Vision Summit.
In this presentation, van Emden covers the basics of scaling edge AI solutions using the Nx tool kit. He emphasizes the process of developing AI models and deploying them globally. He also showcases the conversion of AI models and the creation of effective edge AI pipelines, with a focus on pre-processing, model conversion, selecting the appropriate inference engine for the target hardware and post-processing.
van Emden shows how Nx can simplify the developer’s life and facilitate a rapid transition from concept to production-ready applications.He provides valuable insights into developing scalable and efficient edge AI solutions, with a strong focus on practical implementation.Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Join us to introduce Milvus Lite, a vector database that can run on notebooks and laptops, share the same API with Milvus, and integrate with every popular GenAI framework. This webinar is perfect for developers seeking easy-to-use, well-integrated vector databases for their GenAI apps.
Pushing the limits of ePRTC: 100ns holdover for 100 days
At WSTS 2024, Alon Stern explored the topic of parametric holdover and explained how recent research findings can be implemented in real-world PNT networks to achieve 100 nanoseconds of accuracy for up to 100 days.
Recently uploaded (20)
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Building RAG with self-deployed Milvus vector database and Snowpark Container...
Building RAG with self-deployed Milvus vector database and Snowpark Container...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
20 Comprehensive Checklist of Designing and Developing a Website
20 Comprehensive Checklist of Designing and Developing a Website
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
“Building and Scaling AI Applications with the Nx AI Manager,” a Presentation...
Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Introducing Milvus Lite: Easy-to-Install, Easy-to-Use vector database for you...
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Sh00t - defcon presentation
- 1. A testing environment for Security Testers Demo Labs Defcon 26 pavanw3b
- 2. $ whoami ● Pavan aka pavanw3b ● Developer turned Hacker ● Security Engineer at ServiceNow by job ● Bug hunter by passion ● Null Hyderabad core member
- 3. Security Testing It’s not as simple as Right Click > Scan. Is it?
- 4. I was doing & observed others ● Use of paper, Notepad++, Excel, Evernote - not meant for security ● Tens, hundreds of tabs/windows
- 5. Still... ● Miss something to test and regret later ● Work assessments, bug bounty, personal testing - all mixed and messed up :(
- 6. Welcome to Sh00t ● Task Manager for Security Testing ● Logically separate different projects, needs & types ● Never miss to test a single thing! Dynamic test cases population. ● Use like-paper ● Custom bug templating ● Fully customizable
- 7. Demo time!
- 8. Upcoming features ● Integration with bug management systems: JIRA, ServiceNow etc ● Multi-user - teams support ● Back up & restore
- 9. Installation, Usage & Support https://github.com/pavanw3b/sh00t
- 10. Liked it? Looking for ● Contributors & Mentors ● Feedback, Feature Suggestions & Bugs