Testing Web applications by modeling with FSMs

Abstract

Researchers and practitioners are still trying to find effective ways to model and test Web applications. This paper proposes a system-level testing technique that combines test generation based on finite state machines with constraints. We use a hierarchical approach to model potentially large Web applications. The approach builds hierarchies of Finite State Machines (FSMs) that model subsystems of the Web applications, and then generates test requirements as subsequences of states in the FSMs. These subsequences are then combined and refined to form complete executable tests. The constraints are used to select a reduced set of inputs with the goal of reducing the state space explosion otherwise inherent in using FSMs. The paper illustrates the technique with a running example of a Web-based course student information system and introduces a prototype implementation to support the technique.

AutoBlackTest: Automatic Black-Box Testing of Interactive Applications

“…Some of these techniques share with GUI testing the underlying idea of covering specific sequences of events, for instance semantically interacting events [23]. Other techniques produce test cases by relying on navigation models [24] or data captured from users sessions [25]. While these models and data are quite common for Web applications, they are less frequently available for GUI applications.…”

Penetration Testing with Improved Input Vector Identification

“…Most of the work in the area has been commercially oriented and focused on improving web crawling techniques, such as OWASP's WebScarab web crawler, 1 or on developing new vulnerability scanners, such as Nessus 4 and Nikto. 5 Notable research contributions in this area include the development of an advanced web crawler by Huang and colleagues [14], and a technique by Elbaum and colleagues [5] that interacts with a web application at runtime to identify IVs and possible domain information.…”

“…In this area, there has been a fair amount of work. Early techniques relied on developer-provided specifications [1,15,18], which does not fit well into the usage scenario of penetration testing, where oftentimes the vulnerabilities are found in IVs that are unknown or untested by the developers. Several techniques [6,7,16,19] use session data and user logs to identify relevant information about the monitored web applications.…”

“…In fact, many government agencies and trade groups, such as the Communications and Electronic Security Group in the U.K., OWASP, 1 and OSSTMM, 2 accredit penetration testers and sanction penetration testing "best practices." Penetration testing is a useful technique for several reasons: 1) it generally produces a low rate of false positives since it discovers vulnerabilities by exploiting them and thus producing counter examples; 2) it tests applications in context, which allows for the discovery of vulnerabilities that arise from specific configuration and environment issues; and 3) it provides a set of concrete inputs that exploit the discovered vulnerabilities and that can be used to guide developers in correcting the code.…”

Model-Based Testing of Thin-Client Web Applications and Navigation Input

“…Andrews et al [2] employ FSMs with constraints to model and test web applications. Hierarchical decomposition and constraints are used to control the usual state space explosion problem: with hierarchical decomposition the FSM can be decomposed recursively into subsystems.…”