Navegação

    • Cadastrar
    • Login
    • Pesquisar
    • Popular
    • Pesquisar
    1. Home
    2. Tester News Bot

    Tester News Bot (@Tester News Bot)

    94
    Reputação
    532
    Posts
    2326
    Visualizações de perfil
    6
    Seguidores
    0
    Seguindo
    • Perfil
    • Seguindo
    • Seguidores
    • Tópicos
    • Posts
    • Melhor
    • Grupos

    Information about Tester News Bot

    Moderador
    Cadastrou
    Última vez Online

    Posts feitos por Tester News Bot

    • JavaScript Tutorial Creating a CounterString tool in Chrome Browser Dev Tools Snippets

      I often talk about automating tactially and strategically. When we automate tactically we do what it takes to get the job done for us. When we automate strategically we build for the long term.

      The same is true for programming tools. We can start small and tactical and scale strategically. In this example I create a Counterstring tool.

      Counterstrings

      I have written about Counterstrings before:

      • Counterstring algorithms
      • and I implemented it in my Test Tools Hub

      And you can find James Bach’s original writing and work on Counterstrings at satisfice.com

      Since I don’t have a tool for creating Counterstrings in the Web I set out to create one.

      I thought this would be a good simple tutorial for JavaScript, tactical tooling and eventually strategic tooling (by converting it into a Chrome extension).

      A Counterstring is a string like this *3*5*7*9*12*15* where the * represent the position in the string of the number immediately proceeding it.

      How to write it?

      Chrome has “Snippets”

      • right click, inspect
      • in Sources select the “Snippets” tab
      • create a + New Snippet

      This is a built in JavaScript Editor within your browser.

      To see it work type into the snippet:

      console.log("hello");
      

      Click the play icon, and your script should run and you’ll see "hello" written to the console.

      To create a Counterstring tool start by creating a function:

      function getCounterString(count){
          console.log("hello");
      }
      

      If you run this, nothing will happen.

      But after running it, if you type into the console getCounterString(5) you should see "hello" written to the console.

      We will make it output a counterstring.

      Counterstring generation function

      function getCounterString(count){
          
          var counterString = "";
      
          while(count>0){
      
              var appendThis = "*" + count.toString().split("").reverse().join("");
              
              if(appendThis.length>count){
                  appendThis = appendThis.substring(0,count);
              }    
      
              counterString = counterString + appendThis;
      
              count = count - appendThis.length;
          }
      
          return counterString.split("").reverse().join("");
      }
      

      If you run this, nothing will happen.

      But after running it, if you type into the console getCounterString(5) you should see "*3*5*" written to the console.

      How does it work?

      Declare a function called getCounterString which takes one parameter called count. That is how we are able to specify the length of the counterstring we want when we call the function getCounterString(5)

      function getCounterString(count){
      

      Create a String variable which we will build the counterString in:

          var counterString = "";
      

      We need to loop around all the values in the counterstring e.g. 5, 3, and 1. So I will decrease the count as we process the values and I’ll use a while loop to do this e.g. while count is greater than 0, keep building the counterstring.

          while(count>0){
      

      Each time I process a count value I will create a string like "*5" or "*3" I will append this to the counterString. But I can’t just write "*13" because I’m going to reverse the string later so I reverse the number as I create it e.g "*31" which would be reversed and read from left to right as "13*". The way I reverse a string in JavaScript is to .split("").reverse().join("") which uses split to convert it to an array, reverse to reverse it then join to convert the array back to a String.

              var appendThis = "*" + count.toString().split("").reverse().join("");
      

      Another complication is that I can’t just add the number to the String otherwise I’ll end up with "1*" as my 1 character string, and it isn’t it is two characters. So if the String I want to append is greater than the number of characters left then I only want a part of that string, e.g. a substring.

              if(appendThis.length>count){
                  appendThis = appendThis.substring(0,count);
              }    
      

      Then I append my number String to the counterstring.

              counterString = counterString + appendThis;
      

      Then I decrement ‘count’ by the number of characters I just added to the counterstring.

              count = count - appendThis.length;
      

      Then I continue the while loop if count still has characters to process.

          }
      

      Then, finally, I return the reversed counterString.

          return counterString.split("").reverse().join("");
      }
      

      Refactoring

      Since I have repeated code .split("").reverse().join("") I create a reverseString method

      function reverseString(reverseMe){
          return reverseMe.split("").reverse().join("");
      }
      

      Which I would call in my getCounterString function by:

      var appendThis = "*" + reverseString(count.toString());
      

      And

      return reverseString(counterString);
      

      This would give me a getCounterString function which I could run from the console, and I could then copy and paste the counterstring - a very basic tool.

      Easier to use

      var count = window.prompt("Counterstring Length?", "100");
      var counterString = getCounterString(count);
      console.log(counterString);
      

      The above code creates an input dialog and asks me “Counterstring Length?”, and I can enter the length I want. It stores the value I enter into a variable called count which it then uses to call the getCounterString method.

      And I print the generated Counterstring to the console, using console.log to make it easier to copy and paste.

      Even easier to use

      I can manipulate the DOM, i.e. the Web Page, from JavaScript.

      And if I select an input field before running the script then the I can use document.activeElement to find the input field that I selected and can set the value of that field.

      document.activeElement.value=counterString;
      

      If I select an input field, and then run the snippet then the counterstring should be added to the input.

      Note: this bypasses HTML max length attribute controls since it injects the text directly into the field Value, and doesn’t type the keys.

      Video

      I’ve created a video showing all this in action:

      Watch on YouTube

      Code

      And you can find the source code on Github.

      • github.com/eviltester/counterstringjs/blob/master/snippets/counterstring.js

      https://eviltester.com/blog/eviltester/2019-02-19-counterstring-snippets/

      postado em Feed de Blogs e Posts
    • Promoção na Escola Talking About Testing

      Dia internacional do teste de software Dia 20 de Fevereiro é considerado o dia internacional do teste de software ✅ devido ao lançamento do livro “The art of Software Testing“, do autor Glenford J. Myers, sendo o primeiro livro focado especificamente na disciplina de teste de software. Para comemorar esta data a Escola Talking About Testing está com … Continue lendo Promoção na Escola Talking About Testing

      https://talkingabouttesting.com/2019/02/19/promocao-na-escola-talking-about-testing/

      postado em Feed de Blogs e Posts
    • Bate-papo sobre DevOps – Grupo de mentoria Talking About Testing

      No último sábado, 9 de Fevereiro de 2019, rolou o primeiro bate-papo do grupo de mentoria do blog Talking About Testing, onde Alekson Fortes, Henrique de Souza e eu (Walmyr Filho), conversamos sobre DevOps baseado nos 3 caminhos descritos no livro “The DevOps Handbook: How to Create World‑Class Agility, Reliability, and Security in Technology Organizations“, … Continue lendo Bate-papo sobre DevOps – Grupo de mentoria Talking About Testing

      https://talkingabouttesting.com/2019/02/14/bate-papo-sobre-devops-grupo-de-mentoria-talking-about-testing/

      postado em Feed de Blogs e Posts
    • What is the best fuzzer (automated software testing tool) to find 0-days? Why? Quora Answer

      Q: What is the best fuzzer (automated software testing tool) to find 0-days? Why?

      A:

      0-day is a very broad statement.

      I tend to use the payload fuzzers in BurpSuite and OWasp Zap Proxy, but these require me to identify the target that I’m testing, and the appropriate data scope and range to fuzz.

      I suspect you might be more interested in application or file based fuzzers.

      Google have introduced a service for fuzzing applications.

      github.com/google/oss-fuzz

      There are many lists of fuzzers to read through.

      • blackarch.org/fuzzer.html
      • sectools.org/tag/fuzzers
      • secfigo/Awesome-Fuzzing

      New tools are being created for this all the time and there is a constant flood of research on fuzzing:

      scholar.google.co.uk/scholar?hl=en&as_sdt=0%2C5&q=fuzzing&btnG=

      Since the fuzzers all work at different levels and on different technologies you have to be very specific in your research to make sure you don’t overload yourself with tools (with is all too easy to do in Security Testing)

      owasp.org/index.php/Fuzzing

      https://eviltester.com/blog/eviltester/quora/2019-02-13-what-best-fuzzer/

      postado em Feed de Blogs e Posts
    • Hacking JavaScript Games - Accessing private javascript variables at runtime via debugging

      I like to write little bots from the console to help with with application and game automation. But when the variables and objects I need are created from within anonymous functions I can’t get access. In this post I will explain how to access them.

      I’ve tried writing helper code to access the methods within objects and trawl through the DOM to find specifically named objects, and that can help with a large application where the objects are all public.

      But when the application is essentially one anonymous function kept alive by event handlers and timers, how do we access the objects.

      The short answer is:

      • set a breakpoint on the line of code that use the object
      • in the console when the breakpoint activates, create a new reference to the object from the window

      e.g. if there is a pacman object I want to access, then find a line that uses it, breakpoint the line, then from the console:

      window.pacman = pacman
      

      And I now have access to the private pacman object from the console when not in debug mode because the window now has a reference to it.

      Manual Step

      This requires a manual step before any of my automated bots can be used but if I write down what to ‘search for’ to find the line in the code then it is pretty easy to repeat.

      Security by private objects

      If we are relying on the objects being private and inaccessible due to the anonymous function then we really shouldn’t because if it is in our browser, the user can gain access to it.

      Always have protection on your server side to handle anything thrown at it.

      Opens Up New Options

      This opens up a bunch of new options for testing and automating modern JavaScript approaches for me.

      This can’t really be used for continuous integration automating or fully autonomous code injection since there is a manual step involved. But for automating tactically where the user is present, this opens up more possibilities.

      Want to see it in action?

      Using the simple open source Pacman clone from platzh1rsch.ch where all the code is wrapped and called from anonymous function. I show the steps and thought processes for gaining console access to the main game and pacman objects to allow me to write infinite life cheats.

      • http://pacman.platzh1rsch.ch/
      • https://github.com/platzhersh/pacman-canvas
      • http://platzh1rsch.ch/

      Watch on YouTube

      Where to learn more?

      I have some material covering this topic:

      • https://www.eviltester.com/page/onlinetraining/techwebtesting101/
      • https://www.eviltester.com/page/onlinetraining/protectthesquare/
      • https://nordictestingdays.eu/files/files/09-sigma-alan-richardson_just_enough_javascript_to_be_dangerous-05-06.pdf
      • https://www.youtube.com/user/EviltesterVideos/search?query=javascript

      https://eviltester.com/2019/02/hacking-javascript-private-variables.html

      postado em Feed de Blogs e Posts
    • Talking About Testing & Patas Dadas

      No ano de 2019 a Escola Talking About Testing está fechando uma parceria com a organização Patas Dadas e 10% do valor pago por cada curso será doado à tal organização. A Patas Dadas tem a missão de resgatar animais em situação de abandono, proporcionando o atendimento veterinário necessário até estarem prontos para a adoção, buscando … Continue lendo Talking About Testing & Patas Dadas

      https://talkingabouttesting.com/2019/02/12/talking-about-testing-patas-dadas/

      postado em Feed de Blogs e Posts
    • Escreva código uma só vez

      Mais um post da série qualidade de código em teste de software Se você está chegando neste post agora e ainda não leu os conteúdos anteriores, recomendo começar por eles. Seguem os links: Escreva pequenas unidades de código Escreva simples unidades de código Agora se você já leu o primeiro e segundo post da série, vamos … Continue lendo Escreva código uma só vez

      https://talkingabouttesting.com/2019/02/11/escreva-codigo-uma-so-vez/

      postado em Feed de Blogs e Posts
    • Automated tests in a CD/CI pipeline

      Good pipelines are stable and can support frequent and small releases. When building the pipeline you need to include not only the build and unit tests part, but also the e2e tests and even the smoke tests and deploy to all the environments, so you have as minimun as human interation as possible, avoiding releases … Continue reading Automated tests in a CD/CI pipeline →

      https://azevedorafaela.com/2019/02/07/automated-tests-in-a-cd-ci-pipeline/

      postado em Feed de Blogs e Posts
    • How to Practice your JavaScript, Software Testing and Test Automation

      One way I practice my Software Testing, improve my JavaScript programming and practice my automating is by ‘hacking’ JavaScript games.

      One of my bots scored 282010 on https://phoboslab.org/xtype/ This ‘bot’ is JavaScript code that runs from the Browser Dev Tools and plays the game.

      Image of high score bot achieved

      I have a video showing the bot in action below.

      To create this I have to learn to use the dev tool to inspect the Dom, and the running memory space, and read the JavaScript. All of this is modelling the application. A recon step that helps me with my Software Testing.

      As I recon the app I look at the network tab to see what files are loaded and what API calls are issued. This also informs my model. And makes me think about Injection and Manipulation points.

      Perhaps I can use a proxy to trap and amend those requests? Perhaps my proxy can respond with a different file or data automatically?

      These are thought process and skills that I can apply in my testing. I also learn more about HTTP, Dev tools and Proxies.

      When the game is running I have to observe its execution behaviour. I build a model of the software and its functionality. This informs my Software Testing. I have to build models of the application as I test and make decisions about what to target.

      To ‘hack’ the game, I have to inspect the objects which have been instantiated by the code. I can do this in the console by typing in the object names.

      Inspecting a game object in memory

      To learn what these objects are I have to read the game code. This improves my JavaScript because one of the best ways to learn to write code is to read code and try to understand what it does.

      I can use the Snippets view in Chrome Sources to write JavaScript. This is a built in mini JavaScript IDE in the browser.

      Writing code in the browser

      I can write simple code here to manipulate the game objects in memory to help me cheat and hack the game. I don’t need to learn a lot of JavaScript to do this, and most of the JavaScript you need is already in the game source itself.

      To write a ‘bot’… code that executes in its own thread periodically to do something, I use the ‘setInterval’ command. This is the fundamental key to writing JavaScript bots. e.g.

      var infiniteLivesBot = setInterval(infiniteLives,1000);
      

      The above line calls a function named infiniteLives every second. That infiniteLives function checks if my number of lives have decreased, and if so, increase them. e.g.

      function infiniteLives(){
          if(game.lives<3){
              game.lives=3;
          }
      }
      
      var infiniteLivesBot = setInterval(infiniteLives,1000);
      

      I can easily stop this bot using the clearInterval command.

      clearInterval(infiniteLivesBot);
      

      I can run that code from the snippets view, or paste it into the console, or convert it into a bookmarklet. Whatever is more convenient to help me when I want to hack the game. I do the same thing to support my testing e.g. setup data, delete data etc.

      This is a form of ‘tactical’ automating. It won’t scale, it doesn’t go into continuous integration. It supports me. It does a specific task. It automates part of my work. It is a good start to learning to automate more strategically.

      To automate xtype I had to learn how to trigger mouse events to initiate the firing functionality. I couldn’t remember how to do this. I copy and pasted a snippet of code from stackoverflow. All professional programmers do this.

      • stackoverflow.com/questions/2381572/how-can-i-trigger-a-javascript-event-click

        var event = document.createEvent(“MouseEvents”);
        event.initEvent(“mousedown”, true, true);
        document.getElementById(“canvas”).dispatchEvent(event, true);

      Part of learning programming is knowing where to find a general answer. Knowing which part of the answer to isolate. Then having the confidence to bring that into your code and experiment with it.

      As I do this, I learn more JavaScript. Which allows me to write scripts in other tools e.g. Postman. And I can inject code into applications e.g. using WebDriver JavaScriptExecutor. The more I practice, the more options I open up.

      I take the knowledge and then write small utilities or applications to help me. I write a lot of small JavaScript utilities to help me with data extract activities and reformatting of data from Web applications.

      I extended my knowledge by writing JavaScript applications and games which I bundled into:

      • github.com/eviltester/TestingApp

      If you want to experiment with simple games manipulation and hacking then the games in this app are designed for that purpose.

      Doing this also has a knock on effect on how I view web applications. The GUI is no longer a trusted client. The GUI can be manipulated by the user. The messages it sends to the server can be manipulated by the user. The server needs to be robust.

      This helps my Software Testing. I have to go deeper when I test. And by practicing I develop the skills to go deeper when I test. I can recognise when requirements need to be tested more deeply than they state on the surface.

      This helps my programming. I am very aware that the server needs to validate and approach the input data with caution.

      This is one way that I practice my Software Testing, JavaScript programming and automating. The benefit to me has been enormous. I recommend this, or adapt the ideas and create your own practice path.

      I cover many of the skills to do this in my online Technical Web Testing 101 course https://www.eviltester.com/page/onlinetraining/techwebtesting101/

      Free Video Discussing This Topic

      Watch on YouTube

      Want to see my XType bot in action?

      This was a hard bot to write Xtype is a bullet hell shooter which are challenging to play, let alone automate - and no, I’m not going to show you the code for the bot.

      But this is not my first bot.

      I’ve written bots to play z-type, Cookie Clicker, 3D Monster Maze

      I like these games because they are all well written, I can read the code to improve my programming, and they are fun to play.

      Many of my bots are not full playing bots like the x-type bot. They are support tools. And when I started to automate x-type I started with support tools:

      • an infinite lives hack
      • an auto-aimer so that I didn’t have to keep track of the boss while I was controlling the player
      • I added auto firing to the auto-aiming so I only had to concentrate on moving the player
      • I combined all three and had a bot that could play the game, although it was cheating with infinite lives.
      • only then did I approach the autonomous playing of the game

      For 3D Monster Maze I only wrote support tools:

      • a heads up display so that a map of the screen was rendered on screen as I played showing me the position of Rex to help me avoid him, and showing me where the exit was
      • a trap for Rex, so that if he entered it he couldn’t move
      • a chain for Rex so that he never moved from his starting point
      • armour so that if Rex caught me, he couldn’t kill me

      For many games I try to think how to add extra features to make the game more interesting. I don’t have the skill or patience to write games like these, but I do have the skill and motivation to ‘augment’ them for my learning.

      This is analogous to writing ‘tools’ to support our testing, or making applications more ‘testable’.

      Note: my games github.com/eviltester/TestingApp are not well written, but they are very easy to understand and hack.

      Watch on YouTube

      https://eviltester.com/2019/02/practice-javascript-software-testing-automation.html

      postado em Feed de Blogs e Posts
    • How to Pretty Print JSON using Browser Dev Tools

      Quick tips for pretty printing JSON in the Browser.

      All examples in this post use the swapi.co API

      Where do you find JSON?

      In the network tab, I will very often be observing network traffic, and I’ll want to interrogate the message to view it more easily.

      So I copy and paste it from the network tab.

      showing json in the network tab

      I could use an online tool to format it and view it:

      • https://jsonformatter.org/
      • https://jsonformatter.curiousconcept.com/
      • https://jsonformatter-online.com/

      Or I could use the browser itself.

      Paste the JSON into the console

      Pasting the Json into the console will show an interactive view where I can expand and contract the outline and view the JSON.

      showing json in the console

      Pretty Print it using JavaScript

      JavaScript has a built in JSON class and I can use the stringify method to pretty print an object as JSON to the console.

      So I first create an object from the JSON:

      bob={"name":"Luke Skywalker"}
      

      Then I can pretty print the JSON (4 is the indentation level):

      JSON.stringify(bob, null, 4)
      

      e.g

      "{
          "name": "Luke Skywalker",
          "height": "172",
          "mass": "77",
          "hair_color": "blond",
          "skin_color": "fair",
          "eye_color": "blue",
          "birth_year": "19BBY",
          "gender": "male",
          "homeworld": "https://swapi.co/api/planets/1/",
          "films": [
              "https://swapi.co/api/films/2/",
              "https://swapi.co/api/films/6/",
              "https://swapi.co/api/films/3/",
              "https://swapi.co/api/films/1/",
              "https://swapi.co/api/films/7/"
          ],
          "species": [
              "https://swapi.co/api/species/1/"
          ],
          "vehicles": [
              "https://swapi.co/api/vehicles/14/",
              "https://swapi.co/api/vehicles/30/"
          ],
          "starships": [
              "https://swapi.co/api/starships/12/",
              "https://swapi.co/api/starships/22/"
          ],
          "created": "2014-12-09T13:50:51.644000Z",
          "edited": "2014-12-20T21:17:56.891000Z",
          "url": "https://swapi.co/api/people/1/"
      }"
      

      how to use JSON stringify

      Free Video Showing How to Pretty Print JSON

      Watch on YouTube

      https://eviltester.com/2019/02/pretty-print-json-using-dev-tools.html

      postado em Feed de Blogs e Posts