Crawling AJAX by Inferring User Interface State Changes

Mesbah, Ali; Bozdag, Engin; Deursen, Arie van

doi:10.1109/icwe.2008.24

Cited by 138 publications

(137 citation statements)

References 20 publications

Supporting

Mentioning

134

Contrasting

Order By: Relevance

“…Therefore, we should be able to generate and execute different event sequences as well as different (random or user-specified) input data. We have proposed such a crawler for AJAX, called CRAWLJAX [24], which is substantially extended for this work and explained in Section 4.…”

Section: Ajax Testing Challengesmentioning

confidence: 99%

“…Since the first publication on CRAWLJAX [24], a range of improvements to the tool and the underlying algorithms have been realized. Furthermore, the tool and testing approach have been applied to several AJAX applications (see, e.g., [33], [6]).…”

Section: Model (Dom)mentioning

confidence: 99%

“…They mostly use a crawler to infer a navigational model of the web. Unfortunately, traditional web crawlers are not able to crawl AJAX applications [24].…”

Section: Traditional Web Testingmentioning

confidence: 99%

“…Our experimental subject in this study is the AJAX-based open source TUDU web application 24 for managing personal todo lists, which has also been used by other researchers [22]. The 24.…”

Section: Subject Systemmentioning

confidence: 99%

“…The 24. http://tudu.sourceforge.net server-side is based on J2EE and consists of around 12K lines of Java/JSP code, of which around 3K forms the presentation layer we are interested in.…”

Section: Subject Systemmentioning

confidence: 99%

See 4 more Smart Citations

Invariant-Based Automatic Testing of Modern Web Applications

Mesbah

Deursen

Roest

2012

IIEEE Trans. Software Eng.

132

View full text Add to dashboard Cite

Abstract-AJAX-based Web 2.0 applications rely on stateful asynchronous client/server communication, and client-side run-time manipulation of the DOM tree. This not only makes them fundamentally different from traditional web applications, but also more error-prone and harder to test. We propose a method for testing AJAX applications automatically, based on a crawler to infer a state-flow graph for all (client-side) user interface states. We identify AJAX-specific faults that can occur in such states (related to e.g., DOM validity, error messages, discoverability, back-button compatibility) as well as DOM-tree invariants that can serve as oracles to detect such faults. Our approach, called ATUSA, is implemented in a tool offering generic invariant checking components, a plugin-mechanism to add application-specific state validators, and generation of a test suite covering the paths obtained during crawling. We describe three case studies, consisting of six subjects, evaluating the type of invariants that can be obtained for AJAX applications as well as the fault revealing capabilities, scalability, required manual effort, and level of automation of our testing approach.

show abstract

Section: Ajax Testing Challengesmentioning

confidence: 99%

Section: Model (Dom)mentioning

confidence: 99%

“…They mostly use a crawler to infer a navigational model of the web. Unfortunately, traditional web crawlers are not able to crawl AJAX applications [24].…”

Section: Traditional Web Testingmentioning

confidence: 99%

“…Our experimental subject in this study is the AJAX-based open source TUDU web application 24 for managing personal todo lists, which has also been used by other researchers [22]. The 24.…”

Section: Subject Systemmentioning

confidence: 99%

“…The 24. http://tudu.sourceforge.net server-side is based on J2EE and consists of around 12K lines of Java/JSP code, of which around 3K forms the presentation layer we are interested in.…”

Section: Subject Systemmentioning

confidence: 99%

See 3 more Smart Citations

Invariant-Based Automatic Testing of Modern Web Applications

Mesbah

Deursen

Roest

2012

IIEEE Trans. Software Eng.

132

View full text Add to dashboard Cite

show abstract

Fostering the diversity of exploratory testing in web applications

Leveau

Blanc

Réveillère

et al. 2022

Software Testing Verif & Rel

View full text Add to dashboard Cite

Exploratory testing (ET) is a software testing approach that complements automated testing by leveraging business expertise. It has gained momentum over the last decades as it appeals testers to exploit their business knowledge to stress the system under test (SUT). Exploratory tests, unlike automated tests, are defined and executed on-the-fly by testers. Testers who perform exploratory tests may be biased by their past experience and therefore may miss anomalies or unusual interactions proposed by the SUT. This is even more complex in the context of web applications, which typically expose a huge number of interaction paths to their users. As testers of these applications cannot remember all the sequences of interactions they performed, they may fail to deeply explore the application scope.This paper therefore introduces a new approach to assist testers in widely exploring any web application. In particular, our approach monitors the online interactions performed by the testers to suggest in real-time the probabilities of performing next interactions. Looking at these probabilities, we claim that the testers who favour interactions that have a low probability (because they were rarely performed), will increase the diversity of their explorations. Our approach defines a prediction model, based on n-grams, that encodes the history of past interactions and that supports the estimation of the probabilities. Integrated within a web browser extension, it automatically and transparently injects feedback within the application itself. We conduct a controlled experiment and a qualitative study to assess our approach. Results show that it prevents testers to be trapped in already tested loops, and succeeds to assist them in performing deeper explorations of the SUT.

show abstract

Improving penetration testing through static and dynamic analysis

Halfond

Choudhary

Orso

2011

Software Testing Verif & Rel

View full text Add to dashboard Cite

SUMMARYPenetration testing is widely used to help ensure the security of web applications. Using penetration testing, testers discover vulnerabilities by simulating attacks on a target web application. To do this efficiently, testers rely on automated techniques that gather input vector information about the target web application and analyze the application's responses to determine whether an attack was successful. Techniques for performing these steps are often incomplete, which can leave parts of the web application untested and vulnerabilities undiscovered. This paper proposes a new approach to penetration testing that addresses the limitations of current techniques. The approach incorporates two recently developed analysis techniques to improve input vector identification and detect when attacks have been successful against a web application. This paper compares the proposed approach against two popular penetration testing tools for a suite of web applications with known and unknown vulnerabilities. The evaluation results show that the proposed approach performs a more thorough penetration testing and leads to the discovery of more vulnerabilities than both the tools.

show abstract

Crawling AJAX by Inferring User Interface State Changes

Cited by 138 publications

References 20 publications

Invariant-Based Automatic Testing of Modern Web Applications

Invariant-Based Automatic Testing of Modern Web Applications

Fostering the diversity of exploratory testing in web applications

Improving penetration testing through static and dynamic analysis

Contact Info

Product

Resources

About