Selected Recent Forum Posts

Here is a selection of some of the posts that we think would be of general interest.

• Use the "OnBeforeUnload()" method -- Try to avoid this, may be a security breach attempt! 
• Is eValid a programmable browser? -- Certainly is, with the EPI option installed. 
• Can eValid do what they do and if not what is missing? -- In a word, yes. But you expected that, right? 
• How do I create a test from scratch? -- You can create a test 100% manually, but it's far easier with automated help. 
• Do you have facilities in eValid to compare two images? -- Yes, but be aware that such regression testing is very sensitive. 

eValid AJAX Patent Issued By USPTO

On 23 July 2013 the US Patent Office (USPTO) issued USPatent #8,495,585, the fifth patent in the eValid patent portfolio. This patent further beefs up the Intellectual Property (IP) surrounding the eValid product by addressing specific methods of analysis of AJAX applications as they interact with the DOM, and also deals in detail with synchronization of AJAX test playback processes.

In addition to the issued eValid Patents there are three other patents currently being considered by the USPTO that cover additional aspects of the eValid product and the technology used to implement it. An additional five patent applications are in the works.

If you're working in automated web testing you may wish to look into the Business Development (BizDev) Opportunities that are based on eValid technology and its associated IP.

Selected Recent Forum Posts

Here is a selection of some of the posts that we think would be of general interest.

• Does eValid run on 64-bit machines? -- Yes, no problem; the out-of-box install has to go to a special folder.
• Frame names that change every day -- Messy web application, but frame names can be replaced with frame numbers.
• How do I get data from the outside world into my scripts? -- There is a simple environment-variable feed in for you. 
• Improve delivery performance by decreasing load time -- The real-world data eValid generates helps pinpoint problem components. 
• Is eValid an IE derivative browser? -- eValid uses all of IE's components, but assembles them differently. 

Selected Recent Forum Posts

Here is a selection of some of the posts that we think would be of general interest.

•  Have 100 eValid copies running in parallel -- How to avoid, and exploit, intra-browser interactions. 
• The size and download data for every page component -- How to measure very-detailed page timings. 
• How do you know how those lovely performance charts work? -- All of the charts are Java Applets. 
• Running 100 browsers to generate load -- Does channel usage overhead interfere with accurate measurement? 
• Pages that have a Modal Popup -- Special tricks for handling modals. 

CyberSecurity Resources

A question we are getting recently is: How can eValid be used to support cybersecurity work? In other words, given the very specialized needs of searching for and pinpointing cybersecurity vulnerabilities, what resources can eValid bring to the table?

For one thing, cybersecurity is a big area, involving a wide range of techniques -- static analysis, dynamic analysis, inspection, and a variety of other options. Because eValid's view is 100% client-side, its technology is only able to provide insight on how things operate from the browser, that is, at the client-side.

But that is in some ways one of the most potentially fruitful areas for which cyber vulnerability analysis can be performed.

As OWASP's section on Testing for AJAX Vulnerabilities points out, the use of AJAX "... the advent of AJAX accounts for an "...Increased Attack Surface..." because AJAX "...throws in additional ways to potentially inject malicious content." In other words, AJAX is an untapped issue in the security world.
eValid can easily handle AJAX applications, and resources inside eValid can then be used to extract the information needed to expose problems due specifically to AJAX application's asynchronous, client-server cooperative nature. So eValid seems to be a good fit for this kind of work, in an area in which it is already strong. The capabilities eValid can supply to a cyberthreat analysis effort are summarized in this CyberSecurity Resource Summary.

Selected Recent Forum Posts

Here is a selection of some of the posts that we think would be of general interest.

• Which browser eValid is imitating? -- Details of eValid's neat trick to emulate ANY device! 
• Can I use eValid to find out why my pages are loading slowly -- The general method eValid uses to measure detailed timing is revealed. 
• A way of capturing the value into a variable in memory -- Tricky manipulations with DOM values have big payoffs. 
• Can you do a search from the Address field? -- Guidelines for getting good simple searches done. 
• eValid synchronize playback -- The big issue: synchronization of AJAX! Here' the scoop. 

How to get a good playback on an AJAX site?

Question:
Do you have any special recommendations for me on how to get a good playback on an AJAX site?

Answer:
Fair question, but also a very broad question.

Web applications that employ AJAX can range from very simple (for example, a simple autocomplete activity), to the very, very complex (for example, the recently introduced http://www.outlook.com email system from Microsoft which they are pitching as better that Gmail).

At a very high level we have found this method of using eValid to test and measure AJAX applications to be the most effective:

(1) Make a recording from life first. "From life" means, using the out-of-the-box settings, make a recording from the starting URL to the point where you are going to be validating a result. The Wait times that eValid puts into your script will, at playback time, provide a crude level of synchronization.

(2) Play the recording back...it ought to work the first time assuming you have not edited the script and are not multiplying the Wait times by the Wait Time Multiplier to make things "go faster."

(3) Now, play back the script increasing the speed -- and increasing the changes for a script de-sync due to AJAX. When the script de-sync's, mark that spot in the playback, go back to that point, and record some kind of synchronization step. Repeat this until you can run your script with the Wait Time Multiplier = 0 -- that is, with NO wait times, but only synchronizations.

To a first level, this will get you a good script. Of course it can become more complex if you want to do structural testing on the page or if you want to replace some parts of your script with fancy DOM manipulations.

_________________
eValid Support