The article outlines a step‑by‑step roadmap for software testers to integrate AI into their daily work, understand model behavior, establish robust evaluation methods, embed security testing, and continuously reinforce core testing fundamentals while avoiding hype‑driven career moves.
This article introduces the PHP Taint extension, explains its runtime taint‑tracking mechanism, shows how it marks user inputs, propagates taint through string operations, triggers warnings on high‑risk functions, and provides installation, usage examples, supported risk scenarios, built‑in APIs, and best‑practice recommendations for secure PHP development.
AutoCVE is an open‑source, multi‑agent platform that automates the full CVE discovery workflow—from project selection, code scanning, and intelligent finding via a ReAct loop, to verification and structured reporting—enabling researchers to uncover up to 30 high‑severity vulnerabilities across 14 projects in a single week.
The article demonstrates a double‑layer MITM setup (mitmproxy → Burp Suite → mitmproxy) to decrypt SM2‑encrypted web request and response traffic, provides step‑by‑step commands, common pitfalls, and a GitHub skill that automates the process.
OpenAI unveiled the GPT-5.6 series—Sol, Terra, and Luna—featuring max and ultra modes, a tiered pricing model, benchmark scores that surpass Claude Mythos by up to four points, security testing that uses a third of the tokens, and a limited rollout to about twenty government‑approved partners.
The article presents four practical case studies of captcha-related weaknesses—two showing how verifyId or UUID reuse lets attackers bypass image verification, one demonstrating a UUID‑bound bypass, and a fourth exposing a resource‑consumption flaw via manipulable height and width parameters.
The author discovered a silent IDOR vulnerability in a financial system where the X-Account-Id request header was trusted by the backend, allowing any user ID to retrieve full transaction, rewards, and billing data without authentication, and reported it responsibly for a rapid fix and reward.
This guide explains how to install the Mcpwn tool, understand its detection methods for RCE, path traversal, and prompt injection, and run both quick and focused scans against public and custom MCP servers to uncover critical security flaws.
This article presents a hybrid script‑plus‑LLM Skill that automates decompilation, interface extraction, sensitive data discovery, encryption analysis, and vulnerability assessment for WeChat mini‑programs, showing a step‑by‑step workflow, agent architecture, example results, and a GitHub implementation that reduces analysis time to about 20‑30 minutes.
This guide provides twenty detailed, ready‑to‑use templates that cover API overview translation, end‑to‑end call chains, OAuth2 flow analysis, JWT security testing, API key rotation, large file chunked upload, WebSocket messaging, payment callback verification, GraphQL optimization, gRPC testing, HTTP status‑code scenarios, circuit‑breaker testing, version compatibility, internationalization, OpenAPI validation, and contract‑test generation, each with concrete code snippets and step‑by‑step requirements.
The article examines how a 2025 supply‑chain poisoning incident sparked a paradigm shift toward adversarial testing, introducing new roles, AaaS platforms, and dual‑cycle processes that move testing teams from merely finding bugs to building resilient, attack‑aware systems by 2026.
AuthKit is a Burp Suite extension that expands a single request into Original, Unauthorized and multiple‑role samples to uncover unauthorized access, horizontal and vertical privilege escalation, and BOLA issues, offering passive capture, right‑click active testing, multi‑identity replay, metric dashboards, diff views, context‑menu integration, and flexible scope controls.
ByPassTamperPlus is a Python‑based collection of SQLMap tamper scripts tailored for MSSQL, MySQL and Oracle across multiple versions, employing version‑specific syntax, functions and obfuscation techniques to improve payload survivability against modern Web Application Firewalls, while acknowledging inherent limitations.
WebScan Pro is a Python‑based, multithreaded site directory scanner that offers both CLI and GUI modes, supports Windows, macOS, and Linux, and provides real‑time visual monitoring, customizable thread settings, and best‑practice recommendations for safe and efficient security testing.
The article outlines a three‑dimensional skill framework—technical depth, business breadth, and engineering mindset—to guide automation test engineers in mastering programming fundamentals, test frameworks, CI/CD, quality metrics, AI‑driven testing, and career progression from junior to senior levels.
The article forecasts that in 2026 software testing will be reshaped by AI‑generated test cases, self‑healing frameworks, predictive risk analysis, left‑shift quality gates, integrated security and privacy testing, and a shift toward test architects and business‑savvy consultants, urging professionals to expand their technical and soft‑skill portfolios.
This article breaks down the eight core differences between mobile and web testing, covering platform fragmentation, network scenarios, interaction models, installation processes, performance metrics, interruption handling, security concerns, and automation tools, and explains why mobile testing demands broader technical breadth.
This article analyses the five fundamental security attributes—confidentiality, integrity, non‑repudiation, auditability and authenticity—detailing their definitions, testing goals, key techniques, a comprehensive banking transfer case study, discovered vulnerabilities, remediation measures, metrics and best‑practice recommendations for continuous security testing.
The article presents a thorough AI‑driven test‑case suite for a user registration interface, detailing strategies such as equivalence partitioning, boundary‑value analysis, decision‑tree modeling, and error‑guessing, and covering fields like account, password, confirm password, mobile and email with functional, security, concurrency, and usability scenarios.
This article outlines a comprehensive testing matrix that maps common test types—unit, API, UI, security, performance, smoke, and regression—to their problem domains, SDLC stages, and execution methods, helping teams select and prioritize tests based on risk, feedback speed, and ownership.
This guide shows non‑coding testers how to conduct quick performance and security assessments by relying on user perception, simple timing, multi‑browser simulations, basic input manipulation, and network inspection to uncover obvious issues before involving professional test teams.
This article examines script injection threats in Java applications and compares static, dynamic, and interactive security testing tools—SAST, DAST, and IAST—highlighting their strengths, weaknesses, and popular options to help developers select the most suitable solution.
This article explores a hybrid approach that combines traditional static application security testing (SAST) with large language models (LLM) to automatically detect business‑logic vulnerabilities, detailing the methodology, implementation stages, experimental results, and the challenges of integrating AI into code security analysis.
This article presents three practical case studies—social app stability testing, game app performance optimization, and e‑commerce app security testing—demonstrating how Monkey testing, combined with targeted parameters and monitoring tools, can uncover hidden issues and improve overall product quality.
This article outlines a comprehensive approach to API automation testing, covering requirement analysis, test case design for functional, performance, and security aspects, tool selection, a practical login‑API case study, and best practices such as CI/CD integration, regression testing, and environment management.
Learn practical tcpdump examples to boost network troubleshooting and security testing, covering common parameters, ASCII output, protocol and IP filtering, file writing, buffering modes, combined filters, and advanced use cases like extracting HTTP headers, detecting port scans, capturing ICMP, DHCP, SNMP, and more.
This article details Huolala's challenges in risk‑control testing amid rapid business growth, outlines the inefficiencies of manual configuration verification, and explains how a suite of automated tools and a full‑scope interception strategy dramatically improved testing efficiency, data quality assurance, and cross‑team collaboration.
This article explains the structure of JSON Web Tokens, outlines common attack vectors such as algorithm confusion, weak keys, replay, and header injection, and provides practical mitigation strategies and a testing checklist with recommended security tools.
The article explains how browser‑based synthetic monitoring can observe the full user experience, use rich assertions and multi‑step scripts to spot CDN supply‑chain poisoning and traffic hijacking, illustrated with real polyfill.io and BootCDN attack cases.
This guide explains what capital loss means, outlines common financial loss scenarios, details a comprehensive testing methodology, presents real-world banking and insurance loss cases, and offers practical prevention measures to safeguard financial operations.
jwt_tool.py is a Python toolkit that validates, forges, scans, and manipulates JSON Web Tokens, offering features such as token validity checks, testing of known CVE‑related vulnerabilities, misconfiguration scanning, claim fuzzing, secret/key verification, dictionary‑based weak‑key detection, timestamp tampering, RSA/ECDSA key reconstruction, and interactive token editing.
This article explains how mid‑level and senior software test engineers are defined, highlights the career‑advancing value of certification, and presents a detailed testing skill map covering automation, performance, and security testing techniques and tools.
This article explains the principles of the Windows Filtering Platform, outlines functional, compatibility, performance, and security testing techniques for WFP‑based network drivers, and presents a case study on diagnosing throughput issues using filter isolation tools.
This guide explains how to use Burp Suite's Auth Analyzer plugin to efficiently perform bulk API access‑control (broken access control) testing, covering vulnerability types, tool installation, step‑by‑step testing procedures, result analysis, and report export for improved software security.
This article explains the architecture, core principles, and implementation details of Syzkaller, the coverage‑guided kernel fuzzing framework, and shows how it is set up and runs on Android devices to discover kernel vulnerabilities efficiently.
This article explains why security testing is critical for Kubernetes clusters, outlines key testing approaches such as SAST, DAST, container image scanning, configuration audits, and network policy testing, and provides practical steps for integrating these methods into CI/CD pipelines to ensure robust cloud‑native security.
This guide explains the advantages of using the Charles proxy tool for software testing—including network traffic monitoring, debugging, environment simulation, security testing, and automation support—followed by detailed instructions for downloading, installing, registering, and configuring the tool.
This article explains how to secure PHP web applications by performing code reviews, validating user input, preventing SQL injection and XSS, and using security testing tools such as PHP Security Scanner, OWASP ZAP, and Kali Linux, along with practical testing methods like boundary, authorization, and exception handling.
This article details the discovery and exploitation of an API‑based information leakage in a university system, showing how default passwords, missing parameters, and directory depth allowed an attacker to retrieve thousands of student records, and concludes with lessons for security testing.
This article outlines essential software testing points—including UI usability, functional correctness, performance load, security controls, and cross‑platform compatibility—explaining why enumerating each test item helps testers design comprehensive cases, detect defects early, and ensure reliable, secure, and user‑friendly applications.
This article explains how security testing tools integrate into DevOps to form a DevSecOps model, outlines the differences between static and dynamic application security testing, and reviews popular SAST and DAST solutions that help protect software throughout its lifecycle.
This article provides a comprehensive overview of software testing, covering its purpose, various test types such as functional, performance, security, compatibility, reliability, user experience, internationalization, and automation, as well as career prospects and essential skills for testers.
The guide outlines community-driven client‑side testing practices—functional, compatibility, exploratory, UX, performance, stability, and security testing—detailing tool use such as TeslaLab, automation and AI techniques, cross‑device and platform challenges, memory‑leak and crash analysis, and combined black‑box/white‑box approaches to improve app quality and data privacy.
This article provides software test engineers with 1‑3 years of experience a comprehensive roadmap to master fundamental testing skills, automation, performance, security testing, and essential programming languages, emphasizing systematic learning, practical application, and continuous improvement for career growth.
This guide outlines essential mobile app testing practices, including device and platform selection, handling user mobility and network changes, multitasking scenarios, gesture conflicts, user experience factors, permissions, caching, web dependency, layered and exploratory testing, security checks, and effective log usage.
This article documents a complete horizontal privilege escalation attack, showing how modifying POST parameters, REST‑style paths, and cookies can lead to unauthorized view, edit, and delete of other users' data, followed by techniques to combine the flaw with XSS and CSRF for greater impact.
This guide outlines practical steps for selecting devices, weighing real devices versus emulators, leveraging cloud and network testing, and conducting UX, performance, and security checks to ensure high‑quality mobile app deployments in today’s fast‑paced digital landscape.
This article explains why interface testing is essential for game quality and security, and provides a detailed, step-by-step methodology—including planning, analysis, test case design, execution, result verification, and automation—to help QA teams efficiently test server APIs and prevent player cheating.
GameSentry, an open‑source tool from NetEase Yidun, streamlines game security testing by analyzing protocols, function logic, memory, and code hot‑updates, offering detailed risk categories, testing steps, and advantages that lower the barrier for developers to detect vulnerabilities before release.
The article explains the importance of security testing within DevSecOps, outlines key testing methods such as SAST, DAST, IAST, and SCA, discusses penetration testing, and describes Huawei Cloud's comprehensive security testing framework and practices for ensuring software safety in modern development pipelines.
This article walks through a full horizontal privilege escalation attack, showing how altering POST data, REST‑style URLs, and cookie fields can grant unauthorized view, edit, and delete rights, and how to amplify the impact with self‑XSS and CSRF techniques.
This comprehensive guide walks you through the fundamentals of software testing, covering test analysis and design, mobile testing techniques, performance and security testing methods, algorithm validation, data quality assurance, and effective cross‑domain project management for modern development teams.
This article surveys IAST and RASP technologies, detailing Java bytecode instrumentation methods, passive probing techniques, taint analysis algorithms, integration with SkyWalking, and compares their capabilities with SAST and DAST, providing practical implementation guidance and reference resources.
This article explains how test engineers can incorporate functional security testing into routine testing by outlining the differences between security and functional testing, describing the Security Development Lifecycle (SDL) responsibilities, and providing concrete test‑case design guidelines for various security scenarios.
This article details how Good Doctor Online integrated and optimized the open-source IAST tool within its security development lifecycle, covering architecture, performance enhancements, RPC adaptation, CI/CD pipeline integration, and real-world deployment results.
This article introduces the open‑source Command2API tool, explains its origin in internal security testing, describes its simple Python‑based architecture that runs commands in a thread and serves results through an HTTP API, provides usage examples, examines the source code, and suggests possible improvements.
This article introduces web security testing, explains why it is essential, describes common vulnerabilities such as weak passwords, XSS, CSRF, SQL injection, authorization bypass, and file upload issues, and offers practical prevention measures and testing guidelines for developers and testers.
This article presents a comprehensive GitHub collection of Spring Boot vulnerabilities, explains how to identify information‑leakage and remote‑code‑execution flaws via exposed Swagger and Actuator endpoints, and provides step‑by‑step verification commands for security testing.
This article outlines JD Daojia's comprehensive application security strategy, including risk analysis, threat modeling, DevSecOps processes, open‑source component scanning, SAST/DAST/IAST testing, manual security assessments, and evaluation of testing effectiveness to mitigate vulnerabilities before production.
This document outlines a detailed testing strategy for the Cloud Classroom mobile app, covering security, static code analysis, performance, compatibility, and overall quality assurance to ensure stable functionality and a positive user experience.
The article presents a systematic, automated platform that captures, replays, and compares API requests using intelligent sampling and vertical/horizontal privilege checks to detect authorization flaws, dramatically reducing manual testing effort, uncovering over twenty issues monthly, and outlining future CI integration and AI‑enhanced detection.
This article describes Ctrip's practical deployment of OpenRASP‑based IAST, outlines the challenges of data pollution caused by traffic replay, and presents a Java bytecode instrumentation solution that intercepts SocketOutputStream writes to prevent dirty data from persisting in databases, caches, and message queues.
This article examines the growing need for comprehensive IoT testing, outlines how to select representative devices, and details the four main testing domains—security, performance, functionality, and compatibility—while offering practical guidance for QA teams to ensure high‑quality connected products.
This article explains the importance of security testing, outlines where to start, and details a step‑by‑step security testing workflow covering requirement analysis, static code scanning, third‑party component checks, data masking, permission checks, XSS, SQL injection, privilege escalation, file upload/download, server port scanning, and business‑specific test cases.
This article explains practical techniques—equivalence partitioning, boundary value analysis, and scenario testing—to create thorough login test cases, then expands with advanced functional, security, performance, and compatibility scenarios, helping testers improve coverage and demonstrate expertise in interviews.
This article explores why mobile app testing is crucial, explains the mobile testing pyramid, details functional, regression, performance, security, usability, and compatibility testing types, compares automation frameworks and tools, and discusses practical challenges such as device fragmentation, network variability, and battery constraints.
The article examines why basic functional testing jobs are dwindling, highlights growing opportunities in automation, performance, security, big‑data and AI testing, and offers a practical roadmap to help testers acquire new skills and advance toward higher‑salary roles.
White-box testing examines a program’s internal structure, code, and logic by creating and executing test cases that cover all paths, conditions, and statements, enhancing security, reliability, and code quality, while outlining its steps, techniques, examples, advantages, and drawbacks.
This guide walks through installing Drozer, configuring port forwarding, connecting the console, and using a variety of commands to enumerate packages, activities, content providers, services, and broadcast receivers on Android devices, while also addressing common errors and demonstrating vulnerability scans such as SQL injection and directory traversal.
This comprehensive guide explains why code auditing is essential for modern enterprises, compares enterprise and white‑hat audits, outlines a seven‑step methodology, and reviews both open‑source and commercial SAST tools with practical case studies across PHP, Node.js, Python, and Go.
This article explains the differences between functional and security testing, introduces common web vulnerabilities such as SQL injection, cross‑site scripting (XSS), and cross‑site request forgery (CSRF), provides concrete code examples, and offers practical tips for detecting and preventing these issues.
This guide explains how to classify payment types, outlines functional, interface, and security testing methods, and lists comprehensive test points for payment amounts, processes, methods, and coupon handling to ensure reliable and secure payment flows in software products.
This article provides a detailed overview of payment testing, covering payment classification, common testing methods such as functional, interface, and security testing, key test points for payment flow, amounts, methods, and coupons, and includes illustrative diagrams to help testers ensure reliable and secure transaction processes.
This guide outlines a comprehensive software testing framework, covering basic smoke tests, functional, security, interface, compatibility, installation, performance, regression, and advanced testing practices, with detailed steps, responsibilities, and reporting requirements for development, testing, and product teams.
This comprehensive guide explains the most common software testing types—from Alpha and Beta to Security, Load, and Compatibility testing—detailing their purposes, execution contexts, and how they help ensure software quality before release.
This article presents a comprehensive guide to Android UI and API automation testing, covering framework selection, script development with Robotium and Genymotion, Docker-based Selenium grid deployment, Python RemoteDriver usage, security testing, and best practices for efficient mobile test automation.
This article explains what CSRF (Cross‑Site Request Forgery) is, illustrates its attack model, details the potential damages, walks through the attack process with examples, and outlines practical detection methods and multiple defense techniques including token‑based protection and referer checks.
This article surveys the latest software testing trends—from security, AI‑driven testing, static analysis, and precise testing to cloud, IoT, open‑source tools, container‑based DevOps, agile, big‑data, and mobile testing—highlighting opportunities, challenges, and future directions for test engineers.
This article explains the concept and architecture of an unmanned customer service system, outlines its security testing strategy—including interface, vulnerability scanning, privilege and data protection tests—describes database and web security methods, and provides practical command examples and tool recommendations.
This article examines typical ciphertext leakage scenarios in file encryption software, such as process forgery, driver hijacking, temporary file exposure, and embedded object insertion, and outlines practical escape testing techniques to improve security and product robustness.
This article introduces business security testing, explaining its background, overall workflow, and detailed techniques such as network request interception with tools like TamperIE, Chrome DevTools, and tcpdump, as well as cookie manipulation, backend authentication forging, and replay attacks on GET and POST interfaces.
Security testing, performed from near completion to release, verifies that software meets security requirements and quality standards by identifying common vulnerabilities such as DLL hijacking, ASLR/DEP misuse, and heap overflows, and employs static scanning and dynamic testing methods to detect and remediate these issues.
This article provides an in‑depth overview of security testing, covering its definition, lifecycle, test types, a wide range of scanning and injection tools, practical checklists, evaluation metrics, and recommendations for integrating security assessments throughout the software development process.
