Showing posts with label commerce. Show all posts
Showing posts with label commerce. Show all posts
Sunday, September 17, 2017
Hackazon una aplicación web vulnerable de e commerce para practicar
Hackazon una aplicación web vulnerable de e commerce para practicar
Hackazon es un m�quina intencionadamente vulnerable que simula ser una tienda online y que incorpora las �ltimas tecnolog�as que se usan actualmente: un interfaz AJAX, un workflow realista de e-commerce e incluso un API RESTful para una aplicaci�n m�vil
Aunque Dan Kuykendall aka @dan_kuyendall de NT OBJECTives (ahora Rapid7) la present� ya hace casi 3 a�os, en el 2014 en la APP Sec USA de OWASP, sigue siendo una interesante opci�n a la hora de montar un laboratorio de pr�cticas.
Hackazon es de c�digo abierto y permite adem�s configurar cada �rea de la aplicaci�n con el fin de cambiar el panorama de vulnerabilidades y as� evitar "pruebas conocidas de vulnerabilidades" o cualquier otra forma de "enga�o".
Dado que la aplicaci�n incluye interfaces RESTful que potencian la funcionalidad AJAX y clientes m�viles (JSON, XML, GwT y AMF), los usuarios necesitar�n las �ltimas herramientas y t�cnicas para descubrir todas las vulnerabilidades. Hackazon tambi�n requiere probar detalladamente los flujos de trabajo, como carritos de compras, que se utilizan com�nmente en aplicaciones empresariales.
Instalaci�n (entorno WAMP)
Caracter�sticas
Wiki: https://github.com/rapid7/hackazon/wiki
Manual de usuario (pdf): https://community.rapid7.com/servlet/JiveServlet/downloadBody/3452-102-3-8267/Hackazon_User%27s_Guide.pdf
Aunque Dan Kuykendall aka @dan_kuyendall de NT OBJECTives (ahora Rapid7) la present� ya hace casi 3 a�os, en el 2014 en la APP Sec USA de OWASP, sigue siendo una interesante opci�n a la hora de montar un laboratorio de pr�cticas.
Hackazon es de c�digo abierto y permite adem�s configurar cada �rea de la aplicaci�n con el fin de cambiar el panorama de vulnerabilidades y as� evitar "pruebas conocidas de vulnerabilidades" o cualquier otra forma de "enga�o".
Dado que la aplicaci�n incluye interfaces RESTful que potencian la funcionalidad AJAX y clientes m�viles (JSON, XML, GwT y AMF), los usuarios necesitar�n las �ltimas herramientas y t�cnicas para descubrir todas las vulnerabilidades. Hackazon tambi�n requiere probar detalladamente los flujos de trabajo, como carritos de compras, que se utilizan com�nmente en aplicaciones empresariales.
Instalaci�n (entorno WAMP)
- Descarga el c�digo
- Configura el DOCUMENT_ROOT a /web. Aseg�rate de que est� activado el soporte de htaccess y REWRITE.
- Copia /assets/config/db.sample.php a /assets/config/db.php
- Cambia la configuraci�n para la BD en /assets/config/db.php
- Abre http://yoursitename/install
Caracter�sticas
- Soporte REST - http://www.w3.org/2001/sw/wiki/REST
- Soporte GWT - http://www.gwtproject.org
- Soporta peticiones AJAX y HTTP est�ndar
- PHP Version � 5.4
- PHP Framework � http://phpixie.com/
- JS � http://jquery.com/ & http://knockoutjs.com/
- CSS � http://getbootstrap.com/
- DB � MySQL 5.5 con soporte InnoD
- Web Server � Apache 2.0
Wiki: https://github.com/rapid7/hackazon/wiki
Manual de usuario (pdf): https://community.rapid7.com/servlet/JiveServlet/downloadBody/3452-102-3-8267/Hackazon_User%27s_Guide.pdf
download file now
Saturday, September 16, 2017
E Commerce Site Testing
E Commerce Site Testing
Now a days ecommerce testers are in demands, many new ecommerce�s sites are coming into exiting and old ecommerce site are getting famous day by day. More peoples are preferring the online shopping than actual going to market and purchasing the things. Online ecommerce site has gain the trust on people. Online shopping site has many policies are very effective and trust worthy.
Online site has provide offers, cash back and lots of varieties which are attracting the people to purchase online and. For the smooth process, this sites need to be tested and should be defect free. Many news are there which shows that because of the loophole present in the system, company has to loose crores of rupees. One such an incidence were an online food ordering site looted by a university student because of the bug present in the software. Bug was on payment page, when user were refreshing the payment page, payment were made automatically. This bug caused a crores of loss to the company.
Such a unpredictable things can happen, tester has to think in many different way to overcome any loophole present in the system. There are many type of testing we need to perform on ecommerce site to ensure its quality.
Functional Testing :
Need to ensure that all the functionalities are working as stated in requirement document. And all the major and minor bugs are removed from the system.
Performance Testing:
Performance testing is also important part in ecommerce site, as we know on the sales day the traffic on the site may be huge, and which can cause the server down issues or break down of the software. many of you might have heard about a news, once a ecommerce site announced the big billion day sale and due to that the traffic on the site were huge which cause the server down issue and for some time the site was unaccessible . so such thing should not be happens, we need to make sure its performance ability.
Cross browser Testing:
We can�t predict which browser do user use. It may be any browser user can user. So we need to ensure that and test our site on multiple browser. There are few issues which comes only on particular browser. These all should be eliminated.
Usability Testing:
Usability testing also plays important role when it comes to the ecommerce site, even a first time visitor should be able to purchase the stuff without reading any manual. Means core functionality should be implement with an ease. As a tester we need to ensure that the software is easy to use. at least a core and basic functionality should be easy to understand.
Cookies:
Cookies are the important part of the ecommerce site, now a days even if you not logged in to the ecommerce site still you can add the product into the cart, if suppose after that you closed the browser of window and again open the ecommerce site, you will find the added products are still there in the cart these is all because of the stored cookies. These need to be tested well.
Payment Gate Way:
Hard past to test of any ecommerce site is payment gateway, when it comes to the money we need to ensure twice about the quality, payment failure, refund, unauthorized transaction, fail transaction all need to be tested.
Integration Testing:
Integration like payment gateway integration, API integration, data transmission between all the modules should be happen properly. All these can be ensure by performing integration testing.
Globalization & localization:
Globalization and localization testing is done to ensure that the software is fit to any states, countries cultural values, traditional values. There are some ecommerce site which are allow other countries user to purchase the stuff from the site, if you see the site aliexpress, the site get transform as per the country if we select the Indian it will show all the product price in Indian currency and the language is also get changed to the English language.
Security Testing:
Software should be well robust to handle any unwanted attach on it, attackers may try to get the control over the application by finding the loop holes in the software. By performing security testing tester try to eliminate all the bottlenecks present in the software application.
download file now
Subscribe to:
Posts (Atom)