This post is password protected. To view it please enter your password below:

Password:

Anyway back on track , I really like strange encodings for HTML and the way in which some characters (chars) will get interpreted by a web-app as something else.

It makes my job as a tester much more interesting. Once you know what you are doing and you have a grasp of the basics you can will find that you can detect  defects where other testers would have passed an Application as ready for production.

This issue is undocumented elsewhere on the net as far as I can see and it can easily bring down a large majority of websites. (Major ones). By bring down I mean a Dos on the home page due to non display of content.

Feel free to investigate further in to it if you wish. However please only test it on sites which you have permission to run tests against.

anyway onto the details.

The issue is caused by characters that cannot be displayed in XML. As XML is unable to render the characters it will just error and display a blank screen to all users. (so now imagine if a site allowed users to input comments which were displayed on the front page).

The character in question is  and for this defect to take place a few things are needed. As the title states the site must have a MySQL back-end (millions of those about). It must also be coded in .Net (C# tested but may also affect VB.Net and other .Net languages) and lastly it must save data from a webform or textbox into the DB using CoreLab data connectors, and then display the data to be webpage via XML.

Now usually you won’t be able to enter  into the webapp but don’t worry as you enter it as valid text. (more on that coming up)

To see an example of this happening open NotePad + Microsoft Word, and the HTML Encoder page on my site.  Now in notepad type in I’ve visited the test Managers Page and do the same in Microsoft word.

now paste them into the decoder and see the difference.

Notepad will give you %27 and microsoft word will have changed your apostrophe to a curly apostrophe %_u2019 (the underscore needs to be removed but I can’t stop wordpress from encoding without it). I and most likely you may know of this as a simple %19 = .

Now Corelab, .Net – XML and MySql can all handle curly apostrophe’s however if you carriage return and some text on the next line after the curly apostrophe then CoreLab will add in a an “r/n – carriage return”. It seems that in the default installation of Corelab it doesn’t encode chars as UTF8 but as something else. Then in the DB you then get the encoded  which XML cannot cope with as its an invalid HTML char. So when that text which now has an invalid HTML char attempts to get rendered back in XML the XML stream fails and the page will fail to display.

Today I was looking to see if I could find a star “*” in excel and everytime I pressed search excel treated it as a wildcard and highlighted every cell in turn one by one.

To find the star I had to use the excel escape character of tilda “~”

so in the end in the search box I typed ~* and it found the star just fine.

Like I said just a quick tip in case its useful to anyone else.

Playing with Search engines.

As most of you know I spend virtually all of my working day testing search engines. I thought that today I would take a small look one of the new big kids on the block Bing which is the new search engine from Microsoft.

As I’m a Test Manager I won’t be be comparing basic searches but I’ll be looking for weird results and also looking for possible defects.

One of the great things about Bing is that it’s very similar to Google in that they share the same search structure, so if I type into Bing that I want to look for The Test Manager the URL will look a little something like http://www.bing.com/search?q=The+Test+Manager.com&go=&form=QBRE&filt=all&qs=n . Now if I want the exact same search in google all I need to do is to change the domain name from bing.com to google.com keeping the rest of the URL so the query now reads.  http://www.google.com/search?q=The+Test+Manager.com&go=&form=QBRE&filt=all&qs=n .

So lets start looking for interesting data.

First thing I think we’ll so its to look at the special character handling.

URL 1 = Your browser sent a request that this server could not understand. Reference #7.d6b23554.1246449926.0

not the cleanest of failure messages.
I should in the interests of fairness state that Bing can handle search phrases up to 2250 characters long and fails nicely. However if the string is a bit longer you get the ugly fail error. My string was alot longer

Enough fun stressing the servers, now lets look at business logic

How do they handle real search data.

we will search for URL:// meaning URL’s that start with // this should in theory bring back no results as its an invalid scheme.

URL2 = Strange results in Bing This is a strange one as if you attempt to click the link you get told

“Let’s try that again -That web page doesn’t exist”

however if you use Bing Cache you can see the page does exist. The bing Bots take //:www. and add in the http scheme when browsing however the site code does not.

Another problem with this URL is that it when trying to copy it, it may contain a bolded double witdh space which is invisible to the most. A real pain as it means that it will fail with a host not found.

A similar thing happens if you search for ww. (We can have valid 2 w’s as they are subdomain’s, however most search engines have issues with unexpected results.  its just one of those things that search engine testers know to look out for)

URL3 = Another Random Bing result.

Ok so enough picking on Bing next time around it will be Googles turn.

I really like Bing as a search engine and I think its a good starting point. Once its matured a bit then I’m sure it will grow and sort out these little niggles.

Generalising most people would state that virtually all botnets are bad. By this I mean that usually they are not used by their owners to attempt to look for a cure for cancer etc.

They are however used to launch mass denial of service attacks against .com websites and large corporate networks, even Governments.

They are not the kind of thing I would like shady Gov’t agencies to be involved in.

However it seems that Darpa/Arda are looking to create a tool to remotely take over existing botnets and become their new bot master.

Information below.

http://cryptome.info/traceback.htm

https://www.fbo.gov/

20 – goto 10

30 -  run

Welcome to the new Test Manager Blog.

The above Hello World code was the first program I ever wrote back in the early 80′s on a ZX spectrum 81. It was just hello world in a constant loop.

I would have been about 7 or 8 years old at the time.