Maintaing web session state without cookies

Maintaining Session State without Cookies

Some browsers do not recognize cookies, and users can choose to disable cookies in their browsers. The HTTP POST method provides an alternative to cookies to maintain session state. The HTTP POST method provides the same state information as would a cookie but has the advantage that it works even when cookies are not available. This method is not common in practice, but it is a good example to learn from. The HTTP POST method works similarly to an in-memory cookie; user information can be maintained only during the visit, and the session state information is gone when the user turns off the browser.

There are two kinds of cookies, as follows:

• In-memory cookies: An in-memory cookie goes away when the user shuts the browser down.

• Persistent cookies: A persistent cookie resides on the hard drive of the user and is retrieved when the user comes back to the Web page.

Graduation college days

My graduation days were totally different and I have never faced those kind of days in my education cycle. The college in which I studied was Priyadarshini P.G. college situated in Ameerpet,Hyderabad

It was full of fun and only fun and no studies at all :) there were strength of only 18 members and that too only boys :( (Though it is a co-ed college)

Among those boys there were hardly three or four guys including me who were little serious about their studies, Remaining all were ho-hum kind of students, As it was tough course (B.C.A) containing all hard computer subjects, most of the lectures were also not fair enough to teach the subjects in a proper way.

English period was simply a recreation period for us and nothing else---

There was an english teacher used to take english classes for us and that period was like full fledge of merriment, Guys used to tease each other in front of teacher by throwing chocks and talking some rubbish about each other and also at the same time will behave like decent student by synching with teacher for few minutes by replying to her queries then again back to same track. Also there was a balcony in our class room which was the major part of recreation for us, So guys used to roam around in the balcony teasing other people walking on the road.

So that's how we spent our class periods & graduation time,But at the time of exams guys use to get tensed and start referring some books and taking each other's help to get some passing marks finally.

But one thing was that it had a major impact on my education & carrier, Because of no such seriousness in studies at all in class and neither from management side. Life was very much adrift. Despite all these things I got a good percentage and stood as a second topper in the class, Apart from my heavy hard work major credit goes to my cousin brother neeraj(B.C.A completed and at that time he was pursuing M.sc (IS) ) and my cousin sister poonam (she was pursuing B.C.A parallel to me but in some other women's college) and of course my bhaiya & bhabhi.

Nevertheless of all these I still sometimes I keep regretting myself that if I would have got some good college then does it have made any difference ..? or it would have been same like this.. ?

Few Security testing fundas for Web Apps

How to test Web site login security

Security is a major aspect of any Web site. Before testing the functionality, first you need to check the login page, because the login page is the main entry for hackers to any Web site. It is the tester's responsibility to check whether the login page is properly secured or not.

The technique you can use to check the security of the login page is this:

Username: ' or 1=1--
Password: any

If you enter the script given, you can easily log in to the system if developer has not applied proper validation in the code. This technique is called SQL Injection, and it means you are terminating the existing query using your script.

Few more techniques on securing web applications from sql injection

SQL Injection exploits may soon be as common as those targeting Windows and Unix flaws, experts say. An estimated 60% of Web applications that use dynamic content are likely vulnerable, with devastating consequences for an enterprise. Learn how to recognize whether your sites are vulnerable.

Step 1. Open the Web site in a browser.

Step 2. Mouse over the links of the Web site with your cursor while paying attention to the bottom status bar. You will notice the URLs that the links point to. Try to find a URL with parameters in it. Ex. http://www.site.com/articleid.asp?id=42. Most SQL injection problems are present when the file extensions are ".asp" or ".cfm". When trying to test a site for SQL injection vulnerabilities, look for these files specifically.

Note: If you don't see any URL's in the status bar, then just click on links and watch the address bar until you find a URL that has parameters.

Step 3. Once a URL with parameters has been found, click the link and go to that page. In the Address bar you should now see the URL that was seen in the status bar.

Step 4. Here is where the actual testing takes place. There are two methods for testing script for SQL injection. Be sure to test each parameter value one at a time with both methods.

Method 1. Go to the address bar, click your cursor, and highlight a parameter value Ex. Highlight the word value in "name=value" and replace it with a single quote (').It should now look like "name='"

Method 2. Go to the address bar, click your cursor, and put a single quote (') in the middle of the value. It should now look like "name=val'ue"

Step 5. Click the 'GO' button. This will send your request to the Web server.

Step 6. Analyze the response from the Web server for any error messages. Most database error messages will look similar to the examples below:

Example error 1:
Microsoft OLE DB Provider for SQL Server error '80040e14'
Unclosed quotation mark before the character string '51 ORDER BY
some_name'. /some_directory/some_file.asp, line 5

Example error 2:
ODBC Error Code = S1000 (General error)
[Oracle][ODBC][Ora]ORA-00933: SQL command not properly ended

Step 7. Sometimes the error message is not obvious and is hidden in the source of the page. To look for it, you must view the HTML source of the page and search for the error. To do this in Internet Explorer, click the 'View' menu, and select the 'Source' option. This will cause notepad to open with the HTML source of the page. In notepad, click the 'Edit' menu and select 'Find'. A dialog box will appear that will ask you to 'Find What'. Type the phrase 'Microsoft OLE DB' or '[ODBC]' and click 'Find Next'.

Step 8. If either step 6 or 7 is successful, then the Web site is vulnerable to SQL injection

A peep into all new Internet Explorer 8

IE 8 Releasing this june for beta release... To know more click here

Quick and simple differences between Smoke & Sanity tests

Many testers assumes that Smoke and Sanity testing are same but there are deviations between those two here are they:

SMOKE TESTING:

• Smoke testing originated in the hardware testing practice of turning on a new piece of hardware for the first time and considering it a success if it does not catch fire and smoke. In software industry, smoke testing is a shallow and wide approach whereby all areas of the application without getting into too deep, is tested.
• A smoke test is scripted, either using a written set of tests or an automated test
• A Smoke test is designed to touch every part of the application in a cursory way. It’s shallow and wide.
• Smoke testing is conducted to ensure whether the most crucial functions of a program are working, but not bothering with finer details. (Such as build verification).
• Smoke testing is normal health check up to a build of an application before taking it to testing in depth.

SANITY TESTING:

• A sanity test is a narrow regression test that focuses on one or a few areas of functionality. Sanity testing is usually narrow and deep.
• A sanity test is usually unscripted.
• A Sanity test is used to determine a small section of the application is still working after a minor change.
• Sanity testing is a cursory testing, it is performed whenever a cursory testing is sufficient to prove the application is functioning according to specifications. This level of testing is a subset of regression testing.
• Sanity testing is to verify whether requirements are met or not, checking all features breadth-first.

Goosh: A Command Shell For Google

Now Google provides you to do your regular googling using command line software called goosh (This google-interface behaves similar to a unix-shell.)

Instead of googling through a browser always, Now you can try your hands from command line and also Goosh could be a great friend of those who do not see the GUI in their regular software life :) or we can simply say command line workers. So quickly want to google it know then here is the goosh

Google's GPhone

Talk from Sergey Brin on GPhone


GPhone is getting built on android platform want to know more about android (See here)

Lets wait and watch to know who will take away the mobile market (Gphone or IPhone) ....?