Get SMS notification for emails at GMail

Romain Vialard is a Google Apps Script Top Contributor. He has contributed interesting articles and blog posts about Apps Script. - Jan Kleinert

I just had to share this finding with all of you. Now you can get SMS alert or notifications for important emails at GMail.

Just follow the steps described at the below link:
https://developers.google.com/apps-script/articles/gmail_filter_sms#section1
or,
Just follow the steps below(copied from above link):

1. In Google Calendar, register your mobile phone to enable SMS notifications.
2. In Gmail, create a new label named 'Send text'.
3. In Gmail, create a filter to apply the label 'Send text' to important emails. For example, you may want consider emails from your boss containing the word 'urgent' as important.
4. Send an email to yourself to try this filter.
5. In Google Docs, open a new spreadsheet.
6. Choose the menu Tools > Script Editor.
7. Copy and paste the following script:

   function sendText() {
     var label = GmailApp.getUserLabelByName('Send text');
     var threads = label.getThreads();
     var now = new Date().getTime();
     for(i in threads){
       CalendarApp.createEvent('IMP- '+threads[0].getFirstMessageSubject(),
                               new Date(now+60000),
                               new Date(now+60000)).addSmsReminder(0);
     }
     label.removeFromThreads(threads);
   }

8. Save the script.
9. Click the Run icon. A pop-up opens asking you for your authorization to access the Gmail and Google Calendar services.
10. Click the Authorize button.
11. Click the Run icon again.
12. After one minute, you should receive a text on your mobile device, containing the subject of the email you wrote and sent in Step 4.

Ruby gem 'churn' dependency conflict solution

The main reason of writing this solution is that I haven't found any solution regarding this problem by searching till date.

Scenario: 
Just wanted to run some sample test scripts to explore ruby gem "churn".

Problem:
Installed 'churn-0.0.15', latest map gem 'map-5.1.0' and as churn required gem main so installed latest 'main.5.0.'. But gem 'main' required 'map' version '4.3.0', so I had installed that too.
Finally when I tried to run sample script, it gave me the following error

"Unable to activate churn-0.0.15, because map-5.1.0 conflicts with map (= 4.3.0) (Gem::LoadError)"

So, map 4.3.0 was conflicting with map 5.1.0, though in order to install 'churn' I had to install both of them.

Probable Solution:
I need to install only one 'map' gem which will satisfy both churn and  main.

Solution:
I uninstalled churn, map and main, all versions.

Then I installed 'map-4.3.0' then 'main-4.6.0' and finally "churn-0.0.15'.

It solved the conflict that I was having.

Similar Issues:
https://github.com/danmayer/churn/issues/10
https://github.com/jscruggs/metric_fu/issues/73

SQL query performance test with JMeter

There are lot of tools in the market by which you can analyze performance of SQL query or stored procedures. Which tool you select is a matter of choice and compliance with your database server.

Apache JMeter is a open source software which had been built with JAVA. Main purpose of this tool is to do load test function behavior and measure performance. Basically anything that has request and respond feature can be load tested by JMeter.
Website link: JMeter

Scenario: I need to know how efficiently my SQL queries can perform under some given load.

I will use JMeter tool to accomplish my objective. In order to use JMeter you need to have JAVA run-time environment present in your machine. JMeter uses JDBC to connect to any database. As my targeted server is Microsoft SQL Server(MSSQL) 2008, I need to have proper JDBC driver for MSSQL and need to place that driver under "JMeter/lib" directory. Also we need to monitor the performance of the server where the database has been stored. "Performance Monitor" provided by Microsoft can be very useful for this purpose.

JMeter Download Link
(note: I have used JMeter v 2.4)
JRE download link
Microsoft JDBC Driver for SQL Server
Performance Monitor: Control Panel\System and Security\Administrative Tools\Performance Monitor (path in Win 7)


Basic JMeter configuration breakdown:

Test Plan->Add Users(thread group)->Add JDBC requests(SQL queries)->Add JDBC connection config-> Add Listeners(to view/store test results)->Add Assertions to JDBC request(measure matrices for analyzing response)

Step 1: Put downloaded JDBC driver (sqljdbc4.jar) under "JMeter/lib/" directory.

Step 2: Creating Test Plan: I will create 20 users, each will send three SQL requests to the database server and each user will repeat sending requests four times(# of iteration). Total (20x3x4=)240 JDBC requests will be sent by 20 users. After first opening JMeter by default a empty test plan will be created with default name as "Test Plan". Give a meaningful name to your test plan relating with your objective.

Screen-shot: Test Plan

Step 3: Adding Users: Add "Thread Group" element under the test plan by right clicking on test plan->Add->Threads(Users)->Thread Group(left click). Name it like "DB users" or something meaningful. In this element I will give no. of users to be simulated at database server. Now I'll give inputs according to my test plan under section "Thread Properties":
Number of Threads (Users) : 20
Ramp-up period (seconds) : 1 (how much to delay starting each user)
Loop Count : 4 (number of iterations)

Screen-shot: Adding thread Group
Screen-shot: Configuring thread group

Step 4: Adding JDBC requests(SQL queries): Add "JDBC Request" element under thread group by right clicking on thread group->Add->Sampler->JDBC Resuest(left click). Name it with relevant to your query i.e. "Key Report->Period MAT".
Now we need to give a variable name under "Variable name bound to pool" section i.e "BI". It is used by the JDBC Sampler to identify the configuration to be used.Several different JDBC Configuration elements can be used, but they must have unique names.I will use same JDBC config for all the JDBC requests.
Now input SQL query under "Query:" section. Select your query type from the "Query Type:" drop down list. I will give queries traced by SQL Profiler, so I have given query type as "Callable Statement". For SELECT statement you should select query type as "Select Statement".
Following the above process I have created another two JDBC requests as "Key Report->Period QTR" and "Key Report-> Period YTD".

Screen-shot: Adding JDBC Request
Screen-shot:Query input

Step 5: Adding JDBC Connection Configuration: Add "JDBC Connection Configuration" element by right clicking on thread group->Add->Config Element->JDBC Connection Configuration (left click).
Now give following inputs to configure:
1. Variable Name: (Same variable name given at JDBC Request elements)
2. Maximum Number of Connecitons: 0 (if you want connection to be shared then give value more than zero)
3. Pool Timeout: 10000
4. Idle cleanup interval: 60000
5. Auto Commit: True
6. Maximum Connection Age: 5000
7. Validation query: Select 1
8. DatabaseURL: jdbc:sqlserver://(server IP);instanceName=(Instance);databaseName=(DBName)
9. JDBC Driver Class: com.microsoft.sqlserver.jdbc.SQLServerDriver
10. User Name: (SQL server access user name)
11. Password: (user's password)

Screen-shot: Adding JDBC Connection Configuration
Screen-shot: Configuring JDBC Config element

Step 6: Adding Listeners: We need to add listerners by which we will view the performance test results. For basic level of report add "Summary Report" & "View Results Tree". To be noted that listeners will use a lot of memory. I also use third party listeners named "Response time vs Threads" & "Response time over time" which can be found at http://code.google.com/p/jmeter-plugins/.

Screen-shot: Adding listener

Step 7: Adding Assertions: Assertions allow you to assert facts about responses received from the server being tested. Using an assertion, you can essentially "test" that your application is returning the results you expect it to.For this case I will add three types of assertion to each of my JDBC request & they are "Response Assertion", "Duration Assertion", "Size Assertion". Response assertion will check whether expected pattern of values are returned or not.
Duration assertion will check whether the response have taken more than expected time or not. Size assertion will check whether the response size matches with expected size.

Finally, for my objective the configurations have been been completed. All I need is to do is run the load by left clicking Run->Start or by pressing ctrl+R. After running the load view the results shown at added listeners and run "Performance Monitor" at database server PC to monitor server performance due to this load.

Screen-shot: Summary Table

Screen-shot: View Results Tree

Screen-shot: Response Time Over Time

Screen-shot: Response Time vs Threads

Screen-shot: Performance Monitor

Practical Usability Testing -> China Tour

A question to automation experts, testers, developers -> "Can you automate usability testing?"
My answer to this question is I can't, you have to have human intelligence involved in it. Exploring the user's experience and thoughts and asking questions and noting down information about as how user is using, seems to be the effective way of evaluating usability testing. Though usability testing can be structured in a various way according to needs and available resources.

The common questions I ask while doing usability testing are :

"What is it?"
"Can I use it?"
"Does it make sense?"
"Is it easily understandable to how to do it or how it is done?"
"Where am I?"
"Where can I go and can't go?"
"Why I did what I did and why I didn't do what I didn't?"
What is the most attracted thing appeared?"

How usable to tour China(Guangzhou city):

The first usability issue I faced was language barrier as I didn't know Chinese language. But then I have managed to understand most of the material's functionality through the pictures and signs printed on the materials which made me realize the usefulness of pictures and signs for understandability of functions.

This scenario can be linked to websites that is not being localized. So if there were pictures and signs along with the terms/menus/links then I think it would have more been user friendly website. From then I continue to promote to add pictures and signs along with the menus/links in the website to boost the user friendliness of the website's functions understandability.

For example if you look at the first image below, you can see a box and some label is being printed upon it but as the language was not known by me I can not understand what was the functionality of materials inside the box. But if you look at the second image, there are some signs also printed along with some Chinese texts. Now by seeing the signs I can easily understand the functionality of the materials inside the box which is "Fire Hydrant".

Other than that I have faced and experienced some interesting scenario which can be linked with some scenarios which I have faced during software usability testing.

Evaluating Boarding Pass:
This is a sample boarding pass of China Eastern airlines.

Issue 1: Passenger's name is being overlapped on the next field "BD TIME". [GUI problem]
Issue 2: The seat no. is being printed far from from the "SEAT" field. There are other similar issues.
Issue 3: The term "BD Time" means Bangladesh Time, but it would have been better if the term was written as "Departure Time". And may include the term  "BD Time" at the end of the time shown.
Issue 4: There is no " : " or " - " to separate the minutes and seconds shown at "BD Time" field.

 At Bus stoppage:

Wherever you go "Bus" seems to be the only solution as transportation for moving around the city efficiently and cheaply. But if you don't know which bus to take and where will the bus go, then it might not be the best solution. However I have managed to understand the system by looking at the boards at bus stoppage where the stoppage names are printed like below images.

Lets see how I have figured it out though I didn't know Chinese language. I used to make my hotel manager write down the destination name in chinese in a paper before I leave my hotel. Then I would show that paper to taxi driver/ bus driver/people if I get lost. But the problem was which bus to take and to understand after how many stoppage the bus will reach the destination.
If you closely analyze the stoppage names, you will see that in the horizontal list of stoppage names some are printed as red color. And vertically all red colored texts are same. The made me understand that this is name of the stoppage I am currently standing on left ones from the red stoppage name are already visited by the bus and right ones are to be visited.
Which made me realize the importance of coloring and navigational panel which we see often in the websites and sometimes we don't see as navigational panel. But a well designed navigational panel surely will improve any website's usability as the navigational panel and proper coloring would help the user understand where s/he is and after what sequence of actions s/he reached at current state of the website for backtracking and to have a sense of actions performed and for mapping out the website.

At underground Metro Station:
I found a very good example of navigational map at underground metro station where there is a word "You are here" and pointing at where you are in the map. See the image below:

At road traffic stop:
At road traffic stoppage I have seen an interesting thing which I have not seen in my country's traffic stoppage. And that is a timer is being shown at every stoppage which is indicating after how much time the red signal will become green or when green will become red. See the below video:

How many times you have seen the loading scenario when you go to a website. But there is no timer is shown to help the user estimate the time needed to load the website. Which may occupy user's valuable time starring the loading animation of that site because the user doesn't know the time needed to load. But there were timer, the user can switch to other tasks that can be done within the time left to load the website.
This traffic signal timer made me realize how can the loading scenario can be improved by adding a simple timer.

I don't bind myself to test only software. I try to test everything evolving around me. And learning through practical scenario.

Why am I blogging? ->A Self Explanation

It's been a since I haven't published any blog posts. Though I have plenty of thoughts to share but didn't feel to do it anyway. Then the questions came into my mind of why should I be doing blogging?  How can I be benefited? What is the future of this blog? What will happen if I don't blog and if I continue blog? Is blogging my hobby or passion or something I am not aware of? What should I write and what should I not?

Why should I be blogging?
--> Thoughts are created and developed in my mind and keeps other thoughts and ideas not to be developed properly until I share those thoughts with someone else. So why not share through this blog where my thoughts can be tested by others. Seems like a good idea.

How can I be benefited?
-->To be able to free up my mind to develop new thoughts and ideas properly.

What is the future of this blog?
--> I can not predict any black swan scenario but without that I see myself continuing to share my thoughts and experience through this blog.
[Black Swan->Google Blogger shutdowns :D, I am not testing anymore]

What will happen if I don't blog and if I continue blog?
--> I have seen the effect of not continuing this blog, now have to see what will happen if I continue blogging.

Is blogging my hobby or passion or something I am not aware of?
--> Well, at the mean time it seems like blogging is my necessity.

What should I write and what should I not?
--> Well, in the mean time I would like to share my testing experience and thoughts.

Purpose?
--> My experience and thoughts might help others just like I got benefited by reading blogs of others


This post is a self explanation to myself to free up my mind.

Review:- SQABD Lighting Talk 4, Held on March 31, 2010 at Washington Hotel, Dhaka

Hello all,

I know this post is a bit out-dated in perspective from the topic, but i wanted to review the talks and i thought its better late than never. I had some questions to ask but couldn't at the seminar as i am not a rapid thinker. Hmm might effect me being a rapid-tester like Sajjad vai, ;).And i was waiting for the videos to be finished uploading too. Anyway here it goes:

SQABD Lighting talk 4 review:

Talk1-Mozammel Haque
Topic title-Solo Scrum-The Pomodoro Technique
Resource-http://www.sqabd.com/lt_present.php?id=lt27

First of all thanks for introducing me to the Pomodoro technique. I wasn't aware of it till your talk that day. What i understand from your talk is that:

1. Choose a task to be accomplished
2. Set the Pomodoro to 25 minutes (the Pomodoro is the timer)
3. Work on the task until the Pomodoro time up
4. Take a short break (5 minutes is OK)
5. Every 4 Pomodoros take a longer break
6. And not to answer any IM, phone calls within this 25 min time period. And if anyone calls tell them to call after the time left in Pomodoro.

Now i think there might be some problem regarding this technique. I think this technique might be self interrupting your thinking process. What if someone is deep into something and the timer rings that your time is up and you have to concentrate after 5 minutes. Well, in that case this technique doesn't help.

In that 25 min time period, if you got call then you are already interrupted. And in these days you can not switch off your mobile, that's not logical. Its better finish your talk and fully concentrate then.

Well that's my perspective anyway. BTW liked your presentation style :).

Talk2-M Ayman Noor
Topic title- When to stop testing?
Resource-http://www.sqabd.com/lt_present.php?id=lt28

My answer is simple : until your project manager or test manager or customer says stop, you continue testing. We also have to consider the constraints and do our test plan according to that. Many time it happened to me that there were predetermined time and we planned our test process accordingly suddenly customer don't want anymore testing to be done, then we have to stop there.

In real world, testers are not in a position neither have the authority to minimize the risk, if s/he could have those we might have call ourselves QA guy not tester. And we also do not have privileges to release the product, we can only convince
our PM | TM | customer about the risks they are taking to release the product before sufficient test coverage.

Anyway thanks for asking a thoughtful question.


Talk3-Samuel D. Bretzfield
Topic title-Lighting Talks 4 keynote
Resource-http://www.sqabd.com/lt_present.php?id=lt29

Awsome work environment you have indeed. :)
hire me ...lolz. just kidding.

Talk4-Shaikh Sonny Aman
Topic title- Developing a lightweight, hi-performance and dynamic JSON api server with C.
Resource-http://www.sqabd.com/lt_present.php?id=lt30

Well i really don't like programming language "C" actually. Andi have no prior knowledge about Json either, So I should not make any comment about your talk. :)

BTW: liked your sketch though ;), and your presentation slides were fun to watch.

Talk5-Tauhidul Islam
Topic title-SQL Server Database Change Automation
Resource-http://www.sqabd.com/lt_present.php?id=lt31

Nice tool indeed. How can i get that tool you made? :)
Hope you will make that tool fully automatic from semi automatic one day/night.

BTW: I have found another tool like yours by Ewout Stortenbeker and his project name is "SQL Server database versioning with Subversion (SVN).
URL: http://www.codeproject.com/KB/database/ScriptDB4Svn.aspx

Anyway nice informative presentation.

Talk6-Zahidul Islam
Topic title: Meta Testing
Resource-http://www.sqabd.com/lt_present.php?id=lt33

Hmm Interesting name you mentioned "Meta Testing". May be its my lacking that i haven't understand what "Meta Testing" really is. You have talked about some fallacies and those are interesting way to looking at scenarios indeed.

Talk7-Abu Awal Md. Shoeb
Topic title: Challenges of a Paperless Admission System
Resource-http://www.sqabd.com/lt_present.php?id=lt32

What an inspirational work and speech my friend. Sal-lot to you and to your
co-workers. But it would have been much better if you would have been given the speech in English then I could have forward link to others from outside Bangladesh to watch this speech of yours.

Anyway i am waiting for your many more inspiration works.

Talk8-Hasin Hayder
Topic title: Bangla Input Manager JQuery Plugin
Resource-http://www.sqabd.com/lt_present.php?id=lt34

Great work man! And indeed thanks for reminding us the blessing of open source.
Phonetic Bangla uses in web pages are really great plus point in respective of usability.

BTW: Nice presentation trick :).

Talk9-Imrul Kayes
Topic title: Context driven testing(CDT)
Resource-http://www.sqabd.com/lt_present.php?id=lt35

Thanks for sharing your expertise in CDT. But the two circumstances you have mentioned where it would be difficult for us to apply, i think we the testers are facing those circumstances everyday, i.e.:
1. It is always someone beside the the tester who is responsible for ensuring quality
2. How do you determine that the context is well defined? If the context is well defined then why it would be difficult to apply CDT there??

Talk10-Golam Rabbi
Topic title: Good To Great
Resource-http://www.sqabd.com/lt_present.php?id=lt36

Inspirational speech about your success story indeed. Will sure try to discipline myself but it would be very hard ;).


Best Regards
Ashik

Weekend Testing

Weekend Testing Session No. 35
Date: Saturday 15th May 2010
Time: 3 PM – 5 PM IST GMT+05:30

At last I have participated in the weekend testing session. It was my first session.
I was very excited about it. Some how i missed when it started and joined a bit later. And at last i got time to blog about it. :)

Mission: In my view: Go to URL: http://prezi.com, explore it and make a good presentation and report that to http://www.bugrepository.com/.
The mission was simple but i think was full of traps. Like what is a good presentation ? i was answered by Ajay that good according to me. Well i was more confused and thought about what should be the good according to me? And i thought if can found some problem in it then it would make a good presentation as it seems to have some problem. [well according to me anyway.. ;)]

So I opened up my favorite tool "Perlclip" and generated 1000 long string and pasted at the name and description field. and was continuing to load screen shots in my presentation.

Finally when i tried to open that presentation my browser stopped responding!!! Well, in the end to me, i have made a good presentation. ;)

Finally thanks to the moderator for teaching me to submit my report first then start discussion and also giving me more time finish the presentation. Liked the presentation tool though it is a bit slow and made my browser crashed :).

My presentation link: http://prezi.com/vxc49kxpao9t/
bugrepository.com Bug ID: 0000308

Intra weekdays testing !!

Couldn't think of a better title than this one, sorry :|.

Couple of weeks ago I was thinking about learning testing through community based testing. Where people would come together on a particular day/night and test a random application with a common mission. Actually i was really bored of my company's projects or lack of projects, so i thought it would be nice to arrange or participate in these type of events which will help my learning curve grow (perhaps in right direction).

So, I was asking about this to local testers to know their feedback. Most of them likes the idea but from their perspective it would be impossible to arrange and continue like this event as most of us want to give time to family or friends in the weekends. Then I was suggested about "Weekendtesting.com" community by Mr. Sajjadul Hakim from the local community "SQABD.com".

I found "weekendtesting.com" community's idea very interesting and this actually can be applicable in Bangladesh also. As testers can be grouped together online and can test an app from their home. I hope someday Bangladesh chapter will be opened at "weekendtesting.com".

Before i go deep into that i thought how about i run an experiment with my colleagues with this idea. So i have decided to give them a random app and asked them to test with some limited time. I found suitable app address from "weekendtesting.com" "http://www.barcodeart.com/artwork/netart/yourself/yourself.swf", which was used in one weekend testing session. Interesting scnenario was this:

Participants: 3 newbie testers (fresher)
Time: 2 hours

I was very eager to see how those three new comers approach a problem without having no prior testing knowledge (thats the main mission for me and teach them how should they). Mission was same as was in "weekendtesting" forum: "to find out highest possible value" and "the invalid input". As this session happened in weekdays and within my company, i called it "Intra Weekdays testing".

First Tester's approach: He downloaded a bug report template and wrote down problems he found.
Second Tester's approach: She draw a table to analysis the output and input.
Third Tester's approach: He tried to explore as much as possible to find out anything about the application.

I see that combination of their approach can be called a good approach: explore+analysis+report. But they didn't seem to communicate with each other. So they failed to fulfill the mission. So this taught a big lesson for them which is team work always better.

This is an experiment to teach the freshers the way to approach a problem. Time will say whether it works or not. I will try to continue to do these type of events whenever possible. I was also influenced by the events organized by Mr. Sajjadul Hakim at his company which is in his words "we used to do short testing demonstration sessions with small apps available on the internet".

Thats all for now..

tester's mind

When God would be testing a tester, i think He will overlook issues ..... cause it's His own creation.

A tester should never be harsh to any developer in any circumstances. If you don't agree with me, try enrolling yourself in developer shoes and put your creation under test by some good testers. You will realize eventually what a developer goes through in any SDLC.

I think to build your mind as a tester mind, is a very cloudy process. As one tells you to dun say a word or write without any proof, another tells open your mind to invent test ideas. For me i think my mind is getting confused. As some time i am thinking like a proof harvester another time i am trying to apply new ideas to test. And thus my mind is constantly in parallel state. So, i guess building a tester mind is not that easy, at least for me as i have to think of family matter also. hmm so what kind of thinking process i have to apply in family matters?... no one knows i think... :).. and my mind is in continuous framework changing environment... need to read some psychological book!! Reading ebooks and finishing it is another obstacle for me as i get destructed more often and pursue something else reading or doing. Another thing is that when i try to switch my mind to do some developing projects... well my mind is in catastrophic state... :| .

A tester should be always focused on what he/she is doing or would plan to do. Keep note, keep schedule plan, make note on mobile notification, mail notification do whatever you can do reminder your self about your plan. If needed change that plan accordingly. But do keep notifying yourself. It will keep you focused. For me i am easily got distracted from what i was doing or plan to do. Some say its good some say its bad. I think its bad when you have high priority tasks to do and you want to give your 100% to that tasks. Keep notify yourself by any medium you like.

Introducing me!

Hello,

Introducing myself as (wanna be) Software Testing Engineer, Mohammad Ashik Elahi (scornik). I included "wanna be" because becoming a test engineer is not easy. It takes time, hard work, passion, eagerness and curiosity about software testing. So, if you get into a job as software test engineer and call yourself a software test engineer, i would disagree with you.

Becoming a software tester was never part of my plan. Actually i never planned my career neither my educational life. I was an average student, hope so. But been always trying out new technologies outside academic curriculum. Which is helping me in my professional career.

I got my first PC after passing S.S.C. from my father. Within one month i was able to crash it more than four times. So i guess my fate was written from there. And it was breaking things (software). So i guess my journey as a tester begin from there...

The first objective of creating this blog back at 2008 was to earn money from Google Ad-sense. But i have decided not to run for money, should run for developing my skills as a software test Engineer. Ultimately skills that will matter at the end. Also decided to share my story with you now on ;).

I think i have to end it today... :(, cause my manager just gave some work to be done. Though i had lot to say...

Any way will update my story soon..

---------------------
Mohammad Ashik Elahi A.K.A. scornik

NET SEND

Its sad that Microsoft stopped the NET SEND service. If you used it u know its lot fun if u want bug anyone ...lolz :p. This service has been stopped since release of XP service pack 2 because of security issues.

I have got this trick to enable that service again. \m/....done that in XP service pack2.
To do this, follow these steps:

1. Open Windows Explorer.
2. In the left pane, right-click My Computer, and then click Manage.
3. In the Computer Management window, expand Services and Applications in the left pane, and then click Services.
4. In the right pane, double-click Messenger.
5. In the Messenger Properties (Local Computer) dialog box, click the General tab.
6. On the General tab, select Automatic from the Startup type list, and then click Apply.
7. Under Service status, click Start, and then click OK.

now type in your cmd without the bracer [[ net send "targetted pc's ip address without qoute" "your message with qoute" ]]
Example: net send 172.30.*.* "hello"

wallah!!
note: be sure to enable service in both pc .

Buffer overflow vulnerabilty:

Buffer overflow vulnerabilty:


Stack Overflow>
If a program is written in weakly typed language such as C/C++ and/or copies from one buffer on the stack to another then it might be vulnerable to stack overflow attack.

**should avoid using "gets()".
Example>
*************************************
#include

void f(char* s) {
char buffer[10];
strcpy(buffer, s);
}

void main(void) {
f("01234567890123456789");
}

[root /tmp]# ./stacktest

Segmentation fault
************************************

Heap Overflow>
If a code is written in weakly typed language and it doesn't use canary values or capable of using executalbe stacks then it is vulnerable.

Format string vulnerablity>
By using functions such as printf, sprintf directly, or inderctly through system services.

This situation tends to become precarious on account of the fact that a user who can supply format specifiers can perform
the following malicious actions:

Enumerate Process Stack:
This allows an adversary to view stack organization of the vulnerable process by supplying format
strings, such as %x or %p, which can lead to leakage of sensitive information. It can also be used to extract canary values
when the application is protected with a stack protection mechanism. Coupled with a stack overflow, this information can
be used to bypass the stack protector.

Control Execution Flow:
This vulnerability can also facilitate arbitrary code execution since it allows writing 4 bytes of data
to an address supplied by the adversary. The specifier %n comes handy for overwriting various function pointers in memory
with address of the malicious payload. When these overwritten function pointers get called, execution passes to the
malicious code.

Denial of Service:
If the adversary is not in a position to supply malicious code for execution, the vulnerable application can
be crashed by supplying a sequence of %x followed by %n.


Example>
******************************************
#include
#include
#include
#include

void main(void) {
char str[100] = scanf("%s");
printf("%s", str);
}
*****************************************
change the last statement to printf(str) and the input like -> %08x%08x%08x%08x%08x
from this input the program can be exploited to print the first five entries from the stack.

Unicode Overflow>
written in weakly typed language, take Unicode from user, doesn't use technique as canary values to prevent buffer overflow and doesn't sanitize the input then its vulnerable to Unicode overflow.

Integer Overflow>
When an application takes two numbers of fixed word size and perform an operation with them, the result may not fit within the same word size.

Example>
****************************************
#include
#include

void main(int argc, char *argv[]) {
int i = atoi(argv[1]); // input from user
unsigned short s = i; // truncate to a short
char buf[50]; // large buffer

if (s > 10) { // check we're not greater than 10
return;
}

memcpy(buf, argv[2], i); // copy i bytes to the buffer
buf[i] = '\0'; // add a null byte to the buffer
printf("%s\n", buf); // output the buffer contents

return;
}

[root /tmp]# ./inttest 65580 foobar
Segmentation fault
***************************************

**should examine the use of signed integers, bytes and short
after airthmetic operations
**should check for exceptions if language supports.


Log Forging>
When data is entered into application from untrusted source and the data written to the app's log file then log forging is occuring.

Example>
***************************************
String val = request.getParameter("val");
try {
int value = Integer.parseInt(val);
}
catch (NumberFormatException) {
log.info("Failed to parse val = " + val);
}
output: INFO: Failed to parse val=twenty-one __ for input, twenty-one

output: INFO: Failed to parse val=twenty-one

INFO: User logged out=badguy __ for input, "twenty-one%0a%0aINFO:+User+logged+out%3dbadguy"

***************************************

Process Control>
Excecuting commands from unknown source.

Example>
*******************************************
String home = System.getProperty("APPHOME");
String cmd = home + INITCMD;
java.lang.Runtime.getRuntime().exec(cmd);

here changing the "APPHOME" syatem proeprty an attacker can insert malicious object's path to execute
--------
String btype = request.getParameter("backuptype");
String cmd = new String("cmd.exe /K
\"c:\\util\\rmanDB.bat "+btype+"&&c:\\utl\\cleanup.bat\"")
System.Runtime.getRuntime().exec(cmd);

here btype is not validdated.If an attacker passes a string of the form "&& del c:\\dbms\\*.*", then the application will execute this command along with the others specified by the program
***********************************************


Example>(Ref from owasp testing_guide)
*********************************************
void log_create(int severity, char *inpt) {
char b[1024];
if (severity == 1)
{
strcat(b,”Error occured on”);
strcat(b,":");
strcat(b,inpt);
FILE *fd = fopen ("logfile.log", "a");
fprintf(fd, "%s", b);
fclose(fd);
. . . . . .
}

in the bove code in line "strcpy(b.input)"
overflow will occur if inpt exceeds 1024 bytes.
*******************************************************


Example>(Ref from owasp testing_guide)
******************************************************
Void func(char *path)
{
char servaddr[40];
…
memccpy(servaddr,path,'\');
….
}

In the above code information in the "path" can be longer than 40 bytes before "\" character can be found. In that case stack overflow would occur.
********************************************************


Tools: RATS, Flawfinder and ITS4 are available for analyzing C-style languages.

Info Ref: http://www.owasp.org/index.php/Buffer_Overflows