GUI testing wiki
Search
Search
Dark mode
Light mode
Explorer
00 Antilibrary
blockchain
bootloader
browser fingerprinting
cache poisoning
CART (classification and regression test)
compatibility or conversion testing
configuration testing
confirmation bias
context isolation bypass
CORP (Cross-Origin Resource Policy)
cryptomining
direct manipulation (design pattern)
EDG (Event Dependency Graph)
EDoS (Economical Denial of Sustainability)
ELET (Embedded Language Encapsulation Type)
energy-based algorithm
ESI (Edge Side Includes)
Gecko engine
Gherkin
gradient boosting
HMM (Hidden Markov Model)
installation testing
Jenkins
kernel
LIFO (last in, first out)
LLM (large language model)
machine learning
man-in-the-middle attacks
micro-service architecture
Moving Target Defence
MTTR (Mean Time To Recover)
MVW (model-view-controller)
NCD (Normalized Compression Distance)
NFA (Nondeterministic Finite Automation)
OAuth
OCR (optical character recognition)
overfitting
PCA (Principal Component Analysis)
performance testing
Pitest
precise alias analysis
procedure testing
program slicing
Q-learning
recommendation engine
recovery testing
reflection (Java)
relational databases
reliability testing
RNN (recurrent neural network)
serviceability or maintenance testing
signature forgery
smuggling
social engineering
SSL (secure sockets layer)
SSRF (server-side request forgery)
standard graph matching
storage testing
stress testing
SVM (support vector machine)
TDD (test-driven development)
TLS (transport layer security)
tree difference algorithms
VM (virtual machine)
volume testing
01 Notes
ABAC (attribute based access control)
acceptance testing
access control
Acunetix
ad hoc widgets
Adobe Flash
agile development
AIF (Application Independent Functionalities)
Alloy modeling language
applet
AST (Abstract Syntax Tree)
authentication vulnerabilities
behavioral biometrics analysis
benchmark testing
BFT (business flow tampering)
black-box testing
boundary value analysis
BRF (Balance Random Forest)
brute forcing
buffer overflow
Burp Suite
C2C (client-to-client) communication
CA (covering array)
callee
callstack
canvas DOM element
CAPTCHA (Completely Automated Public Turing-test-to-tell Computers and Humans Apart)
cause-effect graphing
CDN (Content Delivery Network)
CDP (Chrome DevTools Protocol)
CFG (Control Flow Graph)
Cisco RBAC CVE
clickjacking
Co-clustering
co-evolving systems
code inspection
code obfuscation
code walkthrough
CodeCommons
COEP (Cross-Origin Embedder Policy)
COIL (Cross-Origin Image Leak)
combinatorial testing
compiler
concolic execution
content spoofing
cookie
COOP (Cross-Origin Opener Policy)
CORS (Cross-Origin Resource Sharing)
coverage criteria
cross-domain policies
CRUD (Create, Read, Update, Delete) operations
CSP (Content Security Policy)
CSRF (cross-site request forgery)
CSRF (cross-site request forgery) token
CSRH (Client-Side Request Hijacking)
CURL
CVE (common vulnerabilities and exposures)
daikon engine
data integrity
DDoS (Distributed Denial of Service)
DDT (dependency detection tool)
DEAP
decision table
design pattern
desk checking
DFS (depth-first search)
differential testing
direct graph-based logic flow analysis
directory traversal (path traversal)
Docker
Docker Hub
Docker Image
Dockerfile
dogfooding
DOM clobbering
domain
DOS (Denial of Service)
drive-by download
driver
DTA (dynamic taint analysis)
dual boot
dynamic analysis
dynamic invariants
E2E (end-to-end) testing
EAR (Execution After Redirect)
EFG (event flow graph)
EIG (event interaction graph)
ENV (environment variables)
EPM (Equivalence Partitioning Method)
error
error guessing
ESG (event sequence graph)
event models comparison
evil RegEx (Regular Expression)
fault model
Firefox extension
fitness function
flaky test
forced browsing
format string attack
framejacking
FSM (finite-state machine)
Function Variadicity
fuzzing
GA (genetic algorithm)
GEMs (GUI Element Misuse)
graph database
GUI (graphical user interface)
GUI ripper
HAR file
Honeypot
HPG (Hybrid Property Graph)
HSTS (HTTP Strict Transport Security)
HTTP eavesdropping
HTTP Response Splitting
HTTP trace collection
HTTPS (HyperText Transfer Protocol Secure
IDOR (Insecure Direct Object Reference)
IDS and IPS (intrusion detection, intrusion prevention system)
iframe injection
IIFE (immediately invoked function expression)
incremental or integration testing
IndexedDB
Instrumentation
integration testing
integration tree
Iroh.js
JEA (Just-Enough-Access) principle
JIT (Just-in-time) principle
JSON Hijacking Prevention tokens
JSON-LD (linked data)
JWT (JSON Web Token)
keylogging
KNN (K-Nearest Neighbors)
KS (Kolmogorov-Smirnov) test
Linux distribution
LM (word n-gram language model)
LoC
logic coverage testing
logic vulnerability
logic workflow bypass
LTS (Leaning Toothpick Syndrome)
Malai
Markov’s chain and clickstream analysis
Memento (design pattern)
mental model
MF (Micro-Frontend) architecture
MiTB (man-in-the-browser) attack
MiTM (man-in-the-middle) attack
Monkey patching
mono-event interaction
MT (metamorphic testing)
multi-event interactions
multi-modal fusion
multi-modal interactions
Mutation testing
NAS (Network Attached Storage)
negative testing
non-incremental (big-bang) unit testing
noVNC
object storage service
OpenID
OSV (open source vulnerabilities)
OWASP (Open Web Application Security Project)
OWASP Top 10 (2021)
Parallel programming
parameter tampering
paywalls
PDO
peer rating
penetration test
phishing
pixel stealing
POLA (Principle Of Least Astonishment)
PoLP (principle of least privilege)
port
positive testing
Post-WIMP
prefix tree
privacy
prolog (programming language)
prototype pollution
prototype pollution gadgets
proxy object
proxy server
PWA (progressive web application)
QR-code
radians
random forest
RBAC (role-based access control)
RCE (Remote Code Execution)
redirect attack
ReDos (Regular Expression Denial of Service)
RegEx (Regular Expression)
regression testing
reverse proxy
RL (Reinforcement Learning)
RSS (RDF Site Summary)
SameSite cookie
sandbox environment
security testing
SELinux (Security-Enhanced Linux)
session hijacking
session puzzling
sessions token
SH (Software Heritage)
sine and cosine
sink function
SLR (systematic literature review)
SOP (Same-Origin Policy)
SQL signature
SQLIA (SQL injection attack)
SSIM (Structural Similarity Index Method)
SSRF (Server Side Request Forgery)
STA (static taint analysis)
standard widgets
static analysis
static invariants
string validation
stub
subgraph isomorphism
supervised learning
SUT (system under test)
SW (Service Worker)
symbolic execution
systematic testing
tabnabbing
taxonomy
test amplification
test oracle
testbed environment
timing attack
top-level navigation
trojan horse
typosquatting
UIDL (User Interface Description Language)
UML (Unified Modeling Language)
unit testing
URL validation
usability testing
WAF (web application firewall)
web security
web server misconfiguration
Web Storage API (localStorage, sessionStorage)
white-box testing
WIMP (windows, icon, menu, pointers)
WSH (Web Socket Hijack)
WSL (Windows Subsystem for Linux)
WW (Web Worker)
WW (Web Worker) and SW (Service Worker) comparison
XCS (Cross Channel Scripting)
XSF (Cross-site Framing)
XSS (cross site scripting)
XSS and CSFR comparison
XXE (XML external entities)
zero-day vulnerability
02 Literature
books
JavaScript, The Good Parts
chapters
02 Grammar
03 Objects
04 Functions
06 Arrays
09 Style
JavaScript, The Good Parts
The art of software testing
chapters
01-02 Self-assessment test, psychology and economics of software testing
03 Program Inspections, walkthroughs and reviews
04 Test-case Design
05 Module (Unit) Testing
06 Higher-Order Testing
07 Usability (User) Testing
08 Debugging
09 Testing in the Agile Environment
10 Testing Internet Applications
11 Mobile Application Testing
The art of software testing
The Basic of Web Hacking
chapters
5. Web Application Exploitation with Broken Authentication and Path Traversal
The Basic of Web Hacking. Tools and Techniques to Attack the Web
Web application security
chapters
16. Client-Side Attacks
Web application security
papers
authentication
A Supervised Learning Approach to Protect Client Authentication on the Web
Reliable protection against session fixation attacks
Systematically breaking and fixing OpenID security. Formal analysis, semi-automated empirical evaluation, and practical countermeasures
behavioral biometrics
User Profiling Using Sequential Mining Over Web Elements
browser security
Experimental Security Analysis of Sensitive Data Access by Browser Extensions
SandFOX. secure sandboxed and isolated environment for Firefox browser
Sentinel. Securing legacy firefox extensions
buffer overflow
An Empirical Study on Detecting and Fixing Buffer Overflow Bugs
clickjacking
A solution for the automated detection of clickjacking attacks
Clickjacking. Existing defenses and some novel approaches
Frametrapping the framebusting defence
ProClick. a framework for testing clickjacking attacks in web applications
Security assessment of clickjacking risks in web applications. metrics based approach
Tricking Johnny into Granting Web Permissions
Vulnerability Analysis of Iframe Attacks on Websites
client-side storage
An investigation into possible attacks on HTML5 indexedDB and their prevention
Analysis of privacy and security in HTML5 web storage
Decrypting IndexedDB in private mode of Gecko-based browsers
NoteLocker. Simple Secure Storage Service
Security of CORS on LocalStorage
The role of HTML5 IndexedDB, the past, present and future
cloud control interface (CCI)
How Private is Your Private Cloud. Security Analysis of Cloud Control Interfaces
CMS (Content Management System)
Comparative analysis of web security in open source content management system
code synthesis
WAVES. Automatic Synthesis of Client-Side Validation Code for Web Applications
cookies
Accept All Exploits. Exploring the Security Impact of Cookie Banners
Quite a mess in my cookie jar! leveraging machine learning to protect web authentication
Cross-Site Framing (CSF)
Cross-Site Framing Attacks
cryptography
A Comparison of Online JavaScript Obfuscators
CSRF (Cross Site Request Forgery)
A server and browser transparent CSRF defense for web 2.0 applications
Assessment of vulnerabilities of web applications of Bangladesh. A case study of XSS and CSRF
Browser protection against cross-site request forgery
Client-Side Detection of Cross-Site Request Forgery Attacks
CsFire. Transparent client-side mitigation of malicious cross-domain requests
CSRF Detection Based on Graph Data Mining
Enhancing Web Security. A Comparative Analysis of Machine Learning Models for CSRF Detection
Honey, I Cached our Security Tokens Re-usage of Security Tokens in the Wild
Mitch. A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities
Scenario-Based Cross-Site Request Forgery (CSRF) Attack Simulation
The Great Request Robbery. An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web
The state of HTTP declarative security in online banking websites
CSS (Cascading Style Sheets)
Cross-origin pixel stealing. Timing attacks using CSS filters
dependency-related vulnerabilities
Managing security vulnerabilities introduced by dependencies in React.js
DOM clobbering
It’s (DOM) Clobbering Time. Attack Techniques, Prevalence, and Defenses
dynamic taint analysis
Augur. Dynamic Taint Analysis for Asynchronous JavaScript
HTTP traffic analysis
A survey. Cloud hosted website protection using soft computing techniques
A Traffic Monitoring and Policy Enforcement Framework for HTTP
Cross-domain vulnerabilities over social networks
Machine Learning Based Web Application Plugin for Threat Detection and IP Analysis
Reining in the web with content security policy
input validation
Bypass testing of web applications
Runtime Input Validation for Java Web Applications using Static Bytecode Instrumentation
ZigZag. Automatically hardening web applications against client-side validation vulnerabilities
intrusion recovery
Intrusion recovery for database-backed web applications
Runtime recovery of web applications under zero-days ReDoS attacks
JavaScript instrumentation
VisibleV8. In-browser Monitoring of JavaScript in the Wild
JWT (JSON Web Token)
JSON Web Token Penetration Testing on Cookie Storage with CSRF Techniques
logic flow tampering
BFTDETECTOR. Automatic detection of business flow tampering for digital content service
BLOCK. a black-box approach for detection of state violation attacks towards web applications
DetLogic. A black-box approach for detecting logic vulnerabilities in web applications
Finding client-side business flow tampering vulnerabilities
From Hindsight to Foresight. Enhancing Design Artifacts for Business Logic Flaw Discovery
Hidden GEMS. Automated discovery of Access Control Vulnerabilities in Graphical User Interfaces
IVD. Automatic Learning and Enforcement of Authorization Rules in Online Social Networks
Keeping out the masses. Understanding the popularity and implications of internet paywalls
LogicScope. automatic discovery of logic vulnerabilities within web applications
On the misuse of Graphical User Interface elements to implement security controls
Patching Logic Vulnerabilities for Web Applications using LogicPatcher
Requirements for preventing logic flaws in the authentication procedure of web applications
Toward black-box detection of logic flaws in web applications
Verification of Web Content Integrity. A new approach to protecting servers against tampering
mobile front-end testing
A GUI-based metamorphic testing technique for detecting authentication vulnerabilities in Android mobile apps
Mining Android App Usages for Generating Actionable GUI-based Execution Scenarios
object storage (blob storage)
Do Not Trust the Clouds Easily. The Insecurity of Content Security Policy Based on Object Storage
parameter tampering
A Novel Approach for Message Authentication to Prevent Parameter Tampering Attack in Web Applications
Automating the Detection of Access Control Vulnerabilities in Web Applications
No tamper. Automatic black-box detection of parameter tampering opportunities in Web Applications
TamperProof. a server-agnostic defense for parameter tampering attacks on web applications
WAPTEC. whitebox analysis of web applications for parameter tampering exploit construction
philosophy of science, meta-analysis
(Re)considering the Concept of Literature Review Reproducibility
phishing
PhishCatcher. Client-Side Defense Against Web Spoofing Attacks Using Machine Learning
privacy
Apathy, convenience or irrelevance. Identifying conceptual barriers to safeguarding children’s data privacy
program repair
Automatic program repair
prototype pollution
A Multivocal Literature Review on Prototype Pollution Vulnerability
Detecting prototype pollution for node.js. Vulnerability review and new fuzzing inputs
Follow My Flow. Unveiling Client-Side Prototype Pollution Gadgets from One Million Real-World Websites
On Detecting and Measuring Exploitable JavaScript Functions in Real-world Applications
Undefined-oriented Programming. Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences
QR-code exploitation
Malicious QR-code threats and vulnerability of blockchain
redirect vulnerability
EARs in the wild. large-scale analysis of execution after redirect vulnerabilities
Fear the EAR. discovering and mitigating execution after redirect vulnerabilities
Malicious hidden redirect attack web page detection based on CSS features
server configuration
Confeagle. Automated Analysis of Configuration Vulnerabilities in Web Applications
service worker vulnerabilities
A Survey on Vulnerabilities of Service Workers
Categorizing service worker attacks and mitigations
The Service Worker Hiding in Your Browser. The Next Web Attack Target.
software architecture
Micro-frontends. Principles, implementations and pitfalls
software co-evolution
Untangling Spaghetti of Evolutions in Software Histories to Identify Code and Test Co-evolutions
software models
A Grey-Box Approach for Detecting Malicious User Interactions in Web Applications
Automatically inferring user behavior models in large-scale web applications
On model-based testing advanced GUIs
Testing is an Event-Centric Activity
SQLIA (SQL Injection Attack)
An effective method for preventing SQL injection attack and session hijacking
Minimization of SQL injection in scheduling application development
SENTINEL. securing database from logic flaws in web applications
SQLIA detection techniques
tabnabbing
Detecting Tabnabbing Attacks Via An RL-Based Agent
NoTabNab. Protection against the “tabnabbing attack”
TabShots. client-side detection of tabnabbing attacks
testing enhancements
A snowballing literature study on test amplification
An Empirical Analysis of UI-Based Flaky Tests
Augusto. Exploiting popular functionalities for the generation of semantic GUI tests with Oracles
AutoInSpec, using missing test coverage to improve specifications in GUIs
Coverage criteria for GUI testing
Lightweight Static Analysis for GUI testing
Mutta. A novel tool for E2E web mutation testing
Repairing GUI Test Suites Using a Genetic Algorithm
STILE, a tool for optimizing E2E web test scripts parallelization
What All the PHUZZ Is About. A Coverage-guided Fuzzer for Finding Vulnerabilities in PHP Web Applications
UI and UX issues
A taxonomy of testable HTML5 Canvas Issues
Classifying and qualifying GUI defects
Dirty clicks. A study of the Usability and Security Implications of Click-related Behaviors on the Web
Home and away. UI design pattern for supporting end-user security
JANUS. Detecting rendering bugs in Web Browsers via Visual Delta Consistency
Out of Sight, Out of Mind. UI Design and the Inhibition of Mental Models of Security
vulnerability management
Demo. Large Scale Analysis on Vulnerability Remediation in Open-Source JavaScript projects
WAF (Web Application Firewall)
Adaptive Web Application Firewall for Multi-Threat Detection
web vulnerabilities reviews
A systematic review and taxonomy of web applications threats
A Taxonomy of Web Security Vulnerabilities
Common vulnerabilities in real world web applications
Enhancing Front-End Security. Protecting User Data and Privacy in Web Applications
Navigating web application security. A survey of vulnerabilities and detection solutions
Security of Web Application. State of the Art
Towards a formal foundation of web security
Web application attacks
XCS (Cross Channel Scripting)
XCS. Cross Channel Scripting and its impact on web applications
XSS (Cross-Site Scripting)
A survey of detection methods for XSS attacks
Automated removal of cross site scripting vulnerabilities in web applications
mXSS attacks. attacking well-secured web-applications by using innerHTML mutations
On Security Issues in Web Applications through Cross Site Scripting (XSS)
Scriptless attacks. Stealing the pie without touching the sill
WAVE. Black Box Detection of XSS, CSRF and Information Leakage Vulnerabilities
03 References
(Aditya Sood, Richard Enbody, et al., 2011)
(Ahmed, Altamimi, et al., 2023)
(Akhawe, Barth, et al., 2010)
(Al-Kahla, Shatnawi, Taqieddin, 2021)
(Aldrich, Turcotte, et al., 2023)
(Amalfitano, Misael, et al., 2025)
(Anastasia, Stamatia, 2024)
(Arlt, Podelski, Bertolini, et al., 2012)
(Asish Kumar Dalai, Saroj Kumar Panigrahy, et al., 2012)
(Averin, 2020)
(Bai, Wang, Zhu, et al., 2021)
(Balduzzi, Egele, et al., 2010)
(Bandara, Rathnayake, et al., 2021)
(Basu, et al., 2024)
(Belli, Beyazit, Memon, 2012)
(Ben Jaballah, Kheir, et al., 2016)
(Bernard, Debar, et al., 2012)
(Bhingarkar, Shah, et al., 2017)
(Bisht, Hinrichs, et al., 2011)
(Bisht, Hinrichs, Skrupsky, et al., 2010)
(Bochmann, Das, Dssouli, 1991)
(Bojinov, Bursztein, et al., 2009)
(Calzavara, Conti, et al., 2019)
(Calzavara, Tolomei, et al., 2014)
(Calzavara, Tolomei, et al., 2015)
(Chanakya, Spoorthi, et al., 2024)
(Chandra, Kim, et al., 2011)
(Cheh, Tay, et al., 2022)
(Chen, Shi, 2018)
(Chinprutthiwong, Vardhan, et al., 2021)
(Cho, Kim, et al., 2016)
(Cohen, Myra B., et al., 2012)
(Cram, 2020)
(Crockford, 2008)
(D'silva, Vanajakshi, et al., 2017)
(Danglot, Vera-Perez, Yu, et al., 2019)
(Darmawan, Karim, et al., 2021)
(De Ryck, Desmet, et al., 2010)
(De Ryck, Nikiforakis, et al., 2013)
(Deepa, Thilagam, et al., 2018)
(Dilavrec, Khelladi, Blouin, et al., 2021)
(Doupe, Boe, et al., 2011)
(Eshete, Villafiorita, et al., 2013)
(Farah, Shojol, et al., 2016)
(Felsch, Heiderich, et al., 2015)
(Fonseka, Pashenna, et al., 2023)
(Gelernter, Grinstein, et al., 2015)
(Goues, Claire, Pradel et al., 2021)
(Hakim, 2023)
(Hazhirpasand, 2020)
(Heiderich, Niemietz, et al., 2012)
(Heiderich, Schwenk, et al., 2013)
(Hoffman, 2024)
(Huang, Cohen, Memon, 2010)
(Isatou, Abu Bakar, et al., 2015)
(Jeong, Hur, 2022)
(Johns, Braun, et al., 2011)
(Jueckstock, Kapravelos, et al., 2019)
(Kang, Lyu, et al., 2024)
(Katulanda, Henaka Arachchi, et al., 2023)
(Kaur, Tiwari, 2023)
(Keen, 2022)
(Khodayari, Barber, et al., 2024)
(Khodayari, Pellegrino, 2023)
(Kim, Lee, et al., 2024)
(Kim, Wang, Kwon, et al., 2023)
(Kim, Zheng, Park, et al., 2020)
(Kimak, Ellman, et al., 2012)
(Kimak, Ellman, et al., 2015)
(Klein, Musch, et al., 2022)
(Kluban, Mannan, et al., 2024)
(Kotcher, Pei, Jumde, et al., 2013)
(Kratky, Chuda, 2018)
(Krishnaraj, Madaan, et al., 2023)
(Le, Huu-Tung, Pham, et al., 2019)
(Lelli, Blouin, Baudry, 2015a)
(Lelli, Blouin, Baudry, 2015b)
(Leotta, Paparella, Ricca, 2024)
(Levi, Hazan, et al., 2019)
(Li, Xie, 2023)
(Li, Xue, et al., 2011)
(Li, Xue, et al., 2013)
(Li, Yan, et al., 2012)
(Linares-Vasquez, White, et al., 2018)
(Liu, An, et al., 2024)
(Liu, Shen, et al., 2020)
(Lv, Shi, et al., 2023)
(Macklon, Viggiato, Markos, et al., 2023)
(Maes, Heyman, et al., 2009)
(Maheshwari, Nayak, et al., 2024)
(Malviya, Saurav, et al., 2013)
(Mariani, Leonardo, et al., 2018)
(Marinescu, Parry, et al., 2017)
(Memon, Banerjee, Ishan, et al., 2003)
(Memon, Soffa, Mary, Pollack, 2001)
(Mohammed, Alkhathami, et al., 2021)
(Monshizadeh, Naldurg, et al., 2016)
(Mulliner, Robertson, Kirda, 2014)
(Mulliner, Robertson, Kirda, 2017)
(Muraleedharan, Thomas, et al., 2020)
(Myers et al., 2011)
(Nayak, Khandelwal, et al., 2024)
(Ndiaye, Barais, et al., 2019)
(Neef, Kleissner, et al., 2024)
(Nidhra, Dondeti, 2012)
(Offutt, Wu, Du, 2004)
(Olianas, Leotta, Ricca, et al., 2024)
(Onarlioglu, Buyukkayhan, et al., 2015)
(Onukrane, Skrodelis, et al., 2023)
(Papadopoulos, Snyder, et al., 2020)
(Patel, Rathod, et al., 2013)
(Pauli, 2013)
(Payet, Doupe, et al., 2013)
(Pelizzi, Sekar, et al., 2011)
(Pellegrino, Balzarotti, 2014)
(Peng Zhou, Yuhan Gao, et al., 2024)
(Ramadan, Osama, et al., 2024)
(Rauti, Leppänen, 2018)
(Rennhard, Kushnir, et al., 2022)
(Romano, Song, et al., 2021)
(Sadqi, Maleh, 2022)
(Saeedeh Sadat et al., 2022)
(Saini, Gaur, et al., 2015)
(Saleh, Malkawi, et al., 2024)
(Samudio, LaToza, 2022)
(Sanchez, 2020)
(Selim, Tayeb, et al., 2016)
(Sendiang, Polii, et al., 2016)
(Shahriar, Devendran, et al., 2013)
(Shahriar, Haddad, et al., 2015)
(Shahriar, Zulkernine, et al., 2010)
(Shar, Tan, et al., 2012)
(Sinha, Uppal, et al., 2014)
(Skrupsky, Bisht, et al., 2013)
(Skrupsky, Monshizadeh, et al., 2012)
(Solano, Camacho, et al., 2021)
(Soleimani, Hadavi, et al., 2017)
(Sood, Enbody, et al., 2011)
(Spero, Biddle, 2020)
(Spero, Biddle, 2021)
(Stamm, Sterne, et al., 2010)
(Subramani, Jueckstock, et al., 2021)
(Sun, Hawkey, et al., 2012)
(Sushma, Jayalakshmi, et al., 2022)
(Taibi, Mezzalira, 2022)
(Tkachenko et al., 2024)
(Trampert, Stock, et al., 2023)
(Unlu, Bicakci, et al., 2010)
(Upasana Sarmah, D.K. Bhattacharyya, et al., 2018)
(Ur Rehman, Nazir, Mustafa, 2017)
(Viticchie, Basile, Avancini, et al., 2016)
(Watson, 2007)
(Wei, Ryder, 2013)
(Weissbacher, Robertson, et al., 2015)
(West, Pulimood, et al., 2012)
(Williams, Vo, et al., 2019)
(Xu, Ni, Ming, et al., 2024)
(Ye, Zhang, Wang et al., 2016)
(Zaris, Gjermundrød, et al., 2014)
(Zhou, Zhang, Qian, et al., 2024)
(Zhu, 2021)
06 Courses, webinars
FLE French Course
French Course 03-11-2025
French Course 03-18-2025
French Course 04-01-2025
French Course 04-08-2025
French Course 04-15-2025
French Course 05-13-2025
Code Generation
DevOps in declarative reconfigurations
Ethics in research. How to make your research more visible
Exploring the Intersections Between Law, Design and Computer Science in Privacy and Data Protection
First steps with Zotero
Introduction to Abaca (Inria compute cluster)
Supporting Metamodel and code co-evolution
Taming Large Language Models
The publishing trap
Towards Autonomous Test Agent
Visual Software QA (Quality Assurance) using VLM (Vision Language Models)
96 Meta
SLR
Paper list
Tags analysis
PhD status
References analysis
98 Templates
Temp_Definition
Temp_Literature
Temp_Reference
Temp_Webinars
Home
❯
01 Notes
Folder: 01-Notes
256 items under this folder.
Jun 27, 2025
test amplification
definition
testAmplification
Jun 27, 2025
test oracle
definition
testingTechniques
Jun 27, 2025
testbed environment
definition
testingTechniques
Jun 27, 2025
timing attack
definition
cyberSecurity
timingAttack
Jun 27, 2025
top-level navigation
definition
Jun 27, 2025
trojan horse
definition
cyberSecurity
Jun 27, 2025
typosquatting
definition
Jun 27, 2025
unit testing
definition
testingTechniques
codeAnalysis
whiteBox
Jun 27, 2025
usability testing
definition
blackBox
testingTechniques
Jun 27, 2025
web security
definition
Jun 27, 2025
web server misconfiguration
definition
OWASP
cyberSecurity
webApplication
Jun 27, 2025
white-box testing
definition
testingTechniques
whiteBox
Jun 27, 2025
zero-day vulnerability
definition
cyberSecurity
Jun 27, 2025
multi-modal fusion
definition
multiModal
GUI
Jun 27, 2025
multi-modal interactions
definition
Jun 27, 2025
negative testing
definition
testingTechniques
Jun 27, 2025
noVNC
definition
Jun 27, 2025
non-incremental (big-bang) unit testing
definition
whiteBox
testingTechniques
Jun 27, 2025
object storage service
definition
objectStorage
cloudSecurity
cloudComputing
Jun 27, 2025
parameter tampering
definition
parameterTampering
logicVulnerability
HTTP
Jun 27, 2025
paywalls
definition
paywalls
Jun 27, 2025
peer rating
definition
whiteBox
testingTechniques
Jun 27, 2025
penetration test
definition
cyberSecurity
penTest
penetrationTesting
Jun 27, 2025
phishing
definition
cyberSecurity
clientSideAttacks
webApplication
Jun 27, 2025
pixel stealing
definition
pixelStealing
timingAttack
Jun 27, 2025
port
definition
port
network
Jun 27, 2025
positive testing
definition
testingTechniques
Jun 27, 2025
prefix tree
definition
softwareEngineering
dataStructure
Jun 27, 2025
privacy
definition
philosophy
privacy
Jun 27, 2025
prolog (programming language)
definition
programmingLanguage
Jun 27, 2025
prototype pollution gadgets
definition
prototypePollution
gadget
Jun 27, 2025
prototype pollution
definition
JavaScript
programmingLanguage
cyberSecurity
prototypePollution
Jun 27, 2025
proxy object
definition
softwareEngineering
Jun 27, 2025
proxy server
definition
network
clientDefense
Jun 27, 2025
radians
definition
math
Jun 27, 2025
random forest
definition
machineLearning
classifier
supervisedLearning
Jun 27, 2025
redirect attack
definition
redirectAttack
cyberSecurity
Jun 27, 2025
regression testing
definition
testingTechniques
Jun 27, 2025
reverse proxy
definition
network
Jun 27, 2025
sandbox environment
definition
designPattern
Jun 27, 2025
security testing
definition
cyberSecurity
testingTechniques
Jun 27, 2025
session hijacking
definition
cyberSecurity
clientSideAttacks
Jun 27, 2025
session puzzling
definition
Jun 27, 2025
sessions token
definition
cyberSecurity
Jun 27, 2025
sine and cosine
definition
math
Jun 27, 2025
sink function
definition
cyberSecurity
sink
Jun 27, 2025
standard widgets
definition
GUI
visualTesting
Jun 27, 2025
static analysis
definition
codeAnalysis
AST
RegEx
Jun 27, 2025
static invariants
definition
codeAnalysis
softwareEngineering
Jun 27, 2025
string validation
inputValidation
cyberSecurity
clientSideAttacks
GUI
JavaScript
Jun 27, 2025
stub
definition
Jun 27, 2025
subgraph isomorphism
definition
Jun 27, 2025
supervised learning
definition
machineLearning
Jun 27, 2025
symbolic execution
definition
softwareEngineering
symbolicExecution
Jun 27, 2025
systematic testing
definition
testingTechniques
softwareEngineering
Jun 27, 2025
tabnabbing
definition
clientSideAttacks
cyberSecurity
GUI
tabnabbing
Jun 27, 2025
taxonomy
definition
Jun 27, 2025
fuzzing
definition
testingTechniques
fuzzing
Jun 27, 2025
graph database
definition
graphModel
graphDatabase
Jun 27, 2025
iframe injection
definition
XSS
iframe
Jun 27, 2025
incremental or integration testing
definition
whiteBox
testingTechniques
Jun 27, 2025
integration testing
definition
testingTechniques
Jun 27, 2025
integration tree
definition
testingTechniques
Jun 27, 2025
keylogging
definition
cyberSecurity
clientSideAttacks
Jun 27, 2025
logic coverage testing
definition
whiteBox
testingTechniques
Jun 27, 2025
logic vulnerability
definition
businessFlowTampering
logicVulnerability
Jun 27, 2025
logic workflow bypass
definition
clientSideAttacks
webApplication
Jun 27, 2025
mental model
definition
cognitivePsychology
Jun 27, 2025
mono-event interaction
definition
GUI
Jun 27, 2025
multi-event interactions
definition
GUI
Jun 27, 2025
SH (Software Heritage)
definition
tool
Jun 27, 2025
SLR (systematic literature review)
definition
scientificMethods
Jun 27, 2025
SOP (Same-Origin Policy)
definition
crossDomainPolicy
SOP
Jun 27, 2025
SQL signature
definition
SQL
SQLIA
Jun 27, 2025
SQLIA (SQL injection attack)
definition
cyberSecurity
SQLIA
SQL
Jun 27, 2025
SSIM (Structural Similarity Index Method)
definition
regressionTesting
softwareEngineering
imageComparison
Jun 27, 2025
SSRF (Server Side Request Forgery)
definition
cyberSecurity
Jun 27, 2025
STA (static taint analysis)
definition
softwareEngineering
codeAnalysis
Jun 27, 2025
SUT (system under test)
definition
Jun 27, 2025
SW (Service Worker)
definition
parallelComputing
serviceWorker
JavaScript
Jun 27, 2025
SameSite cookie
definition
cyberSecurity
cookie
webApplication
Jun 27, 2025
UIDL (User Interface Description Language)
definition
softwareEngineering
GUI
Jun 27, 2025
UML (Unified Modeling Language)
definition
softwareEngineering
Jun 27, 2025
URL validation
definition
URL
Jun 27, 2025
WAF (web application firewall)
paper
cyberSecurity
attackMitigation
WAF
Jun 27, 2025
WIMP (windows, icon, menu, pointers)
GUI
definition
Jun 27, 2025
WSH (Web Socket Hijack)
definition
clientSideAttacks
Jun 27, 2025
WSL (Windows Subsystem for Linux)
linux
WSL
OS
tool
Jun 27, 2025
WW (Web Worker) and SW (Service Worker) comparison
definition
serviceWorker
webWorker
parallelComputing
JavaScript
Jun 27, 2025
WW (Web Worker)
definition
parallelComputing
network
JavaScript
Jun 27, 2025
Web Storage API (localStorage, sessionStorage)
definition
clientStorage
Jun 27, 2025
XCS (Cross Channel Scripting)
definition
XSS
XCS
Jun 27, 2025
XSF (Cross-site Framing)
definition
crossSiteFraming
clientSideAttacks
webApplication
Jun 27, 2025
XSS (cross site scripting)
definition
cyberSecurity
XSS
clientSideAttacks
webApplication
Jun 27, 2025
XSS and CSFR comparison
definition
cyberSecurity
clientSideAttacks
comparison
Jun 27, 2025
XXE (XML external entities)
definition
XXE
Jun 27, 2025
acceptance testing
definition
testingTechniques
Jun 27, 2025
access control
definition
OWASP
accessControl
Jun 27, 2025
ad hoc widgets
definition
UIwidget
Jun 27, 2025
agile development
definition
softwareEngineering
Jun 27, 2025
applet
definition
Jun 27, 2025
authentication vulnerabilities
definition
cyberSecurity
authentication
Jun 27, 2025
behavioral biometrics analysis
definition
biometric
behavioralBiometric
userModels
authentication
Jun 27, 2025
benchmark testing
definition
testingTechniques
softwareEngineering
Jun 27, 2025
black-box testing
definition
testingTechniques
blackBox
Jun 27, 2025
boundary value analysis
definition
testingTechniques
blackBox
Jun 27, 2025
brute forcing
definition
cyberSecurity
cyberAttack
cryptography
Jun 27, 2025
buffer overflow
definition
cyberSecurity
bufferOverflow
Jun 27, 2025
callee
definition
softwareEngineering
Jun 27, 2025
callstack
definition
softwareEngineering
Jun 27, 2025
canvas DOM element
definition
HTML
Jun 27, 2025
cause-effect graphing
definition
testingTechniques
blackBox
Jun 27, 2025
clickjacking
definition
clientSideAttacks
cyberSecurity
GUI
Jun 27, 2025
co-evolving systems
definition
coevolvingSystems
Jun 27, 2025
code inspection
definition
whiteBox
testingTechniques
Jun 27, 2025
code obfuscation
definition
softwareEngineering
Jun 27, 2025
code walkthrough
definition
whiteBox
testingTechniques
Jun 27, 2025
combinatorial testing
definition
math
Jun 27, 2025
compiler
definition
softwareEngineering
Jun 27, 2025
concolic execution
definition
testingTechniques
softwareEngineering
concolicExecution
Jun 27, 2025
content spoofing
definition
cyberSecurity
Jun 27, 2025
cookie
definition
clientStorage
Jun 27, 2025
coverage criteria
definition
testingTechniques
whiteBox
Jun 27, 2025
cross-domain policies
definition
cyberSecurity
clientDefense
crossDomainPolicy
Jun 27, 2025
daikon engine
definition
softwareEngineering
Jun 27, 2025
data integrity
definition
Jun 27, 2025
decision table
definition
softwareEngineering
blackBox
Jun 27, 2025
design pattern
definition
algorithm
designPattern
Jun 27, 2025
desk checking
definition
whiteBox
testingTechniques
Jun 27, 2025
differential testing
paper
webApplication
testingTechniques
visualTesting
Jun 27, 2025
direct graph-based logic flow analysis
definition
businessFlowTampering
softwareEngineering
algorithm
Jun 27, 2025
directory traversal (path traversal)
definition
clientSideAttacks
accessControl
directoryTraversal
pathTraversal
Jun 27, 2025
dogfooding
definition
softwareEngineering
Jun 27, 2025
domain
definition
Jun 27, 2025
drive-by download
definition
cyberSecurity
GUI
Jun 27, 2025
driver
definition
Jun 27, 2025
dual boot
definition
OS
Jun 27, 2025
dynamic analysis
definition
testingTechniques
codeAnalysis
Jun 27, 2025
dynamic invariants
definition
codeAnalysis
softwareEngineering
Jun 27, 2025
error guessing
definition
testingTechniques
blackBox
Jun 27, 2025
error
definition
Jun 27, 2025
event models comparison
definition
eventModel
graphModel
Jun 27, 2025
evil RegEx (Regular Expression)
definition
cyberSecurity
Jun 27, 2025
fault model
definition
softwareModel
Jun 27, 2025
fitness function
definition
Jun 27, 2025
flaky test
definition
visualTesting
Jun 27, 2025
forced browsing
definition
clientSideAttacks
accessControl
forcedBrowsing
Jun 27, 2025
format string attack
definition
cyberAttack
cyberSecurity
formatString
Jun 27, 2025
framejacking
definition
clientSideAttacks
cyberSecurity
webApplication
Jun 27, 2025
COOP (Cross-Origin Opener Policy)
definition
crossDomainPolicy
COOP
attackMitigation
Jun 27, 2025
CORS (Cross-Origin Resource Sharing)
definition
cyberSecurity
CORS
crossDomainPolicy
attackMitigation
Jun 27, 2025
CRUD (Create, Read, Update, Delete) operations
definition
Jun 27, 2025
CSP (Content Security Policy)
definition
cyberSecurity
crossDomainPolicy
attackMitigation
Jun 27, 2025
CSRF (cross-site request forgery) token
definition
CSFR
cyberSecurity
attackMitigation
Jun 27, 2025
CSRF (cross-site request forgery)
definition
cyberSecurity
clientSideAttacks
CSFR
Jun 27, 2025
CSRH (Client-Side Request Hijacking)
definition
CSRH
CSFR
Jun 27, 2025
CURL
definition
Jun 27, 2025
CVE (common vulnerabilities and exposures)
cyberSecurity
CVE
Jun 27, 2025
Cisco RBAC CVE
definition
cyberSecurity
CVE
Jun 27, 2025
Co-clustering
definition
unsupervisedLearning
Jun 27, 2025
CodeCommons
definition
machineLearning
Jun 27, 2025
DDT (dependency detection tool)
definition
Jun 27, 2025
DDoS (Distributed Denial of Service)
definition
cyberSecurity
DoS
Jun 27, 2025
DEAP
definition
tool
geneticAlgorithm
python
Jun 27, 2025
DFS (depth-first search)
definition
algorithm
softwareEngineering
Jun 27, 2025
DOM clobbering
definition
clientSideAttacks
cyberSecurity
businessFlowTampering
Jun 27, 2025
DOS (Denial of Service)
definition
cyberSecurity
DoS
Jun 27, 2025
DTA (dynamic taint analysis)
definition
softwareEngineering
codeAnalysis
dynamicAnalysis
taintAnalysis
Jun 27, 2025
Docker Hub
definition
deploy
CI
CD
Jun 27, 2025
Docker Image
deploy
definition
CI
CD
Jun 27, 2025
Docker
definition
deploy
docker
CI
CD
Jun 27, 2025
Dockerfile
definition
deploy
CI
CD
Jun 27, 2025
E2E (end-to-end) testing
definition
E2E
testingTechniques
Jun 27, 2025
EAR (Execution After Redirect)
definition
redirectAttack
EAR
Jun 27, 2025
EFG (event flow graph)
definition
testingTechniques
eventModel
graphModel
Jun 27, 2025
EIG (event interaction graph)
definition
testingTechniques
eventModel
graphModel
Jun 27, 2025
ENV (environment variables)
definition
Jun 27, 2025
EPM (Equivalence Partitioning Method)
definition
testingTechniques
blackBox
Jun 27, 2025
ESG (event sequence graph)
definition
eventBasedTesting
eventModel
graphModel
Jun 27, 2025
FSM (finite-state machine)
definition
designPattern
softwareModel
Jun 27, 2025
Firefox extension
definition
firefox
browser
extension
Jun 27, 2025
Function Variadicity
definition
softwareEngineering
Jun 27, 2025
GA (genetic algorithm)
evolutionaryComputation
algorithm
math
Jun 27, 2025
GEMs (GUI Element Misuse)
definition
GUI
testingTechniques
cyberSecurity
Jun 27, 2025
GUI (graphical user interface)
definition
GUI
Jun 27, 2025
GUI ripper
definition
testingTechniques
ripper
graphModel
Jun 27, 2025
HAR file
definition
HAR
HTTP
Jun 27, 2025
HPG (Hybrid Property Graph)
definition
HybridPropertyGraph
softwareEngineering
Jun 27, 2025
HSTS (HTTP Strict Transport Security)
definition
browser
crossDomainPolicy
HTTP
Jun 27, 2025
HTTP Response Splitting
definition
Jun 27, 2025
HTTP eavesdropping
definition
cyberSecurity
HTTP
eavesdropping
Jun 27, 2025
HTTP trace collection
definition
algorithm
HTTP
Jun 27, 2025
HTTPS (HyperText Transfer Protocol Secure
definition
cyberSecurity
Jun 27, 2025
Honeypot
definition
cyberSecurity
Jun 27, 2025
IDOR (Insecure Direct Object Reference)
definition
cyberSecurity
IDOR
Jun 27, 2025
IDS and IPS (intrusion detection, intrusion prevention system)
definition
cyberSecurity
attackMitigation
Jun 27, 2025
IIFE (immediately invoked function expression)
definition
JavaScript
programmingLanguage
designPattern
Jun 27, 2025
IndexedDB
definition
clientStorage
Jun 27, 2025
Instrumentation
definition
softwareEngineering
Jun 27, 2025
Iroh.js
definition
webTool
Jun 27, 2025
JEA (Just-Enough-Access) principle
definition
accessControl
principle
cyberSecurity
Jun 27, 2025
JIT (Just-in-time) principle
definition
principle
cyberSecurity
accessControl
Jun 27, 2025
JSON Hijacking Prevention tokens
definition
JSON
Jun 27, 2025
JSON-LD (linked data)
definition
JSON
SEO
structuredData
Jun 27, 2025
JWT (JSON Web Token)
definition
JWT
Jun 27, 2025
KNN (K-Nearest Neighbors)
definition
machineLearning
supervisedLearning
Jun 27, 2025
KS (Kolmogorov-Smirnov) test
definition
statistics
Jun 27, 2025
LM (word n-gram language model)
definition
languageModel
testingTechniques
Jun 27, 2025
LTS (Leaning Toothpick Syndrome)
definition
Jun 27, 2025
Linux distribution
definition
OS
linux
Jun 27, 2025
LoC
definition
Jun 27, 2025
MF (Micro-Frontend) architecture
definition
Jun 27, 2025
MT (metamorphic testing)
definition
metamorphicTesting
testingTechniques
GUI
Jun 27, 2025
Malai
designPattern
softwareModel
definition
Jun 27, 2025
Markov’s chain and clickstream analysis
testingTechniques
clickstreamAnalysis
math
stateless
algorithm
Jun 27, 2025
Memento (design pattern)
definition
designPattern
Jun 27, 2025
MiTB (man-in-the-browser) attack
Jun 27, 2025
MiTM (man-in-the-middle) attack
definition
cyberSecurity
Jun 27, 2025
Monkey patching
definition
Jun 27, 2025
Mutation testing
definition
mutationTesting
Jun 27, 2025
NAS (Network Attached Storage)
definition
NAS
Jun 27, 2025
OSV (open source vulnerabilities)
definition
cyberSecurity
tool
Jun 27, 2025
OWASP (Open Web Application Security Project)
definition
webApplication
cyberSecurity
Jun 27, 2025
OWASP Top 10 (2021)
definition
Jun 27, 2025
OpenID
definition
OpenID
authentication
Jun 27, 2025
PDO
definition
PDO
Jun 27, 2025
POLA (Principle Of Least Astonishment)
definition
POLA
principle
Jun 27, 2025
PWA (progressive web application)
definition
JavaScript
Jun 27, 2025
Parallel programming
definition
algorithm
parallelComputing
Jun 27, 2025
PoLP (principle of least privilege)
definition
accessControl
principle
cyberSecurity
Jun 27, 2025
Post-WIMP
definition
GUI
Jun 27, 2025
QR-code
definition
QRcode
Jun 27, 2025
RBAC (role-based access control)
definition
cyberSecurity
designPattern
RBAC
accessControl
Jun 27, 2025
RCE (Remote Code Execution)
definition
RCE
Jun 27, 2025
RL (Reinforcement Learning)
definition
machineLearning
Jun 27, 2025
RSS (RDF Site Summary)
definition
webApplication
RSS
XML
Jun 27, 2025
ReDos (Regular Expression Denial of Service)
definition
cyberSecurity
DoS
ReDoS
Jun 27, 2025
RegEx (Regular Expression)
definition
codeAnalysis
Jun 27, 2025
SELinux (Security-Enhanced Linux)
definition
linux
browser
Jun 27, 2025
ABAC (attribute based access control)
definition
ABAC
accessControl
cyberSecurity
Jun 27, 2025
AIF (Application Independent Functionalities)
definition
principle
Jun 27, 2025
AST (Abstract Syntax Tree)
definition
softwareEngineering
Jun 27, 2025
Acunetix
definition
cyberSecurity
vulnerabilityScanner
Jun 27, 2025
Adobe Flash
definition
Flash
Jun 27, 2025
Alloy modeling language
definition
softwareEngineering
languageModel
softwareModel
Jun 27, 2025
BFT (business flow tampering)
definition
businessFlowTampering
Jun 27, 2025
BRF (Balance Random Forest)
definition
machineLearning
classifier
Jun 27, 2025
Burp Suite
definition
cyberSecurity
tool
penetrationTesting
penTest
Jun 27, 2025
C2C (client-to-client) communication
definition
clientSideAttacks
pushNotification
Jun 27, 2025
CA (covering array)
definition
math
samplingTechniques
Jun 27, 2025
CAPTCHA (Completely Automated Public Turing-test-to-tell Computers and Humans Apart)
definition
CAPTCHA
Jun 27, 2025
CDN (Content Delivery Network)
definition
CDN
Jun 27, 2025
CDP (Chrome DevTools Protocol)
definition
webTool
Jun 27, 2025
CFG (Control Flow Graph)
definition
softwareEngineering
CFG
staticAnalysis
Jun 27, 2025
COEP (Cross-Origin Embedder Policy)
definition
crossDomainPolicy
Jun 27, 2025
COIL (Cross-Origin Image Leak)
definition
canvas
HTML
cyberSecurity