---
# System prepended metadata

title: Thesis Progress Report

---

# THESIS PROGRESS REPORT

# Table Of Contents

1. [Outcomes](#Outcomes)
2. [Difficulties](#Difficulties)
3. [Plan For Next Week](#PlanForNextWeek)

# Outcomes

## Web Vulnerabilities
- **In Week 6, I studied and practiced labs of following web vulnerabilities topics:**
    - File Upload Vulnerability
    - DOM-Based Vulnerability
    - OS Command Injection
    - Prototype Pollution
    - Race Conditions
    - Cross-origin resource sharing (CORS) Vulnerability
- **Platforms used for practicing:**
    - Port Swigger
    - RootMe (*Web-Client* + *Web-Server*):
        ![](https://hackmd.io/_uploads/HJYQXQffp.png)
- **Documentation:**
    - Overall Progress: 90%
    - Unfinished topics:
        - Business Logic Errors
        - Broken Access Control (BAC)
        - DOM-Based Vulnerability

## Software Testing
- **In Week 7-8, I started to read and study the basic concepts of Software Testing, including:**
    - ***Definition:*** The process of checking the quality, functionality, and performance of a software product before launching
    - ***Purpose:***
        - Make a judgment about quality or acceptability 
        - Discover problems (bugs)
    - ***Terminologies***:
        - **Error** Mistakes made during coding, caused faults
        - **Fault:** Result/Representation of errors, also called defect/bug
        - **Failure:** Occur when code has fault is executed.
        - **Incident:** the symptom associated with a failure that alerts the user to the occurrence of a failure.
        - **Test:** An act of executing software with test cases
        - **Test case:** Consist of input and expected output, has an identity corresponding with a program behavior
    - ***Methods to identify test cases:***
        - **Specification-based Testing**: Mainly depends on the specification of the software, also called *Black box testing*
        - **Code-based Testing**: Depends on the implementation of the software (know what is inside the black box), also called *White box testing*
    - ***Testing Life Cycle:***
        ![](https://hackmd.io/_uploads/BJlMUEffT.png)
    - ***Maths For Software Testing:***
        - **Discrete Maths**
        - **Graph Theory:** Program Graph, Finite State Machine, Petri Net, Event-Driven Petri Net, Statechart
    - ***Unit Testing Methods:***
        - **Specification-Based Testing**: Boundary Value Testing, Equivalence Class Testing, Decision Table-Based Testing
        - **Code-Based Testing:** Test Coverage Metrics, Basis Path Testing
- **References:** Paul C. Jorgensen. 2022. *Software Testing: A Craftsman's Approach (5th. ed.*). CRC Press, Inc., USA.

# Difficulties
- Documentation: Large topics (e.g. BAC) are extremely hard to be fully covered in the document (especially *Techniques/Specific Cases* section)
# Plan For Next Week
- Understand other testing methods: Life Cycle-Based Testing, System Testing, Model-Based Testing
- Document what I learn
- Practice with the assignment of HCMUT's "Software Testing Course"