Coverage is a tool written in Python which allows you to track what functionalities/web pages are reached on your website. I use this tool for in my Web Apps Scanner evaluation methodology in order to know if the web apps scanner was able to scan every pages, every functionalities of my test apps.
Anyway, this tool is pretty easy to use even if it requires a MySQL database to store the EntryPoints of the application.
Basically, you setup the database, you insert the entry points into your code and you run the python script
which will generate an HTML report with SVG graphs, reporting the coverage of your application.
Here is a report example
Installation
1/ Database
The database design I used for storing the needed information is the following:
CREATE TABLE `coverage` (
`CoverageID` int(32) NOT NULL auto_increment,
`Apps` varchar(128) character set utf8 collate utf8_unicode_ci NOT NULL,
`Date` date NOT NULL,
`EntryPoint` varchar(255) character set utf8 collate utf8_unicode_ci NOT NULL,
`Origin` varchar(255) character set utf8 collate utf8_unicode_ci NOT NULL,
PRIMARY KEY (`CoverageID`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1;
- Apps: name of the covered application
- Date: time when the entry point is reached
- EntryPoint: Name of the entry point with a special format:
** File Reached:
Touch_ + Name of the file with extension, example, Touch_Index.Php, Touch_Search.Php etc.
** Functionality Reached:
Name of the functionality + _ + Name of the file with extension, example, this sequence of entry points of
the page Login.php of a given application:
- Touch_Login.Php : Enter the page Login.Php
- Username_Password_Login.Php : The username and the password are feed
- Call_Function_Login.Php : Call the function login()
- Call_Function_Succeed_Login.Php : The function login succeed
- Call_Function_Error_Login.Php : The function login reported an error
- Origin: the origin string is the concatenation of the md5 of the HTTP_USER_AGENT a pipe and the date; this ID + date is used to be sure to study the same user.
<?php
// ...
$origin = md5($_SERVER['HTTP_USER_AGENT']). '|' . date("j-m-y H:i");
?>
2/ In the code
So, you will need to add, in your apps code, lots of entry points. I made a PHP source code to do that more easily:
<?php
class Coverage{
private $coverage_id = false;
private $coverage = null;
function __construct() {
$this->coverage_id = true;
$this->coverage = mysql_connect('192.168.1.3:3306', 'test', 'test');
mysql_select_db("test_collect");
}
function send($entryPoint){
if ($this->coverage) {
$origin = "";
$origin .= md5($_SERVER['HTTP_USER_AGENT']);
$origin .= ('|' . date("j-m-y H:i"));
$entryPoint = mysql_real_escape_string($entryPoint);
mysql_query("INSERT INTO coverage VALUES(NULL,'BankApp',NOW(),'$entryPoint','$origin')");
}
}
};
$coverage = new Coverage();
function register_EntryPoint($entryPoint) {
global $coverage, $supportCodeCoverage;
if ($supportCodeCoverage) {
$coverage->send($entryPoint);
}
}
?>
Insert this code in a header or something and call:
register_EntryPoint('Touch_MyFile.Php');
etc. in your code where you have functional difference.
Run the tool
To run the tool, you need to have:
- Python + MySQLdb (the python MySQL API)
- The date (in SQL format) you want to cover; for now, it's only one day
- The Origin ID of the user (the MD5(HTTP_USER_AGENT)), basically, you will look at this in the database, or get it by your code etc.
example:
$ python coverage.py 2007-06-28 41942da0293d0b8afcfab4c2d10c2401
$ python coverage.py 2007-04-12
The script must be in the same directory of your files for now... you can download the archive here: coverage.zip
Last comments