Testing Challenges
Testing Challenges are a collection of hands-on exercises designed to help beginners build confidence in software testing by practicing a wide variety of testing techniques and validating different types of input and edge cases.
Before learning how to write formal test cases, it is important to understand how to think like a tester. These challenges focus on developing that mindset by encouraging you to explore application behavior, identify defects, validate expected outcomes, and investigate unusual or boundary conditions.
By completing these challenges, you will:
- Develop a practical testing mindset.
- Improve your ability to identify functional and non-functional defects.
- Learn to think beyond happy-path scenarios by exploring boundary values, invalid inputs, security vulnerabilities, and edge cases.
- Build confidence in performing exploratory and manual testing.
- Strengthen your analytical and observation skills.
- Gain practical experience before moving on to formal test case design and documentation.
Once you are comfortable identifying scenarios and defects through these exercises, writing structured test cases will become significantly easier and more meaningful.
Note: Use Horizontal scroll (Shift+scroll) wherever required
Testing Challenge #1 - web testing
Website: testingchallenges.thetestingmap.org
| Testing Challenge 1 - web testing | |||
| Category | Defects / Out-comes | Input | 15 out of 18 Found |
| Functional Tests | Minimum Value | Single character (e.g., "A") | |
| Space Values at the End | "John " | ||
| Space Values at the Beginning | " John" | ||
| Space in the Middle | "John Doe" | ||
| More than Maximum Values | "ARHTRBEHFBEDSHFUVHVVEVURVHEVIRJJH" | ||
| Empty Value | (No input) | ||
| Average Value | "Michael" | ||
| Only Space | " " | ||
| Security Tests | HTML Tags | "<b>John</b>" | |
| Basic XSS | "<script>alert('XSS')</script>" | ||
| Basic SQL Injection | "' OR '1'='1" | ||
| Input Character Tests | Non-ASCII Characters | "José" or "Åqsa" | |
| Other Characters Than Alphabetic | "John123" or "John@Wick" | ||
| Maximum Values | "AETDHKGHIQKLMPONQRSTUVIXBZAQ" | ||
| Basic Valid Input | "John" | ||
Testing Challenge #2 - bypass html 5 validations
Website: testingchallenges.thetestingmap.org
| Testing Challenge 2 - bypass html 5 validations | |||
| Step | Action Taken | Result | Challenge Successful !! |
| 1. Opened the webpage with the form | Opened the form in the browser | Form loaded successfully | |
| 2. Identified the input field with numeric validation | Noticed the HTML5 validation (type='number') | HTML5 validation was visible | |
| 3. Opened Developer Tools in the browser using Inspect | Right-clicked the page, selected 'Inspect' | Developer Tools opened correctly | |
| 4. Modified the input field validation | Changed the type attribute to 'text' to bypass validation | Validation was bypassed | |
| 5. Entered invalid data in the input field | Entered a non-integer value (e.g., 'hello' or '123.456') | Form accepted invalid input | |
| 6. Submitted the form successfully with invalid data | Successfully submitted the form with invalid data | Form was submitted without any errors | |
Testing Challenge #4 - generate testing data
Website: testingchallenges.thetestingmap.org
| Testing Challenge 4 - generate testing data | Challenge Successful !! | ||||||||
| CNP | Details of CNP | Control Number Calculations | 1st Digit (Gender and Time Period) This digit give info about the gender and when the person was born 1 - Male, born between 1900 - 1999. 2 - Female, born between 1900 - 1999. 3 - Male, born between 1800 - 1899. 4 - Female, born between 1800 - 1899. 5 - Male, born between 2000 - 2099. 6 - Female, born between 2000 - 2099. 7 - Foreigner, male. 8 - Foreigner, female. 9 - Unknown gender, Not- Resident. |
2nd and 3rd Digits (Year of Birth) These two digits give info about the last two digits of the year of birth: Ex: If born in 1985, it will be 85. Ex: If born in 2003, it will be 03. |
4th and 5th Digits ( Month of Birth ) These digits tgive info about the month of birth : Ex: 01 - January 02 - February 12 - December |
6th and 7th Digits - Day of Birth These two digits give info about the day of birth: Ex: 01 - 1st day of month. 15 - 15th day of month. |
8th and 9th Digits - Area Code These digits give info about pincode of place of birth Ex: 01 – Bucharest 02 – Arad The exact area codes can be range from 01 to 52. |
10th to 12th Digits - Order Number These three digits give infoabout number of order per DAY Ex: 001 is the first person registered that day. 456 could be the 456th person registered that day. |
13th Digit – Control Number This is a number to ensure the CNP is valid and calculated using the first 12 digits and the following formula: Multiply each of the first 12 digits by a specific sequence: 2x Digit 1 + , 7x Digit 2 + , 9, 1, 4, 6, 3, 5, 8, 2, 7, 9. wagera wagera Then Mod by 11, remainder is Control Number. |
| 1850415010013 | 1 - Male born between 1900 -1999. 85 - Born in 1985. 04 -April. 15 - 15th day. 01 - Bucharest area. 001 - First record for that day. 3 - Control digit . |
(1×2) + (8×7) + (5×9) + (0×1) + (4×4) + (1×6) + (5×3) + (0×5) + (1×8) + (0×2) + (0×7) + (1×9) = 2 + 56 + 45 + 0 + 16 + 6 + 15 + 0 + 8 + 0 + 0 + 9 = 157 Mod 11 = 3 |
|||||||
| 2990621010024 | 2 - Female born between 1900 -1999. 99 - Born in 1999. 06 - June. 21 - 21st day. 01 - Bucharest area. 002 - Second record for that day. 4 - Control digit. |
(2×2) + (9×7) + (9×9) + (0×1) + (6×4) + (2×6) + (1×3) + (0×5) + (1×8) + (0×2) + (0×7) + (2×9) = 4 + 63 + 81 + 0 + 24 + 12 + 3 + 0 + 8 + 0 + 0 + 18 = 213 Mod 11 =4 |
|||||||
| 1980324010013 | 1 - Male born between 1900 - 1999. 98 - Born in 1998. 03 - March. 24 - 24th day. 01 - Bucharest area. 001 - First record for that day. 3 - Correct control digit (calculated). |
(1×2) + (9×7) + (8×9) + (0×1) + (3×4) + (2×6) + (4×3) + (0×5) + (1×8) + (0×2) + (0×7) + (1×9) = 2 + 63 + 72 + 0 + 12 + 12 + 12 + 0 + 8 + 0 + 0 + 9 = 190 Mod 11 = 3 |
|||||||
| 3030415010044 | 3 - Male born between 1800 -1899. 03 - Born in 1803. 04 - April. 15 - 15th day. 01 - Bucharest area. 004 - Fourth record for that day. 4 - Correct control digit (calculated). |
(3×2) + (0×7) + (3×9) + (0×1) + (4×4) + (1×6) + (5×3) + (0×5) + (1×8) + (0×2) + (0×7) + (4×9) = 6 + 0 + 27 + 0 + 16 + 6 + 15 + 0 + 8 + 0 + 0 + 36 = 114 Mod 11 = 4 | |||||||
| 2991223010053 | 2 - Female born between 1900 -1999. 99 - Born in 1999. 12 - December. 23 - 23rd day. 01 - Bucharest area. 005 - Fifth record for that day. 3 - Control digit (calculated). |
(2×2) + (9×7) + (9×9) + (1×1) + (2×4) + (2×6) + (3×3) + (2×5) + (3×8) + (0×2) + (0×7) + (5×9) = 4 + 63 + 81 + 1 + 8 + 12 + 9 + 10 + 24 + 0 + 0 + 45 = 157 Mod 11 = 3 |
|||||||
Testing Challenge #5 - using a web analytics engine
Website: testingchallenges.thetestingmap.org
| Testing Challenge 5 - using a web analytics engine | Challenge Incomplete !! |
| NEED TO BE DONE BY SELF, Consider following question before solving. - What is this asking for? - What am supposed to expect - How am I supposed to do this? |
Testing Challenge #6 - Boundary testing
Website: testingchallenges.thetestingmap.org
| Testing Challenge 6 - Boundary testing | ||||
| Input | Issue | Challenge's Test 's Response | Challenge Incomplete !! | |
| 1 | 2016-12-31 23:59:00 | Below the minimum year range | First date before 2017, December 2016 23:59 | |
| 2 | 2018-01-01 00:00:00 | Above the maximum year range | First date after 2017, January 2018 00:00 |
|
| 3 | 2017-01-20 14:20:00 | Exactly 1-hour advance | Date less than 1 hour |
|
| 4 | 29/02/2017 12:00 | Invalid leap year date | Inexistent date 29 for February 2017 |
|
| 5 | 31/04/2017 12:00 | Invalid day for April | 31 days for 30 days months |
|
| 6 | 32/01/2017 12:00 | Non - existent day | 32 days for 31 days months |
|
| 7 | 20/13/2017 12:00 | Invalid month | Higher limit for the month 13 |
|
| 8 | 00/01/2017 12:00 | Zero as a day | Date with day = zero |
|
Testing Challenge #7 - Scenario Testing
Website: testingchallenges.thetestingmap.org
| Testing Challenge 7 - Scenario Testing | |
| Danish Masood, a passionate QA intern at blackcurrant, was tasked with testing a new administrator portal for an online E-Turf booking and management platform. He followed agile testing practices, while working closely with developers to ensure each sprint is delivered promptly and accurately. Inspired by the principles of software craftsmanship, Danish suggested his teams of focusing on unit testing for critical features like user management and permissions. His active approach caught several bugs early in the development phase, saving the team from last-minute chaos and time vulnerability. By the end of the project, Danish’s efforts impressed the team, and the administrator portal was launched successfully, showcasing his growing expertise in QA. |
Challenge Successful !! |
Testing Challenge #8 - State Transition
Website: testingchallenges.thetestingmap.org
| Testing Challenge 8 - State Transition | |||||||
| State | Selling | Description | Start Date | End Date | Action | Result | Challenge Sucessful !! |
| Saved | Potato | A highly fibrous vegetable root that grows under the ground. | 11:00:00 | 12:00:00 | Delete | Successfully deleted. | |
| In Progress | Sweet Potato | A highly glutenous vegetable root that grows under the ground. | 09:45:00 | 11:00:00 | Delete | Deletion not allowed (as expected). | |
| In Progress | Sweet Potato | A highly glutenous vegetable root that grows under the ground. | 09:45:00 | 11:00:00 | Archive | Archiving not allowed (as expected). | |
| Finished | Bad Potato | A highly venomous vegetable root that grows under the ground. | 09:48:00 | 09:49:00 | Archive | Successfully archived. | |
Testing Challenge #9 - Know your testing techniques
Website: testingchallenges.thetestingmap.org
| Testing Challenge 9 - Know your testing techniques | ||||
| Words | Direction | Letters | Answer | Description |
| COMPLIANCETESTING | Down | 17 | Compliance Testing | Testing techniques used to assess if the product meets certain standards. |
| GLOBALIZATIONTESTING | Across | 20 | Globalization Testing | Testing technique used when a product has customers all over the world. |
| PERFORMANCETESTING | Down | 18 | Performance Testing | Testing technique used to evaluate if software and hardware are in tune. |
| USABILITYTESTING | Down | 16 | Usability Testing | Technique concerned with the ease of use for a product. |
| SECURITYTESTING | Down | 15 | Security Testing | Testing technique investigating threats such as viruses. |
| PORTABILITYTESTING | Across | 18 | Portability Testing | Ensures the application can function on different platforms. |
| SMOKETESTING | Across | 12 | Smoke Testing | Testing technique named after testing pipelines or electronic circuits. |
| BOUNDARYVALUEANALYSIS | Down | 21 | Boundary Value Analysis | Focuses on testing valid and invalid limits. |
| MONKEYTESTING | Across | 13 | Monkey Testing | Testing technique related to randomness, inspired by the animal. |
| STATETRANSITION | Down | 15 | State Transition Testing | Focuses on checking how objects change their state during application operation. |
| USEREXPERIENCE | Down | 14 | User Experience Testing | Concerned with all aspects of how a product is experienced by a user. |
| GUITESTING | Down | 10 | GUI Testing | Testing that focuses only on the end result visible to the user. |
Testing Challenge #10 - BUG HUNT - Part 01
Website: testingchallenges.thetestingmap.org
| Testing Challenge 10 - BUG HUNT - Part 01 | |||
| Defect Numbers | Input | Defect information | Advices from GPT (Got these with GPTs assistances) |
| 1 | <script>alert('XSS')</script> or '; DROP TABLE users;-- | Special characters like <, >, /, ; are allowed in the form fields. | Check if characters like < or ; cause any issues (like breaking the form). |
| 2 | John (space) or Wick (space) | The form doesn’t remove spaces before or after the input. | See if spaces at the start or end of the text are causing issues when entering data. |
| 3 | 😀😆 or ñ (Unicode or non-ASCII characters) | The form lets you enter emojis or other non-standard characters. | Test if the form should reject things like emojis or weird symbols. |
| 4 | user@example.com (already registered email) | The form lets you register with a username or email that’s already registerd. | Try registering with a username or email that’s already in the system and see if it stops you. |
| 5 | OR '1'='1 | The form accepts SQL commands, which can cause security issues. | Try entering SQL commands like ' OR '1'='1 in the username and password fields to check for security holes. |
| 6 | password123 (check for plaintext) | The form sends or stores passwords without encryption. | Check if the password is visible or sent in a way that could be easily intercepted. |
| 7 | Submit with invalid input empty, incorrect format | The system shows too much error info, like internal messages or technical details. | Try submitting incorrect info and see if it reveals any sensitive server information. |
| 8 | john.wick@kalakhatta.com, password123 | The form doesn’t store or show input correctly in the database. | Check if the data entered (name, email, password) shows up correctly in the database. |
| 9 | NULL, empty fields, or missing values | The form or database doesn’t handle missing or incomplete data properly. | Test by leaving out some details (like the last name or email) and see how the system reacts. |
| 10 | created_on and last_updated = non | Dates and times (created_on, last_updated) are missing or wrong in the database. | Test if the timestamps are saved and displayed right in the database. |
| 11 | Refresh page after registration | After registering, refreshing the page causes the user to disappear from the system. | Check if the data is still there after refreshing or restarting the app. |
| 12 | Leave required fields blank and click "Submit" | The "Submit" button stays active even when fields are missing. | Make sure the "Submit" button only works when all the fields are filled correctly. |
| 13 | invalid email or leave a field blank | The form doesn’t show proper error messages for invalid or incomplete fields. | Try submitting wrong info (like an email without @) and see if the right message shows up. |
| 14 | Resize browser window | The screen layout doesn’t adjust correctly when the screen is resized. | Test how the form looks on different screen sizes by resizing the browser or using mobile mode. |
| 15 | john.wick@example.com, password123 (registered user) | Registered users can’t log in properly. | Try logging in with a user that’s already registered to see if login works as expected. |
| 16 | Keep the session idle for an extended time (15 minutes) | The session doesn’t automatically log out after a certain time. | Leave the app idle for a while and see if it logs you out after a period of inactivity. |
| 17 | Not able to get anything about these five. | ||
| 18 | |||
| 19 | |||
| 21 | |||
| 20 | |||
Testing Challenge #10 - BUG HUNT - Part Two
Website: testingchallenges.thetestingmap.org
| Testing Challenge 10 - BUG HUNT - Part Two | |||
| Category | Number | Description | Notes |
| Top 5 Bugs | 1 | SQL Injection Vulnerability | Fields accept SQL injection queries in passwords and other fields, creating a major security issue |
| 2 | Duplicate User Registrations | The form allows already registered values to be registered again, indicating a lack of uniqueness validation. | |
| 3 | No Error Messages | Missing error feedback for duplicate registrations, incomplete fields, and invalid input formats creates confusion. | |
| 4 | "Only-Space" Input Accepted | Fields for First Name, Last Name, and Username accept inputs consisting of only spaces, which is invalid. | |
| 5 | Database Data Missing | Database does not show values in the :active, created_on, and created_by_id fields, impacting tracking and auditability. | |
| Top 5 Issues | 1 | Form Validation Inadequacies | First Name accepts numbers and special characters, violating typical input standards for this field. |
| 2 | Password Field Design | The password text field is poorly bordered, impacting user experience and usability. | |
| 3 | Non-ASCII Input Acceptance | The form accepts non-ASCII values, which might need improvement depending on localization and character set requirements. | |
| 4 | Whitespace Handling | Leading/trailing spaces are not trimmed in input fields, allowing for potential inconsistencies in the database. | |
| 5 | Localization Missing/Error Messages | If the form is expected to support multiple languages, it lacks necessary translations for error feedback. | |