I just read Pradeep's blog Tester Tested!: Checkmate heuristic :: A security testing attack and I just loved it. Thinking is the key here, as it always should be. If you want to test something you can't do it without thinking. Following a classic scripted test case means you'll have to shut down your natural curiosity and your natural thinking. You need to be in machine-mode and just perfom. I'm sorry, but you'll never find anything that way. You'll only find what the developers already should have found and fixed.
In one of the projects I'm working on currently we do have something that we can call a script, if we want to and if we, for political reasons, need to. It's really just a map of the system written out in the english language instead of as a drawing. It shows the whole system on two levels. First it's the five, or six, major functionallity areas of the system and secondly it's the major functions within each area.
This is really all we need and since the people who do test the system, and the new releases, are thinking human beings, it works great. We tend to find issues and bugs in every release and the most interesting are the ones that have been in the system probably for years without us finding them or anyone reporting them. They may or may not be critical. Some are and some are not. Anyway we are all excited when we find a bug! If it's an old one we tend to get even more excited. Finding bugs in the new, or changed, functionallity is easy. It's finding the old ones that is hard, and therefore more fun.
I'll keep posting new stuff as often as I can, and if I find something worth sharing.
