JoanAudit: a tool for auditing common injection vulnerabilities

Thomé, Julian; Shar, Lwin Khin; Bianculli, Domenico; Briand, Lionel C.

doi:10.1145/3106237.3122822

Cited by 10 publications

(3 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Few research [140]- [143] is found regarding XPath. Researchers [140] and [141] both use static analysis. Thomé et al [140] proposed a method to reduce the slice that is extracted by a tool in source code analysis.…”

Section: State-of-the-art Research Of Xpath Injection Solutionsmentioning

confidence: 99%

“…However, their method only enhances slice but not verify vulnerabilities. Later, Thomé et al extended this work in [141] where they suggested a tool called JoanAudit that works by data flow analysis to detect and fix common injection vulnerabilities such as XSS, SQLI, XMLi, XPathI, and LDAPi in Java web system. This tool slices sensitive lines and sink of code that needs to audit regarding security checks.…”

Section: State-of-the-art Research Of Xpath Injection Solutionsmentioning

confidence: 99%

See 1 more Smart Citation

Input Validation Vulnerabilities in Web Applications: Systematic Review, Classification, and Analysis of the Current State-of-the-Art

Faisal

Elshoush

2023

IEEE Access

View full text Add to dashboard Cite

In recent years, huge increase in attacks and data breaches is noticed. Most of the attacks are performed and focused on the vulnerabilities related to web applications. Hence, nowadays the mitigation of application vulnerabilities is an ignited research area. Thus, due to the potential high severity impacts of web application, many different approaches have been proposed in the past decades to mitigate the damages of application vulnerabilities. Static and dynamic analysis are the two main techniques used. In this paper, a new classification for web application input validation vulnerabilities is proffered. In addition, various techniques/tools that are used to detect them are analyzed and evaluated to apprehend their strengths and weaknesses. Thus, this paper provides both technical as well as literature countermeasures to input validation vulnerabilities. Moreover, various statistical distributions of the reviewed techniques were manifested and scrutinize in different aspects to reveal the perception of the prevailing techniques and the gaps in the literature. In addition, the most widespread metrics are also propounded.

show abstract

Section: State-of-the-art Research Of Xpath Injection Solutionsmentioning

confidence: 99%

Section: State-of-the-art Research Of Xpath Injection Solutionsmentioning

confidence: 99%

Input Validation Vulnerabilities in Web Applications: Systematic Review, Classification, and Analysis of the Current State-of-the-Art

Faisal

Elshoush

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The catalog demonstrates different language syntax elements of fluentTQL and how they can be used for specifying vulnerabilities. The Java examples and the SM are manually collected from several sources including the Mitre (Mitre, 2020b) and OWASP (OWASP, 2020b) databases, OWASP benchmark project(OWASP, 2020a), and other publicly available SM lists (Arzt et al, 2013;Brooke, 2013;Piskachev et al, 2019;Thomé et al, 2017).…”

Section: Rq3 Expressivenessmentioning

confidence: 99%

Fluently specifying taint-flow queries with fluentTQL

Piskachev¹,

Späth²,

Budde³

et al. 2022

Preprint

View full text Add to dashboard Cite

Previous work has shown that taint analyses are only useful if correctly customized to the context in which they are used. Existing domainspecific languages (DSLs) allow such customization through the definition of deny-listing data-flow rules that describe potentially vulnerable or malicious taint-flows. These languages, however, are designed primarily for security experts who are expected to be knowledgeable in taint analysis. Software developers, however, consider these languages to be complex.This paper thus presents fluentTQL, a query specification language particularly for taint-flow. fluentTQL is internal Java DSL and uses a fluentinterface design. fluentTQL queries can express various taint-style vulnerability types, e.g. injections, cross-site scripting or path traversal. This paper describes fluentTQL's abstract and concrete syntax and defines its runtime semantics. The semantics are independent of any underlying analysis and allows evaluation of fluentTQL queries by a variety of taint analyses. Instantiations of fluentTQL, on top of two taint analysis solvers, Boomerang and FlowDroid, show and validate fluentTQL expressiveness.Based on existing examples from the literature, we have used fluentTQL to implement queries for 11 popular security vulnerability types in Java. Using our SQL injection specification, the Boomerang-based taint analysis found all 17 known taint-flows in the OWASP WebGoat application, whereas with Flow-Droid 13 taint-flows were found. Similarly, in a vulnerable version of the Java Spring PetClinic application, the Boomerang-based taint analysis found all seven expected taint-flows. In seven real-world Android apps with 25 expected malicious taint-flows, 18 taint-flows were detected. In a user study with 26

show abstract

Fluently specifying taint-flow queries with fluentTQL

Piskachev

Späth²,

Budde

et al. 2022

Empir Software Eng

View full text Add to dashboard Cite

Previous work has shown that taint analyses are only useful if correctly customized to the context in which they are used. Existing domain-specific languages (DSLs) allow such customization through the definition of deny-listing data-flow rules that describe potentially vulnerable or malicious taint-flows. These languages, however, are designed primarily for security experts who are expected to be knowledgeable in taint analysis. Software developers, however, consider these languages to be complex. This paper thus presents fluent TQL, a query specification language particularly for taint-flows. fluentTQL is internal Java DSL and uses a fluent-interface design. fluentTQL queries can express various taint-style vulnerability types, e.g. injections, cross-site scripting or path traversal. This paper describes fluentTQL’s abstract and concrete syntax and defines its runtime semantics. The semantics are independent of any underlying analysis and allows evaluation of fluent TQL queries by a variety of taint analyses. Instantiations of fluentTQL, on top of two taint analysis solvers, Boomerang and FlowDroid, show and validate fluent TQL expressiveness. Based on existing examples from the literature, we have used fluentTQL to implement queries for 11 popular security vulnerability types in Java. Using our SQL injection specification, the Boomerang-based taint analysis found all 17 known taint-flows in the OWASP WebGoat application, whereas with FlowDroid 13 taint-flows were found. Similarly, in a vulnerable version of the Java Spring PetClinic application, the Boomerang-based taint analysis found all seven expected taint-flows. In seven real-world Android apps with 25 expected malicious taint-flows, 18 taint-flows were detected. In a user study with 26 software developers, fluentTQL reached a high usability score. In comparison to CodeQL, the state-of-the-art DSL by Semmle/GitHub, participants found fluentTQL more usable and with it they were able to specify taint analysis queries in shorter time.

show abstract

JoanAudit: a tool for auditing common injection vulnerabilities

Cited by 10 publications

References 36 publications

Input Validation Vulnerabilities in Web Applications: Systematic Review, Classification, and Analysis of the Current State-of-the-Art

Input Validation Vulnerabilities in Web Applications: Systematic Review, Classification, and Analysis of the Current State-of-the-Art

Fluently specifying taint-flow queries with fluentTQL

Fluently specifying taint-flow queries with fluentTQL

Contact Info

Product

Resources

About