Search-based security testing of web applications

Abstract

SQL injections are still the most exploited web application vulnerabilities. We present a technique to automatically detect such vulnerabilities through targeted test generation. Our approach uses search-based testing to systematically evolve inputs to maximize their potential to expose vulnerabilities. Starting from an entry URL, our BIOFUZZ prototype systematically crawls a web application and generates inputs whose effects on the SQL interaction are assessed at the interface between Web server and database. By evolving those inputs whose resulting SQL interactions show best potential, BIOFUZZ exposes vulnerabilities on real-world Web applications within minutes. As a black-box approach, BIO-FUZZ requires neither analysis nor instrumentation of server code; however, it even outperforms state-of-the-art whitebox vulnerability scanners.

Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps

“…As the app is executed, screenshots and GUI-related metadata can be automatically extracted for each unique observed screen or layout of an app. Other similar automated GUI-ripping or crawling approaches can also be adapted for other platforms such as the web [77], [78], [79], [80], [81].…”

Automatic Generation of Tests to Exploit XML Injection Vulnerabilities in Web Applications

“…Thomé et al [68] proposed a search-based testing approach to detect SQL injection vulnerabilities in web applications. Their approach evolves inputs by assessing the effects on SQL interactions between the web server and database with the goal of exposing SQL injection vulnerabilities.…”

“…Our work is also based on evolving test inputs but for XML injection instead of SQL. Moreover, Thomé et al [68] used a fitness function based on a number of factors to measure the likelihood of the SQLi attacks. Instead, we use a fitness function based on the distance between the SUT's outputs and test objectives based on attack patterns.…”

JoanAudit: a tool for auditing common injection vulnerabilities

“…Challenges 2, 4, and 5 are addressed by security testing approaches [1,2,16,20,37] and dynamic analysis-based security attack detection approaches [10, 24, 31-33, 35, 36]. These approaches can be used to detect XSS, SQLi, XMLi, XPathi, and LDAPi vulnerabilities.…”

“…Challenge 6 is generally addressed by black-box security testing approaches [2,16,37] because they are agnostic with respect to the programming language of the system under test. However, this is the same reason for which these approaches cannot locate vulnerabilities in the source code (challenge 1).…”