Towards security testing with taint analysis and genetic algorithms

Abstract

Cross site scripting is considered the major threat to the security of web applications. Removing vulnerabilities from existing web applications is a manual expensive task that would benefit from some level of automatic assistance. Static analysis represents a valuable support for security review, by suggesting candidate vulnerable points to be checked manually. However, potential benefits are quite limited when too many false positives, safe portions of code classified as vulnerable, are reported.In this paper, we present a preliminary investigation on the integration of static analysis with genetic algorithms. We show that this approach can suggest candidate false positives reported by static analysis and provide input vectors that expose actual vulnerabilities, to be used as test cases in security testing.

Web Security: Detection of Cross Site Scripting in PHP Web Application using Genetic Algorithm

“…With regards to the PHP web application, Andrea and Mariano [11] recommended a methodology to locate reflected XSS vulnerability without doing away with it. This methodology was further enhanced by Moataz and Fakhreldin www.ijacsa.thesai.org [10] for determining all three kinds of XSS vulnerabilities.…”

“…This methodology was further enhanced by Moataz and Fakhreldin www.ijacsa.thesai.org [10] for determining all three kinds of XSS vulnerabilities. However, the methodology by Andrea and Mariano [11] intends to locate only reflected XSS vulnerability without putting the genetic mutation operator to its best use. On the other hand, the methodology by Moataz and Fakhreldin [10] further enhanced the one offered by Andrea and Mariano [11] by utilising the database of XSS patterns for revealing the probable XSS vulnerabilities: stored, reflected, and DOMbased XSS.…”

“…Although there are several methodologies employed for detecting XSS vulnerability [7,10,11,12,16,17], the threats of XSS continue to persist. Thus, the aim of this paper is to enhance the detection methodologies by eradicating the infeasible paths, thereby reducing the false positive rate of locating XSS vulnerability.…”

“…However, it has not been sufficiently exploited for PHP web security testing. GA was espoused by Andrea et al and Moataz et al [10,11]. Notably, the methodology by Andrea and Mariano [11] intends to find out only the reflected XSS vulnerability without utilising the genetic mutation operator to the best of its ability.…”

“…Consequently, genetic algorithm ventured into the software testing arena by generating test cases for scrutinising the software security. This kind of algorithm offers solutions to determine XSS vulnerability with a lower false positive rate [3,10,11]. Within the Java web application framework, the genetic algorithm locates the entire XSS vulnerability devoid of any false positive rate in the outcomes [3].…”