Web application security assessment by fault injection and behavior monitoring

Huang, Yao-Wen; Huang, Shih-Kun; Lin, Tsung-Po; Tsai, Chung-Hung

doi:10.1145/775152.775174

Cited by 236 publications

(153 citation statements)

References 24 publications

Supporting

Mentioning

153

Contrasting

Order By: Relevance

“…Most previous researches [10,15,16,17] endeavor to exploit various vulnerabilities within web applications. For instance, SecuBat [18] are used to identify input validation vulnerabilities.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Lom: Discovering logic flaws within MongoDB-based web applications

Wen

Yuan

et al. 2016

Int. J. Autom. Comput.

View full text Add to dashboard Cite

Section: Related Workmentioning

confidence: 99%

“…A number of testing tools, both open-source, e.g., Spike, Burp, and commercial, e.g., IBM AppScan, have been proposed for identifying input validation vulnerabilities within web applications [16] . They feed random inputs from a library of known attack patterns into applications.…”

Section: Related Workmentioning

confidence: 99%

Lom: Discovering logic flaws within MongoDB-based web applications

Wen

Yuan

et al. 2016

Int. J. Autom. Comput.

View full text Add to dashboard Cite

“…We go along the same lines in this paper, but with a specific focus on XSS test selection and systematic benchmarking through testing (and we do not bypass client-side browser mechanisms since it's a part of the XSS target). Similarly to Su's statements [19], Huang et al [20] propose to mutate and inject faulty inputs, including SQL injection and XSS against web application (WAVES tool), but do not provide a diagnosis technique to distinguish the various security layers and validate the capacity of an XSS vector to pass in a web browser or not. The only XSS test case evaluation methodology we found was done using mutation based testing [21]: a test data set was qualified by mutating the PHP code of five web applications.…”

Section: Related Workmentioning

confidence: 99%

Empirical Investigation of the Web Browser Attack Surface under Cross-Site Scripting: An Urgent Need for Systematic Security Regression Testing

Abgrall

Traon²,

Gombault

et al. 2014

2014 IEEE Seventh International Conference on Software Testing, Verification and Validation Workshops

View full text Add to dashboard Cite

Abstract-One of the major threats against web applications is Cross-Site Scripting (XSS). The final target of XSS attacks is the client running a particular web browser. During this last decade, several competing web browsers (IE, Netscape, Chrome, Firefox) have evolved to support new features. In this paper, we explore whether the evolution of web browsers is done using systematic security regression testing. Beginning with an analysis of their current exposure degree to XSS, we extend the empirical study to a decade of most popular web browser versions. We use XSS attack vectors as unit test cases and we propose a new method supported by a tool to address this XSS vector testing issue. The analysis on a decade releases of most popular web browsers including mobile ones shows an urgent need of XSS regression testing. We advocate the use of a shared security testing benchmark as a good practice and propose a first set of publicly available XSS vectors as a basis to ensure that security is not sacrificed when a new version is delivered.

show abstract

“…Testing software functionality according to Huang (2003) includes testing SQL Injection and Cross -Site Scripting (XSS) [2] so that ATLAS software to be able to meet the quality of software components must be able to counteract the functionality of SQL injection and XSS. The following Information passed in the Table means that the program cannot be used via script injection.…”

Section: B Analysis Of Software Quality 1) Functionality Testing Resmentioning

confidence: 99%

ATLAS (Application for Tracking and Scheduling) as Location Guide and Academic Schedulling at Campus YSU (Yogyakarta State University)

Setialana¹,

Fajri²,

Pambudi³

et al. 2014

IJCCE

View full text Add to dashboard Cite

Abstract-Yogyakarta State University is an educational institution that has six faculties with wide area. YSU currently has maps in digital form accessible through website and the form of posters which were placed in several locations. However, the digital map provided less detail and little bit features. Therefore, we need a map of YSU in digital form that can be accessed by portable through smartphone devices. This study resulted in a prototype ATLAS software that can be used as a solution to these problems. This application can help all parties in the search location, place and space in the campus area.

show abstract

Web application security assessment by fault injection and behavior monitoring

Cited by 236 publications

References 24 publications

Lom: Discovering logic flaws within MongoDB-based web applications

Lom: Discovering logic flaws within MongoDB-based web applications

Empirical Investigation of the Web Browser Attack Surface under Cross-Site Scripting: An Urgent Need for Systematic Security Regression Testing

ATLAS (Application for Tracking and Scheduling) as Location Guide and Academic Schedulling at Campus YSU (Yogyakarta State University)

Contact Info

Product

Resources

About