Web application security assessment by fault injection and behavior monitoring

Huang, Yao-Wen; Huang, Shih-Kun; Lin, Tsung-Po; Tsai, Chung-Hung

doi:10.1145/775173.775174

Cited by 40 publications

(40 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…However, this order generally defines the semantics of the page. Thus, it is important to take it into account to assess the similarity, as performed in [5] with a text similarity distance. As an example, the two following pages use the same words in a different order, but they have different semantics:…”

Section: Discussion and Contributionsmentioning

confidence: 99%

“…Besides SQL injections, the proposed approach can address XPATH, OS Commanding, and File include vulnerabilities. While our work shares some of the ideas and objectives presented in [5], we follow different approaches. For example, the clustering approach which is the core of our algorithm is not used in [5].…”

Section: Discussion and Contributionsmentioning

confidence: 99%

“…While our work shares some of the ideas and objectives presented in [5], we follow different approaches. For example, the clustering approach which is the core of our algorithm is not used in [5]. They use a different technique combining error pattern matching and the similarity analysis of application response pages.…”

Section: Discussion and Contributionsmentioning

confidence: 99%

“…The algorithm presented in [5] is also based on the similarity approach. It differs from other implementations in the additional use of the error pattern matching approach at a first step to guide the classification.…”

Section: Similarity Approachmentioning

confidence: 99%

See 3 more Smart Citations

An automated black box approach for web vulnerability identification and attack scenario generation

et al. 2014

View full text Add to dashboard Cite

International audienceWeb applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties of information systems such as confidentiality, integrity, or availability. To cope with these threats, it is necessary to develop efficient security protection mechanisms and assessment techniques (firewall, intrusion detection system, Web scanner, etc.). This paper presents a new methodology, based on Web page clustering techniques, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that it does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such as SQL injections. The proposed methodology led to the development of a new Web vulnerability scanner that has been validated experimentally on several examples of vulnerable applications

show abstract

Section: Discussion and Contributionsmentioning

confidence: 99%

Section: Discussion and Contributionsmentioning

confidence: 99%

Section: Discussion and Contributionsmentioning

confidence: 99%

Section: Similarity Approachmentioning

confidence: 99%

See 2 more Smart Citations

An automated black box approach for web vulnerability identification and attack scenario generation

et al. 2014

View full text Add to dashboard Cite

show abstract

“…Some Artificial intelligence techniques have been proposed as solution to the SQL injection attack. Between the approaches revised is WAVES (Web Application Vulnerability and Error Scaner) [27]. This solution is based on a black-box technique.…”

Section: Database Threat and Security Revisionmentioning

confidence: 99%

SiC: An Agent Based Architecture for Preventing and Detecting Attacks to Ubiquitous Databases

Pinzón

Paz

Bajo

et al. 2009

Computer Communications and Networks

View full text Add to dashboard Cite

One of the main attacks to ubiquitous databases is the SQL injection attack which causes severe damage both in the commercial aspect, as in the confidence of users. This paper proposes the SiC architecture as a solution to the SQL injection attack problem. This is a hierarchical distributed multiagent architecture which incorporates an entirely new approach with respect to existing architectures for the prevention and detection of SQL injections. SiC incorporates a kind of intelligent agent which integrates a case-based reasoning system. This agent, which is the core of the architecture, allows the application of detection techniques based on anomalies as well as detection techniques based on patterns, which provide a great degree of autonomy, flexibility, robustness and dynamic scalability. The characteristics of the multiagent system allow the architecture to detect attacks from different types of devices, regardless of the physical location. The architecture has been tested on a medical database guaranteeing safe access from various devices such as PDAs and computers notebook. This paper describes the main features of the architecture SiC (An agent based architecture for preventing and detecting attacks to ubiquitous databases) and shows the results obtained in the case of study.

show abstract

SQLPIL: SQL injection prevention by input labeling

Masri

Sleiman

2015

Security Comm Networks

View full text Add to dashboard Cite

SQL injection attacks (SQLIAs) aim at exploiting vulnerabilities in web applications in order to execute malicious SQL commands. It is established that prepared statements are resilient to SQLIAs, and thus, developers are advised to use them when constructing SQL queries as opposed to applying string concatenation operations. Unfortunately, this recommended programming practice is not as pervasive as it should be. This paper addresses this shortcoming by presenting SQL injection Prevention by Input Labeling (SQLPIL), an effective, light, and fully automated tool that leverages prepared statements to prevent SQLIAs at runtime. Given a Java program in which SQL queries are built as strings, SQLPIL dynamically transforms the strings into secure prepared statements right before their execution, thus guaranteeing that malicious input will always be treated as data and never as SQL commands. We empirically evaluated our Java implementation of SQLPIL using a benchmark that includes five JSP commercial applications, a number of legitimate queries, and a number of attacks of representative types. The results were promising as all attacks were prevented, and all legitimate runs executed successfully; in other words, the technique exhibited no false alarms when applied on typical applications. Also, the runtime cost was acceptable, assuming typical settings. Copyright © 2015 John Wiley & Sons, Ltd.

show abstract

Web application security assessment by fault injection and behavior monitoring

Cited by 40 publications

References 0 publications

An automated black box approach for web vulnerability identification and attack scenario generation

An automated black box approach for web vulnerability identification and attack scenario generation

SiC: An Agent Based Architecture for Preventing and Detecting Attacks to Ubiquitous Databases

SQLPIL: SQL injection prevention by input labeling

Contact Info

Product

Resources

About