DMCA
Security Testing of Web Applications: a Search Based Approach for Cross-Site Scripting Vulnerabilities
BibTeX
@MISC{Avancini_securitytesting,
author = {Andrea Avancini and Mariano Ceccato},
title = {Security Testing of Web Applications: a Search Based Approach for Cross-Site Scripting Vulnerabilities},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
More and more web applications suffer the presence of cross-site scripting vulnerabilities that could be exploited by attackers to access sensitive information (such as cre-dentials or credit card numbers). Hence proper tests are required to assess the security of web applications. In this paper, we resort to a search based approach for security testing web applications. We take advantage of static analysis to detect candidate cross-site scripting vulnerabilities. Input values that expose these vulnerabil-ities are searched by a genetic algorithm and, to help the genetic algorithm escape local optima, symbolic con-straints are collected at run-time and passed to a solver. Search results represent test cases to be used by software developers to understand and fix security problems. We implemented this approach in a prototype and evaluated it on real world PHP code. I.
Keyphrases
web application security testing cross-site scripting vulnerability symbolic con-straints security problem genetic algorithm candidate cross-site scripting vulnerability access sensitive information test case credit card number hence proper test static analysis search result software developer genetic algorithm escape local optimum real world php code
