A Formal Approach to Exploiting Multi-stage Attacks Based on File-System Vulnerabilities of Web Applications

Abstract

Web applications require access to the file-system for many different tasks. When analyzing the security of a web application, security analysts should thus consider the impact that file-system operations have on the security of the whole application. Moreover, the analysis should take into consideration how file-system vulnerabilities might interact with other vulnerabilities leading an attacker to breach into the web application. In this paper, we first propose a classification of filesystem vulnerabilities, and then, based on this classification, we present a formal approach that allows one to exploit file-system vulnerabilities. We give a formal representation of web applications, databases and filesystems, and show how to reason about file-system vulnerabilities. We also show how to combine file-system vulnerabilities and SQL-Injection vulnerabilities for the identification of complex, multi-stage attacks. We have developed an automatic tool that implements our approach and we show its efficiency by discussing several real-world case studies, which are witness to the fact that our tool can generate, and exploit, complex attacks that, to the best of our knowledge, no other state-of-the-art-tool for the security of web applications can find.

An OWASP Top Ten Driven Survey on Web Application Protection Methods

“…The authors adopted threat models such as an intruder taking control over a website or a whole part of the network. -Mobster Tool: In [49], the authors introduced the MobSTer tool, which is a Model-based Security Testing Framework that may help security analysts in testing security aspects of WA. This framework combines model-checking procedures with the knowledge obtained from penetration testing guidelines and checklists.…”

Vulnerabilidades en aplicaciones web, amenazas y ataques

“…El alcance específico de la seguridad debe estar claramente definido por los interesados en términos de los activos a los que se aplica la seguridad y las consecuencias contra las que se evalúa la seguridad (Nist, Mcevilley, & Oren, 2016) Con el aumento de las aplicaciones web disponibles y las características proporcionadas, se ha producido un aumento exponencial del número de aplicaciones web. Llegando a exponer datos privados y confidenciales, con compañías y usuarios que se dieron cuenta de que eran víctimas de un ataque (De Meo & Viganó, 2017).…”