Derailer

Abstract

Derailer is an interactive tool for finding security bugs in web applications. Using symbolic execution, it enumerates the ways in which application data might be exposed. The user is asked to examine these exposures and classify the conditions under which they occur as security-related or not; in so doing, the user effectively constructs a specification of the application's security policy. The tool then highlights exposures missing security checks, which tend to be security bugs.We have tested Derailer's scalability on several large opensource Ruby on Rails applications. We have also applied it to a large number of student projects (designed with different security policies in mind), exposing a variety of security bugs that eluded human reviewers.

SymNav: Visually Assisting Symbolic Execution

“…Of a different flavor is Derailer [32]: for security assessments of Web applications, it uses symbolic execution to identify when and how their data gets exposed. The user inspects and evaluates the identified conditions for security concerns, then Derailer points out missing security checks in sensitive areas.…”

“…The user inspects and evaluates the identified conditions for security concerns, then Derailer points out missing security checks in sensitive areas. [32] pursues different goals than ours: symbolic execution is the key to obtain exposure data involving specific APIs, but scalability and other concerns typical of a general usage are out of scope. Yet we mention it as one of the few cases where users deal with data (indirectly) derived from a symbolic exploration.…”

Method Using Command Abstraction Library for Iterative Testing Security of Web Applications

“…In general, static data flow analysis of a dynamic programming language is difficult to due to the dynamic behavior. Static analysis techniques have been applied to Rails to identify vulnerabilities by several researchers (Chaudhuri and Foster, 2010) (Doupé et al, 2011) (Near and Jackson, 2014).…”

“…Near and Jackson developed a tool called Derailer that performs symbolic execution of Rails by hijacking the existing Ruby runtime. It provides an interactive interface that enables a user to construct the specifications for the application security policy (Near and Jackson, 2014). Our approach also hides the detail of Rails frameworks by preparing a CALib.…”

Platinum: Reusing Constraint Solutions in Bounded Analysis of Relational Logic

“…Software verification provides the highest degree of software assurance, with its strengths residing in the mathematical concepts that can be leveraged to prove correctness with respect to specific properties. Most notably, bounded verification techniques, such as Alloy [28], have recently received a great deal of attention in the software engineering community (e.g., [8,9,11,13,14,16,20,26,34,35,38,43,46,48,52,54,55,61,63,66]), due to the strength of their automated, yet formally precise, analysis capabilities. The basic idea behind these techniques is to construct a formula that encodes the behavior of a system and examine it up to a user-specified bound.…”