Metamorphic Security Testing for Web Systems

X., Phu; Pastore, Fabrizio; Göknil, Arda; Briand, Lionel C.

doi:10.1109/icst46399.2020.00028

Cited by 21 publications

(11 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can more easily detect bugs that are difficult to find by testing Black Box Testing or other testing methods. Therefore, a White Box Tester should know programming structures [28]. The test that will be carried out is a direct attack experiment using a MITM attack.…”

Section: Methodsmentioning

confidence: 99%

Block-hash of blockchain framework against man-in-the-middle attacks

Riadi

Umar

Busthomi

et al. 2021

regist. j. ilm. teknol. sist. inf.

View full text Add to dashboard Cite

Payload authentication is vulnerable to Man-in-the-middle (MITM) attack. Blockchain technology offers methods such as peer to peer, block hash, and proof-of-work to secure the payload of authentication process. The implementation uses block hash and proof-of-work methods on blockchain technology and testing is using White-box-testing and security tests distributed to system security practitioners who are competent in MITM attacks. The analyisis results before implementing Blockchain technology show that the authentication payload is still in plain text, so the data confidentiality has not minimize passive voice. After implementing Blockchain technology to the system, white-box testing using the Wireshark gives the result that the authentication payload sent has been well encrypted and safe enough. The percentage of security test results gets 95% which shows that securing the system from MITM attacks is relatively high. Although it has succeeded in securing the system from MITM attacks, it still has a vulnerability from other cyber attacks, so implementation of the Blockchain needs security improvisation.

show abstract

Section: Methodsmentioning

confidence: 99%

Block-hash of blockchain framework against man-in-the-middle attacks

Riadi

Umar

Busthomi

et al. 2021

regist. j. ilm. teknol. sist. inf.

View full text Add to dashboard Cite

show abstract

“…In addition to pure functional testing approaches, works in the field of security testing are starting to rise [27][28][29][30], in order to find potential security vulnerabilities in REST APIs. In particular, Mai et al [27] use metamorphic relations to address the oracle problem: 22 system-agnostic metamorphic relations are defined in order to automate security testing in web systems. Atlidakis et al [28] introduce four security rules that capture desirable properties of REST APIs.…”

Section: Related Workmentioning

confidence: 99%

Automated black‐box testing of nominal and error scenarios in RESTful APIs

Corradini

Zampieri

Pasqua

et al. 2022

Software Testing Verif & Rel

View full text Add to dashboard Cite

RESTful APIs (or REST APIs for short) represent a mainstream approach to design and develop web APIs using the REpresentational State Transfer architectural style. Black-box testing, which assumes only the access to the system under test with a specific interface, is the only viable option when white-box testing is impracticable. This is the case for REST APIs: their source code is usually not (or just partially) available, or a white-box analysis across many dynamically allocated distributed components (typical of a microservices architecture) is computationally challenging. This paper presents RESTTESTGEN, a novel black-box approach to automatically generate test cases for REST APIs, based on their interface definition (an OpenAPI specification). Input values and requests are generated for each operation of the API under test with the twofold objective of testing nominal execution scenarios and error scenarios. Two distinct oracles are deployed to detect when test cases reveal implementation defects. While this approach is mainly targeting the research community, it is also of interest to developers because, as a black-box approach, it is universally applicable across different programming languages, or in the case external (compiled only) libraries are used in a REST API. The validation of our approach has been performed on more than 100 of realworld REST APIs, highlighting the effectiveness of the approach in revealing actual faults in already deployed services. K E Y W O R D S automatic test case generation, black-box testing, REST APIs, test oracle | INTRODUCTIONREST APIs are the de-facto standard to implement and grant remote access to web APIs. They are so largely accepted and adopted that the Berlin Group Initiative 1 elaborated a standard based on REST APIs for unifying the European Banking APIs. This initiative was meant to address the PSD2 European Union directive 2 that requested banks to open their customer data to authorized third-party service providers. Moreover, reference implementations of PSD2 compliant banking APIs are mostly available in the form of REST APIs. 3 REST APIs are often components of micro-services architectures [1], according to which, each component should be small and assigned just one (or very few) responsibilities, resulting in a high number of simple components. Distinct components are usually deployed in different containers that can be dynamically allocated and deallocated, possibly across different hosts (for load balancing). 1 https://www.berlin-group.org/ 2 https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en 3 https://www.openbankproject.com/

show abstract

“…Software testing is a well-researched discipline, and every year, new articles add more information to the general knowledge [1,2,4,6,8,12,13,17,23,29]. Therefore, we can only refer to a fraction of all available and valuable testing research.…”

Section: Related Workmentioning

confidence: 99%