Search-based multi-vulnerability testing of XML injections in web applications

Abstract

Modern web applications often interact with internal web services, which are not directly accessible to users. However, malicious user inputs can be used to exploit security vulnerabilities in web services through the application front-ends. Therefore, testing techniques have been proposed to reveal security flaws in the interactions with back-end web services, e.g., XML Injections (XMLi). Given a potentially malicious message between a web application and web services, search-based techniques have been used to find input data to mislead the web application into sending such a message, possibly compromising the target web service. However, state-of-the-art techniques focus on (search for) one single malicious message at a time. Since, in practice, there can be many different kinds of malicious messages, with only a few of them which can possibly be generated by a given front-end, searching for one single message at a time is ineffective and may not scale. To overcome these limitations, we propose a novel co-evolutionary algorithm (COMIX) that is tailored to our problem and uncover multiple vulnerabilities at the same time. Our experiments show that COMIX outperforms a single-target search approach for XMLi and other multi-target search algorithms originally defined for white-box unit testing.

Development of a browser extension for web application vulnerability detection, avoidance, and secure browsing (VDAS)

“…A vulnerability scanner is a software application that assesses security vulnerabilities in networks or host systems and creates a bunch of scan results that are frequently utilized to set vulnerability evaluation particularly during the process of development [7][8][9][10]. Usually, vulnerability scanner detects vulnerabilities that are originated from vendors, system administration activities, or general activities by users.…”

Evolutionary Algorithms in Web Security: Exploring Untapped Potential

“…Table I reports that 3 out of the 16 studies have applied EAs within the context of SQL injection, 6 have applied them within the context of cross-site scripting, and 7 have applied them to other areas of Web Security. Of the 7 studies applying EAs to other areas of Web Security 3 focus on spam email [25], [27], [28], 1 focuses on XML injection [29], 1 targets published vulnerabilities in a server program [30], 1 considers denial-of-service attacks [26], and 1 generates CAPTCHAs [24].…”

JCOMIX: a search-based tool to detect XML injection vulnerabilities in web applications

“…Researchers have proposed various testing techniques to find vulnerabilities in front-end web applications [1,2,6,8,10,11,18], and their validation and sanitization routines in particular. Whitebox techniques (e.g., [6,18]) have been used in the literature to detect various types of vulnerabilities, such as SQL Injection and Cross-site Scripting.…”

“…These techniques require that the source code (or bytecode) of the web applications (both front-end and internal services) is available to the tester, that the internal working can be observed through instrumentation, and are language dependent. Instead, black-box techniques [1,2,8,10,11] identify vulnerabilities by inspecting the user-supplied inputs and the output generated by web applications. Note that there is no one-to-one mapping between user inputs and test output because input are processed and transformed by the SUT.…”

“…However, fuzzers are not very effective for complex vulnerabilities [9], i.e., vulnerabilities that cannot be exploited by injecting few meta-characters in one single input text box. Recently, Jan et al [8,10,11] applied different search-based testing algorithms suitably defined for XMLi, such as traditional genetic algorithms (GAs), many-objective GAs, local solvers and co-evolutionary algorithms. Their study showed that search-based approaches outperform random fuzzing [10] and that co-evolutionary algorithms discover more XMLi vulnerabilities than other search algorithms [11].…”