An automated black box approach for web vulnerability identification and attack scenario generationReportar como inadecuado

An automated black box approach for web vulnerability identification and attack scenario generation - Descarga este documento en PDF. Documentación en PDF para descargar gratis. Disponible también para leer online.

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique LAAS - Laboratoire d-analyse et d-architecture des systèmes Toulouse

Abstract : Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties of information systems such as confidentiality, integrity, or availability. To cope with these threats, it is necessary to develop efficient security protection mechanisms and assessment techniques firewall, intrusion detection system, Web scanner, etc

This paper presents a new methodology, based on Web page clustering techniques, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that it does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such as SQL injections. The proposed methodology led to the development of a new Web vulnerability scanner that has been validated experimentally on several examples of vulnerable applications.

Keywords : Web application Vulnerabilities Attacks Evaluation Web scanner

Autor: Rim Akrout - Eric Alata - Mohamed Kaâniche - Vincent Nicomette -



Documentos relacionados