Abstract:Unrestricted file upload (UFU) vulnerabilities, especially unrestricted executable file upload (UEFU) vulnerabilities, pose severe security risks to web servers. For instance, attackers can leverage such vulnerabilities to execute arbitrary code to gain the control of a whole web server. Therefore, it is significant to develop effective and efficient methods to detect UFU and UEFU vulnerabilities. Towards this, most state-of-the-art methods are designed based on dynamic testing. Nevertheless, they still entail two critical limitations. 1) They heavily rely on manual efforts, which are error-prone and have poor adaptability. 2) They seldom leverage effective information to guide the testing, resulting in generating a large number of invalid test cases. Such limitations severely hinder the performance of UFU vulnerability detection. In this paper, we propose URadar, an adaptive dynamic testing-based method for detecting UFU and UEFU vulnerabilities. There are three core designs in URadar, including file upload interface identification, file type restriction inference, and invalid mutation combination filtration, which can effectively solve the two limitations of existing methods. To evaluate the performance of URadar, we conduct extensive experiments and compare URadar with state-of-the-art methods (e.g., FUSE, RIPS). In testing 18 web applications, URadar discovers 26 UEFU vulnerabilities, where 8 are new, and 6 have been assigned new CVE/CNNVD IDs. By contrast, FUSE and RIPS find 14 and 2 UEFU vulnerabilities, respectively. To discover the same number of UFU vulnerabilities, FUSE needs to send 73,261 request packets with a time cost of 2,791.1s on average, 23.43 and 20.53 times of the requirements for URadar. The above results demonstrate that URadar significantly outperforms the state-of-the-art methods. In addition, we have open-sourced URadar to facilitate future research on UFU vulnerability detection.

RAT: Reinforcement-Learning-Driven and Adaptive Testing for Vulnerability Discovery in Web Application Firewalls

Generative Pre-trained Transformer-Based Reinforcement Learning for Testing Web Application Firewalls

Evolutionary Multi-Task Injection Testing on Web Application Firewalls

Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls

Automating the Detection of Access Control Vulnerabilities in Web Applications

URadar: Discovering Unrestricted File Upload Vulnerabilities Via Adaptive Dynamic Testing

Adaptive Random Testing for XSS Vulnerability

Finding your way in the testing jungle: a learning approach to web security testing

Group Testing Based Detection of Web Service DDoS Attackers.

An algorithm for detecting SQL injection vulnerability using black-box testing

Design and Application of a Response-Driven Adaptive Test System

AdvSQLi: Generating Adversarial SQL Injections Against Real-World WAF-as-a-Service

Exploring Defense of SQL Injection Attack in Penetration Testing

Raijū: Reinforcement Learning-Guided Post-Exploitation for Automating Security Assessment of Network Systems

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks

ML-FEED: Machine Learning Framework for Efficient Exploit Detection

AdamW-RSO DBN: AdamW-Rat Swarm Optimized deep belief network for software vulnerability detection

AIM: Automated Input Set Minimization for Metamorphic Security Testing

An Automated Penetration Testing Framework Based on Hierarchical Reinforcement Learning

Enhanced Study of Deep Learning Algorithms for Web Vulnerability Scanner