Abstract:The importance of automated and reproducible security testing of web applications is growing, driven by increasing security requirements, short software development cycles, and constraints with respect to time and budget. Existing automated security testing tools are already well suited to detect some types of vulnerabilities, e.g., SQL injection or cross-site scripting vulnerabilities. However, other vulnerability types are much harder to uncover in an automated way. One important representative of this type are access control vulnerabilities, which are highly relevant in practice as they can grant unauthorized users access to security-critical data or functions in web applications. In this paper, a practical solution to automatically detect HTTP GET request-based access control vulnerabilities in web applications is presented. The solution is based on previously proposed ideas, which are extended with novel approaches to enable completely automated access control testing with minimal configuration effort, which in turn enables frequent and reproducible testing. An evaluation with seven web applications based on different technologies demonstrates the general applicability of the solution and that it can automatically uncover most access control vulnerabilities while keeping the number of false positives low.

Test Method on Code Injection Vulnerabilities of Web Application

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

Test Sql Injection Vulnerabilities In Web Applications Based On Structure Matching

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Design and implementation of a web application vulnerability detection system

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Process Integrity and Its Application in Software Vulnerability Testing

SQL Injection and Code Defence

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Web Vulnerability Scanning Software

RESEARCH ON CROSS-SITE SCRIPTING VULNERABILITY DETECTION METHOD BASED ON DYNAMIC TESTING

Automatic Web Security Unit Testing: XSS Vulnerability Detection

Research on Software Vulnerability Testing Based on Function-Call

Detection and Prevention of Code Injection Attacks on HTML5-Based Apps

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system

The Analysis and Guard of SQL Injection Attack

The Research of Web Application Security Testing

Adaptive Random Testing for XSS Vulnerability

Automating the Detection of Access Control Vulnerabilities in Web Applications

D-WAV: A Web Application Vulnerabilities Detection Tool Using Characteristics of Web Forms