Abstract:This paper concerns about logic vulnerabilities that result from faulty logic of a web application. Logic vulnerabilities typically accompany with the exposure of unexpected functionalities and lead to the bypass of the intended constraints. From a semantic perspective, logic vulnerabilities occur when mistakes arise in the control flows guarding the processes of invoking critical functionalities. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilities in Java web applications. Logic errors in our approach are characterized as erroneous invocations of functionalities. Program‐slicing technique has been leveraged to capture the processes of invoking critical functionalities. A back‐tracing algorithm is originally designed to extract control flows guarding functionality‐invocation processes. Finally, logic vulnerability detection is transformed into mining abnormal functionality‐invocation processes in a cluster of similar ones by comparing these processes' control flows. We implemented our approach in a prototype tool named logic vulnerability detector and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches. Copyright © 2013 John Wiley & Sons, Ltd. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilitiesin Java web applications. We implemented our approach using program‐slicing technique and a back‐tracingextracting algorithm for control flow, and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches.

Static Detection of Un-Trusted Variables in PHP Web Applications

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Supporting secure programming in web applications through interactive static analysis.

Method of Preventing SQL Injection Attack Using PHP

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Automatic Web Security Unit Testing: XSS Vulnerability Detection

Static detection of logic vulnerabilities in Java web applications

Evaluation of Static Analysis on Web Applications

Design and implementation of a web application vulnerability detection system

A Detective Tool Against Sql Injection Attacks Based on Static Analysis and Dynamic Monitor

VulChecker: Achieving More Effective Taint Analysis by Identifying Sanitizers Automatically

A Static Method for Detection of Information Theft Malware

SQL Injection Prevention Based on Sensitive Characters

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

Design and Applying of Web Application Security Detecting System

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

A Survey on XSS Attack Detection and Prevention in Web Applications

JStill: mostly static detection of obfuscated malicious JavaScript code