An automated black box approach for web vulnerability identification and attack scenario generation - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Journal of the Brazilian Computer Society Année : 2014

An automated black box approach for web vulnerability identification and attack scenario generation

Résumé

Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties of information systems such as confidentiality, integrity, or availability. To cope with these threats, it is necessary to develop efficient security protection mechanisms and assessment techniques (firewall, intrusion detection system, Web scanner, etc.). This paper presents a new methodology, based on Web page clustering techniques, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that it does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such as SQL injections. The proposed methodology led to the development of a new Web vulnerability scanner that has been validated experimentally on several examples of vulnerable applications.
Fichier principal
Vignette du fichier
Jbsc.pdf (610.83 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00985670 , version 1 (30-04-2014)

Identifiants

Citer

Rim Akrout, Eric Alata, Mohamed Kaâniche, Vincent Nicomette. An automated black box approach for web vulnerability identification and attack scenario generation. Journal of the Brazilian Computer Society, 2014, 20 (1), pp.1--16. ⟨10.1186/1678-4804-20-4⟩. ⟨hal-00985670⟩
3839 Consultations
4091 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More