Automated and Effective Testing of Web Services for XML Injection Attacks
English
Jan, Sadeeq[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Nguyen, Duy Cu[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Briand, Lionel[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
18-Jul-2016
ISSTA'16-The International Symposium on Software Testing and Analysis, Saarbrücken 18-20 July 2016
12-23
Yes
No
International
ISSTA'16-The International Symposium on Software Testing and Analysis
18-07-2016 to 20-07-2016
ACM SIGSOFT
Saarbrücken
Germany
[en] XML Injection ; Security Testing ; Constraint Solving
[en] XML is extensively used in web services for integration and data exchange. Its popularity and wide adoption make it an attractive target for attackers and a number of XML-based attack types have been reported recently. This raises the need for cost-effective, automated testing of web services to detect XML-related vulnerabilities, which is the focus of this paper. We discuss a taxonomy of the types of XML injection attacks and use it to derive four different ways to mutate XML messages, turning them into attacks (tests) automatically. Further, we consider domain constraints and attack grammars, and use a constraint solver to generate XML messages that are both malicious and valid, thus making it more difficult for any protection mechanism to recognise them. As a result, such messages have a better chance to detect vulnerabilities.
Our evaluation on an industrial case study has shown that a large proportion (78.86%) of the attacks generated using our approach could circumvent the first layer of security protection, an XML gateway (firewall), a result that is much better than what a state-of-the-art tool based on fuzz testing could achieve.
Interdisciplinary Centre for Security, Reliability and Trust-University of Luxembourg