Reference : Automated and Effective Testing of Web Services for XML Injection Attacks
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/27070
Automated and Effective Testing of Web Services for XML Injection Attacks
English
Jan, Sadeeq mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Nguyen, Duy Cu mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Briand, Lionel mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
18-Jul-2016
ISSTA'16-The International Symposium on Software Testing and Analysis, Saarbrücken 18-20 July 2016
12-23
Yes
No
International
ISSTA'16-The International Symposium on Software Testing and Analysis
18-07-2016 to 20-07-2016
ACM SIGSOFT
Saarbrücken
Germany
[en] XML Injection ; Security Testing ; Constraint Solving
[en] XML is extensively used in web services for integration and data exchange. Its popularity and wide adoption make it an attractive target for attackers and a number of XML-based attack types have been reported recently. This raises the need for cost-effective, automated testing of web services to detect XML-related vulnerabilities, which is the focus of this paper. We discuss a taxonomy of the types of XML injection attacks and use it to derive four different ways to mutate XML messages, turning them into attacks (tests) automatically. Further, we consider domain constraints and attack grammars, and use a constraint solver to generate XML messages that are both malicious and valid, thus making it more difficult for any protection mechanism to recognise them. As a result, such messages have a better chance to detect vulnerabilities.
Our evaluation on an industrial case study has shown that a large proportion (78.86%) of the attacks generated using our approach could circumvent the first layer of security protection, an XML gateway (firewall), a result that is much better than what a state-of-the-art tool based on fuzz testing could achieve.
Interdisciplinary Centre for Security, Reliability and Trust-University of Luxembourg
Fonds National de la Recherche - FnR
Researchers ; Professionals ; Students
http://hdl.handle.net/10993/27070
FnR ; FNR6024200 > Sadeeq Jan > > An Effective Automated Testing approach for Detection of XML Injection > 15/09/2013 > 14/09/2016 > 2013

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Limited access
Final_ISSTA16_xmli_CMR.pdfAuthor postprint843.31 kBRequest a copy

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.