TY - GEN
T1 - A Search-Based Testing Approach for XML Injection Vulnerabilities in Web Applications
AU - Jan, Sadeeq
AU - Nguyen, Cu D.
AU - Arcuri, Andrea
AU - Briand, Lionel
N1 - Publisher Copyright:
© 2017 IEEE.
PY - 2017/5/15
Y1 - 2017/5/15
N2 - In most cases, web applications communicate with web services (SOAP and RESTful). The former act as a front-end to the latter, which contain the business logic. A hacker might not have direct access to those web services (e.g., they are not on public networks), but can still provide malicious inputs to the web application, thus potentially compromising related services. Typical examples are XML injection attacks that target SOAP communications. In this paper, we present a novel, search-based approach used to generate test data for a web application in an attempt to deliver malicious XML messages to web services. Our goal is thus to detect XML injection vulnerabilities in web applications. The proposed approach is evaluated on two studies, including an industrial web application with millions of users. Results show that we are able to effectively generate test data (e.g., input values in an HTML form) that detect such vulnerabilities.
AB - In most cases, web applications communicate with web services (SOAP and RESTful). The former act as a front-end to the latter, which contain the business logic. A hacker might not have direct access to those web services (e.g., they are not on public networks), but can still provide malicious inputs to the web application, thus potentially compromising related services. Typical examples are XML injection attacks that target SOAP communications. In this paper, we present a novel, search-based approach used to generate test data for a web application in an attempt to deliver malicious XML messages to web services. Our goal is thus to detect XML injection vulnerabilities in web applications. The proposed approach is evaluated on two studies, including an industrial web application with millions of users. Results show that we are able to effectively generate test data (e.g., input values in an HTML form) that detect such vulnerabilities.
KW - Sbst
KW - Security testing
KW - Xml injection
UR - http://www.scopus.com/inward/record.url?scp=85020734249&partnerID=8YFLogxK
U2 - 10.1109/ICST.2017.39
DO - 10.1109/ICST.2017.39
M3 - Conference contribution
AN - SCOPUS:85020734249
T3 - Proceedings - 10th IEEE International Conference on Software Testing, Verification and Validation, ICST 2017
SP - 356
EP - 366
BT - Proceedings - 10th IEEE International Conference on Software Testing, Verification and Validation, ICST 2017
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 10th IEEE International Conference on Software Testing, Verification and Validation, ICST 2017
Y2 - 13 March 2017 through 17 March 2017
ER -