Please use this identifier to cite or link to this item:
https://doi.org/10.21256/zhaw-25347| Publication type: | Article in scientific journal |
| Type of review: | Peer review (publication) |
| Title: | Automating the detection of access control vulnerabilities in web applications |
| Authors: | Rennhard, Marc Kushnir, Malte Favre, Olivier Esposito, Damiano Zahnd, Valentin |
| et. al: | No |
| DOI: | 10.1007/s42979-022-01271-1 10.21256/zhaw-25347 |
| Published in: | SN Computer Science |
| Volume(Issue): | 3 |
| Issue: | 5 |
| Page(s): | 376 |
| Issue Date: | 2022 |
| Publisher / Ed. Institution: | Springer |
| ISSN: | 2661-8907 |
| Language: | English |
| Subjects: | Automated testing; Web application security testing; Access control testing; Black box security testing; Dynamic web application security testing |
| Subject (DDC): | 005: Computer programming, programs and data |
| Abstract: | The importance of automated and reproducible security testing of web applications is growing, driven by increasing security requirements, short software development cycles, and constraints with respect to time and budget. Existing automated security testing tools are already well suited to detect some types of vulnerabilities, e.g., SQL injection or cross-site scripting vulnerabilities. However, other vulnerability types are much harder to uncover in an automated way. One important representative of this type are access control vulnerabilities, which are highly relevant in practice as they can grant unauthorized users access to security-critical data or functions in web applications. In this paper, a practical solution to automatically detect HTTP GET request-based access control vulnerabilities in web applications is presented. The solution is based on previously proposed ideas, which are extended with novel approaches to enable completely automated access control testing with minimal configuration effort, which in turn enables frequent and reproducible testing. An evaluation with seven web applications based on different technologies demonstrates the general applicability of the solution and that it can automatically uncover most access control vulnerabilities while keeping the number of false positives low. |
| URI: | https://digitalcollection.zhaw.ch/handle/11475/25347 |
| Fulltext version: | Published version |
| License (according to publishing contract): | CC BY 4.0: Attribution 4.0 International |
| Departement: | School of Engineering |
| Organisational Unit: | Institute of Applied Information Technology (InIT) |
| Published as part of the ZHAW project: | FASTscan: Fully Automated Security Testing with scanmeter |
| Appears in collections: | Publikationen School of Engineering |
Files in This Item:
| File | Description | Size | Format | |
|---|---|---|---|---|
| 2022_Rennhard-etal_Automating-detection-access-control-vulnerabilities.pdf | 1.46 MB | Adobe PDF |  View/Open |
Show full item record
Rennhard, M., Kushnir, M., Favre, O., Esposito, D., & Zahnd, V. (2022). Automating the detection of access control vulnerabilities in web applications. SN Computer Science, 3(5), 376. https://doi.org/10.1007/s42979-022-01271-1
Rennhard, M. et al. (2022) ‘Automating the detection of access control vulnerabilities in web applications’, SN Computer Science, 3(5), p. 376. Available at: https://doi.org/10.1007/s42979-022-01271-1.
M. Rennhard, M. Kushnir, O. Favre, D. Esposito, and V. Zahnd, “Automating the detection of access control vulnerabilities in web applications,” SN Computer Science, vol. 3, no. 5, p. 376, 2022, doi: 10.1007/s42979-022-01271-1.
RENNHARD, Marc, Malte KUSHNIR, Olivier FAVRE, Damiano ESPOSITO und Valentin ZAHND, 2022. Automating the detection of access control vulnerabilities in web applications. SN Computer Science. 2022. Bd. 3, Nr. 5, S. 376. DOI 10.1007/s42979-022-01271-1
Rennhard, Marc, Malte Kushnir, Olivier Favre, Damiano Esposito, and Valentin Zahnd. 2022. “Automating the Detection of Access Control Vulnerabilities in Web Applications.” SN Computer Science 3 (5): 376. https://doi.org/10.1007/s42979-022-01271-1.
Rennhard, Marc, et al. “Automating the Detection of Access Control Vulnerabilities in Web Applications.” SN Computer Science, vol. 3, no. 5, 2022, p. 376, https://doi.org/10.1007/s42979-022-01271-1.
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.