Bitte benutzen Sie diese Kennung, um auf die Ressource zu verweisen: https://doi.org/10.21256/zhaw-25347
Publikationstyp: Beitrag in wissenschaftlicher Zeitschrift
Art der Begutachtung: Peer review (Publikation)
Titel: Automating the detection of access control vulnerabilities in web applications
Autor/-in: Rennhard, Marc
Kushnir, Malte
Favre, Olivier
Esposito, Damiano
Zahnd, Valentin
et. al: No
DOI: 10.1007/s42979-022-01271-1
10.21256/zhaw-25347
Erschienen in: SN Computer Science
Band(Heft): 3
Heft: 5
Seite(n): 376
Erscheinungsdatum: 2022
Verlag / Hrsg. Institution: Springer
ISSN: 2661-8907
Sprache: Englisch
Schlagwörter: Automated testing; Web application security testing; Access control testing; Black box security testing; Dynamic web application security testing
Fachgebiet (DDC): 005: Computerprogrammierung, Programme und Daten
Zusammenfassung: The importance of automated and reproducible security testing of web applications is growing, driven by increasing security requirements, short software development cycles, and constraints with respect to time and budget. Existing automated security testing tools are already well suited to detect some types of vulnerabilities, e.g., SQL injection or cross-site scripting vulnerabilities. However, other vulnerability types are much harder to uncover in an automated way. One important representative of this type are access control vulnerabilities, which are highly relevant in practice as they can grant unauthorized users access to security-critical data or functions in web applications. In this paper, a practical solution to automatically detect HTTP GET request-based access control vulnerabilities in web applications is presented. The solution is based on previously proposed ideas, which are extended with novel approaches to enable completely automated access control testing with minimal configuration effort, which in turn enables frequent and reproducible testing. An evaluation with seven web applications based on different technologies demonstrates the general applicability of the solution and that it can automatically uncover most access control vulnerabilities while keeping the number of false positives low.
URI: https://digitalcollection.zhaw.ch/handle/11475/25347
Volltext Version: Publizierte Version
Lizenz (gemäss Verlagsvertrag): CC BY 4.0: Namensnennung 4.0 International
Departement: School of Engineering
Organisationseinheit: Institut für Angewandte Informationstechnologie (InIT)
Publiziert im Rahmen des ZHAW-Projekts: FASTscan: Fully Automated Security Testing with scanmeter
Enthalten in den Sammlungen:Publikationen School of Engineering

Dateien zu dieser Ressource:
Datei Beschreibung GrößeFormat 
2022_Rennhard-etal_Automating-detection-access-control-vulnerabilities.pdf1.46 MBAdobe PDFMiniaturbild
Öffnen/Anzeigen
Zur Langanzeige


Alle Ressourcen in diesem Repository sind urheberrechtlich geschützt, soweit nicht anderweitig angezeigt.