Non-detrimental Web application security scanning
Resource
Software Reliability Engineering, 2004. ISSRE 2004. 15th International Symposium on
Journal
15th International Symposium on Software Reliability Engineering, 2004. ISSRE 2004
Pages
219-230
Date Issued
2004-11
Date
2004-11
Author(s)
DOI
1071-9458
Abstract
The World Wide Web has become a sophisticated platform capable of delivering a broad range of applications. However, its rapid growth has resulted in numerous security problems that current technologies cannot address. Researchers from both academic and private sector are devoting a considerable amount of resources to the development of Web application security scanners (i.e., automated software testing platforms for Web application security auditing) with some success. However, little is known about their potential side effects. It is possible for an auditing process to induce permanent changes in an application's state. Due to this potential, we have so far avoided large-scale empirical evaluations of our Web Application Vulnerability and Error Scanner (WAVES). In this paper we introduce a testing methodology that allows for harmless auditing, define three testing modes-heavy, relaxed, and safe modes, and report our results from two experiments. In the first, we compared the coverage and side effects of the three scanning modes using 5 real-world Web applications chosen from the 38 found vulnerable in a previous static verification effort. In the second, we used the relaxed mode to conduct a 48-hour test involving 1120 random websites, of which 55 were found to be vulnerable. © 2004 IEEE.
SDGs
Other Subjects
Cross-site scripting; Real-world application; Security scanning; Web applications; Computer crime; Computer system firewalls; Electronic mail; Gateways (computer networks); HTTP; Real time systems; Security of data; Software engineering; Websites; World Wide Web
Type
conference paper
File(s)![Thumbnail Image]()
Loading...
Name
01383120.pdf
Size
304.56 KB
Format
Adobe PDF
Checksum
(MD5):bbaa0b838763540c07f4d47cc7ba2375