Paper published in a book (Scientific congresses, symposiums and conference proceedings)
Automated and Effective Testing of Web Services for XML Injection Attacks
Jan, Sadeeq; Nguyen, Duy Cu; Briand, Lionel
2016In ISSTA'16-The International Symposium on Software Testing and Analysis, Saarbrücken 18-20 July 2016
Peer reviewed
 

Files


Full Text
Final_ISSTA16_xmli_CMR.pdf
Author postprint (863.55 kB)
Request a copy

All documents in ORBilu are protected by a user license.

Send to



Details



Keywords :
XML Injection; Security Testing; Constraint Solving
Abstract :
[en] XML is extensively used in web services for integration and data exchange. Its popularity and wide adoption make it an attractive target for attackers and a number of XML-based attack types have been reported recently. This raises the need for cost-effective, automated testing of web services to detect XML-related vulnerabilities, which is the focus of this paper. We discuss a taxonomy of the types of XML injection attacks and use it to derive four different ways to mutate XML messages, turning them into attacks (tests) automatically. Further, we consider domain constraints and attack grammars, and use a constraint solver to generate XML messages that are both malicious and valid, thus making it more difficult for any protection mechanism to recognise them. As a result, such messages have a better chance to detect vulnerabilities. Our evaluation on an industrial case study has shown that a large proportion (78.86%) of the attacks generated using our approach could circumvent the first layer of security protection, an XML gateway (firewall), a result that is much better than what a state-of-the-art tool based on fuzz testing could achieve.
Research center :
Interdisciplinary Centre for Security, Reliability and Trust-University of Luxembourg
Disciplines :
Computer science
Author, co-author :
Jan, Sadeeq ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Nguyen, Duy Cu ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Briand, Lionel ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
External co-authors :
no
Language :
English
Title :
Automated and Effective Testing of Web Services for XML Injection Attacks
Publication date :
18 July 2016
Event name :
ISSTA'16-The International Symposium on Software Testing and Analysis
Event organizer :
ACM SIGSOFT
Event place :
Saarbrücken, Germany
Event date :
18-07-2016 to 20-07-2016
Audience :
International
Main work title :
ISSTA'16-The International Symposium on Software Testing and Analysis, Saarbrücken 18-20 July 2016
Pages :
12-23
Peer reviewed :
Peer reviewed
Focus Area :
Security, Reliability and Trust
FnR Project :
FNR6024200 - An Effective Automated Testing Approach For Detection Of Xml Injection, 2013 (15/09/2013-14/09/2017) - Sadeeq Jan
Funders :
FNR - Fonds National de la Recherche [LU]
Available on ORBilu :
since 10 May 2016

Statistics


Number of views
361 (36 by Unilu)
Number of downloads
3 (2 by Unilu)

Scopus citations®
 
18
Scopus citations®
without self-citations
13

Bibliography


Similar publications



Contact ORBilu