TU Darmstadt / ULB / TUbiblio

Supporting Security Testers in Discovering Injection Flaws

Türpe, Sven and Poller, Andreas and Trukenmüller, Jan and Repp, Jürgen and Bornmann, Christian (2008):
Supporting Security Testers in Discovering Injection Flaws.
In: Proc. TAIC-PART 2008, pp. 64-68, ISBN 978-0-7695-3383-4,
DOI: 10.1109/TAIC-PART.2008.7,
[Conference or Workshop Item]

Abstract

We present a platform for software security testing primarily designed to support human testers in discovering injection flaws in distributed systems. Injection is an important class of security faults, caused by unsafe concatenation of input into strings interpreted by other components of the system. Examples include two of the most common security issues in Web applications, SQL injection and cross site scripting. This paper briefly discusses the fault model, derives a testing strategy that should discover a large subset of the injection flaws present, and describes a platform that helps security testers to discover injection flaws through dynamic grey-box testing. Our platform combines the respective strengths of machines and humans, automating what is easily automated while leaving to the tester the artistic portion of security testing. Although designed with a specific fault model in mind, our platform may be useful in a wide range of security testing tasks.

Item Type: Conference or Workshop Item
Erschienen: 2008
Creators: Türpe, Sven and Poller, Andreas and Trukenmüller, Jan and Repp, Jürgen and Bornmann, Christian
Title: Supporting Security Testers in Discovering Injection Flaws
Language: ["languages_typename_1" not defined]
Abstract:

We present a platform for software security testing primarily designed to support human testers in discovering injection flaws in distributed systems. Injection is an important class of security faults, caused by unsafe concatenation of input into strings interpreted by other components of the system. Examples include two of the most common security issues in Web applications, SQL injection and cross site scripting. This paper briefly discusses the fault model, derives a testing strategy that should discover a large subset of the injection flaws present, and describes a platform that helps security testers to discover injection flaws through dynamic grey-box testing. Our platform combines the respective strengths of machines and humans, automating what is easily automated while leaving to the tester the artistic portion of security testing. Although designed with a specific fault model in mind, our platform may be useful in a wide range of security testing tasks.

Title of Book: Proc. TAIC-PART 2008
ISBN: 978-0-7695-3383-4
Uncontrolled Keywords: Secure Services; security testing; tool; vulnerability; SQL injection; cross site scripting; Softwaretest
Divisions: LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
LOEWE > LOEWE-Zentren
LOEWE
Date Deposited: 30 Dec 2016 20:23
DOI: 10.1109/TAIC-PART.2008.7
Identification Number: TUD-CS-2008-1122
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)

View Item View Item