Pellegrino, Giancarlo ; Tschürtz, Constantin ; Bodden, Eric ; Rossow, Christian
Hrsg.: Bos, Herbert ; Monrose, Fabian ; Blanc, Gregory (2015)
jÄk: Using Dynamic Analysis to Crawl and Test Modern Web Applications.
Kyoto, Japan
doi: 10.1007/978-3-319-26362-5
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
Web application scanners are popular tools to perform black box testing and are widely used to discover bugs in websites. For them to work effectively, they either rely on a set of URLs that they can test, or use their own implementation of a crawler that discovers new parts of a web application. Traditional crawlers would extract new URLs by parsing HTML documents and applying static regular expressions. While this approach can extract URLs in classic web applications, it fails to explore large parts of modern JavaScript-based applications.
In this paper, we present a novel technique to explore web applications based on the dynamic analysis of the client-side JavaScript program. We use dynamic analysis to hook JavaScript APIs, which enables us to detect the registration of events, the use of network communication APIs, and dynamically-generated URLs or user forms. We then propose to use a navigation graph to perform further crawling. Based on this new crawling technique, we present jÄk, a web application scanner. We compare jÄk against four existing web-application scanners on 13 web applications. The experiments show that our approach can explore a surface of the web applications that is 86 % larger than with existing approaches.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2015 |
| Herausgeber: | Bos, Herbert ; Monrose, Fabian ; Blanc, Gregory |
| Autor(en): | Pellegrino, Giancarlo ; Tschürtz, Constantin ; Bodden, Eric ; Rossow, Christian |
| Art des Eintrags: | Bibliographie |
| Titel: | jÄk: Using Dynamic Analysis to Crawl and Test Modern Web Applications |
| Sprache: | Deutsch |
| Publikationsjahr: | Dezember 2015 |
| Verlag: | Springer Cham |
| Buchtitel: | Research in Attacks, Intrusions, and Defenses. 18th International Symposium, RAID 2015, Kyoto, Japan,November 2-4, 2015. Proceedings. |
| Reihe: | Lecture Notes in Computer Science 9404 |
| Veranstaltungsort: | Kyoto, Japan |
| DOI: | 10.1007/978-3-319-26362-5 |
| Kurzbeschreibung (Abstract): | Web application scanners are popular tools to perform black box testing and are widely used to discover bugs in websites. For them to work effectively, they either rely on a set of URLs that they can test, or use their own implementation of a crawler that discovers new parts of a web application. Traditional crawlers would extract new URLs by parsing HTML documents and applying static regular expressions. While this approach can extract URLs in classic web applications, it fails to explore large parts of modern JavaScript-based applications. In this paper, we present a novel technique to explore web applications based on the dynamic analysis of the client-side JavaScript program. We use dynamic analysis to hook JavaScript APIs, which enables us to detect the registration of events, the use of network communication APIs, and dynamically-generated URLs or user forms. We then propose to use a navigation graph to perform further crawling. Based on this new crawling technique, we present jÄk, a web application scanner. We compare jÄk against four existing web-application scanners on 13 web applications. The experiments show that our approach can explore a surface of the web applications that is 86 % larger than with existing approaches. |
| Freie Schlagworte: | computer and communication networks data security industry sectors security and privacy telecommunications anomaly detection automata theory botnet tracking electronics intrusion detection systems keylogger malware analysis mobile security network securit |
| ID-Nummer: | TUD-CS-2015-12091 |
| Fachbereich(e)/-gebiet(e): | Profilbereiche Profilbereiche > Cybersicherheit (CYSEC) |
| Hinterlegungsdatum: | 17 Aug 2017 15:15 |
| Letzte Änderung: | 22 Jan 2019 10:19 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum