liu.seSearch for publications in DiVA
Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Generating web applications containing XSS and CSRF vulnerabilities
Linköpings universitet, Institutionen för datavetenskap, Databas och informationsteknik. Linköpings universitet, Tekniska högskolan.
2014 (engelsk)Independent thesis Advanced level (degree of Master (Two Years)), 20 poäng / 30 hpOppgave
Abstract [en]

Most of the people in the industrial world are using several web applications every day. Many of those web applications contain vulnerabilities that can allow attackers to steal sensitive data from the web application's users. One way to detect these vulnerabilities is to have a penetration tester examine the web application. A common way to train penetration testers to find vulnerabilities is to challenge them with realistic web applications that contain vulnerabilities. The penetration tester's assignment is to try to locate and exploit the vulnerabilities in the web application. Training on the same web application twice will not provide any new challenges to the penetration tester, because the penetration tester already knows how to exploit all the vulnerabilities in the web application. Therefore, a vast number of web applications and variants of web applications are needed to train on.

This thesis describes a tool designed and developed to automatically generate vulnerable web applications. First a web application is prepared, so that the tool can generate a vulnerable version of the web application. The tool injects Cross Site Scripting (XSS) and Cross Site Request Forgery (CSRF) vulnerabilities in prepared web applications. Different variations of the same vulnerability can also be injected, so that different methods are needed to exploit the vulnerability depending on the variation. A purpose of the tool is that it should generate web applications which shall be used to train penetration testers, and some of the vulnerabilities the tool can inject, cannot be detected by current free web application vulnerability scanners, and would thus need to be detected by a penetration tester.

To inject the vulnerabilities, the tool uses abstract syntax trees and taint analysis to detect where vulnerabilities can be injected in the prepared web applications.

Tests confirm that web application vulnerability scanners cannot find all the vulnerabilities on the web applications which have been generated by the tool.

sted, utgiver, år, opplag, sider
2014. , s. 52
Emneord [en]
Web security, CSRF, XSS, Cross Site Request Forgery, Cross Site Scripting, Taint analysis, vulnerability, generating web applications
HSV kategori
Identifikatorer
URN: urn:nbn:se:liu:diva-111652ISRN: LIU-IDA/LITH-EX-A--14/054—SEOAI: oai:DiVA.org:liu-111652DiVA, id: diva2:758641
Fag / kurs
Computer Engineering
Presentation
2014-09-26, Muhammad al-Khwarizmi, 10:15 (svensk)
Veileder
Examiner
Tilgjengelig fra: 2014-11-06 Laget: 2014-10-27 Sist oppdatert: 2018-01-11bibliografisk kontrollert

Open Access i DiVA

Generating web applications containing XSS and CSRF vulnerabilities(1562 kB)851 nedlastinger
Filinformasjon
Fil FULLTEXT01.pdfFilstørrelse 1562 kBChecksum SHA-512
da0122aa96ce55d34a7f0d51714cd02666c8e3cf893a22f413ab39330b0e731041ff3ed31642396b148c7a561f8c14c75a8e57ac01595187c1793bb1aeb16df6
Type fulltextMimetype application/pdf

Søk i DiVA

Av forfatter/redaktør
Ahlberg, Gustav
Av organisasjonen

Søk utenfor DiVA

GoogleGoogle Scholar
Totalt: 851 nedlastinger
Antall nedlastinger er summen av alle nedlastinger av alle fulltekster. Det kan for eksempel være tidligere versjoner som er ikke lenger tilgjengelige

urn-nbn

Altmetric

urn-nbn
Totalt: 3146 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf