Automatic Web Security Unit Testing: XSS Vulnerability Detection

Automatic Web Security Unit Testing: XSS Vulnerability Detection. Mohammadi, M., Chu, B., Lipford, H. R., & Murphy-Hill, E. In Proceedings of the 11th International Workshop on Automation of Software Test, of AST '16, pages 78–84, New York, NY, USA, 2016. ACM.

Paper doi abstract bibtex

Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an automatic testing approach to detect a common type of Cross Site Scripting (XSS) vulnerability caused by improper encoding of untrusted data. We automatically extract encoding functions used in a web application to sanitize untrusted inputs and then evaluate their effectiveness by automatically generating XSS attack strings. Our evaluations show that this technique can detect 0-day XSS vulnerabilities that cannot be found by static analysis tools. We will also show that our approach can efficiently cover a common type of XSS vulnerability. This approach can be generalized to test for input validation against other types injections such as command line injection.

@inproceedings{Mohammadi2016Automatic,
    abstract = {{Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an automatic testing approach to detect a common type of Cross Site Scripting (XSS) vulnerability caused by improper encoding of untrusted data. We automatically extract encoding functions used in a web application to sanitize untrusted inputs and then evaluate their effectiveness by automatically generating XSS attack strings. Our evaluations show that this technique can detect 0-day XSS vulnerabilities that cannot be found by static analysis tools. We will also show that our approach can efficiently cover a common type of XSS vulnerability. This approach can be generalized to test for input validation against other types injections such as command line injection.}},
    address = {New York, NY, USA},
    author = {Mohammadi, Mahmoud and Chu, Bill and Lipford, Heather R. and Murphy-Hill, Emerson},
    booktitle = {Proceedings of the 11th International Workshop on Automation of Software Test},
    citeulike-article-id = {14104186},
    citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=2896921.2896929},
    citeulike-linkout-1 = {http://dx.doi.org/10.1145/2896921.2896929},
    doi = {10.1145/2896921.2896929},
    howpublished = {4. Workshop},
    isbn = {978-1-4503-4151-6},
    keywords = {security},
    location = {Austin, Texas},
    pages = {78--84},
    posted-at = {2016-07-29 18:23:41},
    priority = {2},
    publisher = {ACM},
    series = {AST '16},
    title = {{Automatic Web Security Unit Testing: XSS Vulnerability Detection}},
    url = {http://dx.doi.org/10.1145/2896921.2896929},
    year = {2016}
}

Downloads: 0

{"_id":"nb4mgX5xYeQaghDfz","bibbaseid":"mohammadi-chu-lipford-murphyhill-automaticwebsecurityunittestingxssvulnerabilitydetection-2016","downloads":0,"creationDate":"2017-02-09T04:44:05.954Z","title":"Automatic Web Security Unit Testing: XSS Vulnerability Detection","author_short":["Mohammadi, M.","Chu, B.","Lipford, H. R.","Murphy-Hill, E."],"year":2016,"bibtype":"inproceedings","biburl":"https://raw.githubusercontent.com/DeveloperLiberationFront/bibtex-library/master/our-papers.bib","bibdata":{"bibtype":"inproceedings","type":"inproceedings","abstract":"Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an automatic testing approach to detect a common type of Cross Site Scripting (XSS) vulnerability caused by improper encoding of untrusted data. We automatically extract encoding functions used in a web application to sanitize untrusted inputs and then evaluate their effectiveness by automatically generating XSS attack strings. Our evaluations show that this technique can detect 0-day XSS vulnerabilities that cannot be found by static analysis tools. We will also show that our approach can efficiently cover a common type of XSS vulnerability. This approach can be generalized to test for input validation against other types injections such as command line injection.","address":"New York, NY, USA","author":[{"propositions":[],"lastnames":["Mohammadi"],"firstnames":["Mahmoud"],"suffixes":[]},{"propositions":[],"lastnames":["Chu"],"firstnames":["Bill"],"suffixes":[]},{"propositions":[],"lastnames":["Lipford"],"firstnames":["Heather","R."],"suffixes":[]},{"propositions":[],"lastnames":["Murphy-Hill"],"firstnames":["Emerson"],"suffixes":[]}],"booktitle":"Proceedings of the 11th International Workshop on Automation of Software Test","citeulike-article-id":"14104186","citeulike-linkout-0":"http://portal.acm.org/citation.cfm?id=2896921.2896929","citeulike-linkout-1":"http://dx.doi.org/10.1145/2896921.2896929","doi":"10.1145/2896921.2896929","howpublished":"4. Workshop","isbn":"978-1-4503-4151-6","keywords":"security","location":"Austin, Texas","pages":"78–84","posted-at":"2016-07-29 18:23:41","priority":"2","publisher":"ACM","series":"AST '16","title":"Automatic Web Security Unit Testing: XSS Vulnerability Detection","url":"http://dx.doi.org/10.1145/2896921.2896929","year":"2016","bibtex":"@inproceedings{Mohammadi2016Automatic,\n abstract = {{Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an automatic testing approach to detect a common type of Cross Site Scripting (XSS) vulnerability caused by improper encoding of untrusted data. We automatically extract encoding functions used in a web application to sanitize untrusted inputs and then evaluate their effectiveness by automatically generating XSS attack strings. Our evaluations show that this technique can detect 0-day XSS vulnerabilities that cannot be found by static analysis tools. We will also show that our approach can efficiently cover a common type of XSS vulnerability. This approach can be generalized to test for input validation against other types injections such as command line injection.}},\n address = {New York, NY, USA},\n author = {Mohammadi, Mahmoud and Chu, Bill and Lipford, Heather R. and Murphy-Hill, Emerson},\n booktitle = {Proceedings of the 11th International Workshop on Automation of Software Test},\n citeulike-article-id = {14104186},\n citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=2896921.2896929},\n citeulike-linkout-1 = {http://dx.doi.org/10.1145/2896921.2896929},\n doi = {10.1145/2896921.2896929},\n howpublished = {4. Workshop},\n isbn = {978-1-4503-4151-6},\n keywords = {security},\n location = {Austin, Texas},\n pages = {78--84},\n posted-at = {2016-07-29 18:23:41},\n priority = {2},\n publisher = {ACM},\n series = {AST '16},\n title = {{Automatic Web Security Unit Testing: XSS Vulnerability Detection}},\n url = {http://dx.doi.org/10.1145/2896921.2896929},\n year = {2016}\n}\n\n","author_short":["Mohammadi, M.","Chu, B.","Lipford, H. R.","Murphy-Hill, E."],"key":"Mohammadi2016Automatic","id":"Mohammadi2016Automatic","bibbaseid":"mohammadi-chu-lipford-murphyhill-automaticwebsecurityunittestingxssvulnerabilitydetection-2016","role":"author","urls":{"Paper":"http://dx.doi.org/10.1145/2896921.2896929"},"keyword":["security"],"metadata":{"authorlinks":{"murphy-hill, e":"https://people.engr.ncsu.edu/"}}},"search_terms":["automatic","web","security","unit","testing","xss","vulnerability","detection","mohammadi","chu","lipford","murphy-hill"],"keywords":["security"],"authorIDs":["4KwxDBamuQtjZni7K","55jJ2Lc9v3TK3fHns","589bfd0d45eb15981e000020","5YhXs8cRYCk6k3iGv","5dea527bddb5e6df010000a3","5dee7c55fc4c19df01000071","5df1b6c280f800de010000c9","5df3c413580920de01000077","5df3cf5b580920de0100013c","5df75925182af9de010001c6","5df783da5c8a36df01000095","5df8c900e6b510df0100019f","5df9d65f38a7afde01000075","5dfa9f9e669fc3df01000117","5dfafdf4a8dc13ee01000006","5dfd0c6fea1680de010000eb","5dfd2ddbece35ede01000177","5e00e186ea72ecdf010000af","5e00f5ec08c773de0100008f","5e0268302862b0de0100005e","5e026e2a2862b0de0100009b","5e02d7ae410ebcdf0100004c","5e041ae10fe3b7df010000b3","5e0de74f45d2fdde0100002b","5e12c19270e2c4f201000036","5e16042df67f7dde01000002","5e199a2b204503de0100007c","5e1a3d583a430ede010000a0","5e1f6763e8f5ddde01000146","5e2544d3561b8fde010000d7","5e262ca924c8a6de0100001d","5e35bc1487b1e1de010000ec","5e37ad97e84c4cf201000098","5e395ebffa3db5df01000124","5e3ace07f2a00cdf010001bd","5e4171c6d9f47bee010000d1","5e419c768491fadf010001cf","5e43cf0944c4f9df01000209","5e4455ebdf3c2af301000147","5e4d8cf7d2986bde01000154","5e51fbb58240c0df0100009c","5e5479f47f0f44de010000b9","5e5578dbe11ab9df010000d5","5e5d5d8ead47bcde010000cc","5e5feab35241b5de01000143","5e6016dbc064fcde010000c2","5e68e6e11a389bdf010001b3","6eTKqREGJrtq3tnZM","92u6mdCESihxh5ntL","9Qn2KzwH4WFGGPWa9","B7z3EKM6rNLDciXyM","BAXJ53MbTC8abhDwT","BHZMAgT3vhzXztYx9","C8QbMbtPPmy5DJwob","CHgxzmxzLHAL8GixP","DApKEKiXriLAseHCr","DYPjRfegsNR67woei","DhNETDpyEfBLpDf8C","DxEpvEgCZXrTmM6zj","EaPBxKZtEb5N8XgYD","FbQupDQXSSAgeoh5g","FintF329QJDpJWzTh","HDDcxPQiEQ944E3Au","HHEAmTDo7JZq9W7ZT","J29cuzotXhgK8bpb6","L2osMpNGAwn4NHjbb","LWfjwfjFPJHTTbTZA","LtiopnrELztGZFoiC","Pi54RN6KBzHGyDRnB","QH73YvgT48mEmYDnk","QXKgqpsqwTHfpC9Fi","SHJmdvyYiEBK9YQpz","SgMxqhouqxL8tMaus","SsvgmxmW93nQJKPfZ","TBq5krjwGNocRMbts","TFrrbLLCHcXMBdgc3","X5DGgTpnyTyPR7a5h","XeRQ7NpnZP6ZNr2vP","bBgpuShQZoAvyP6EY","btpyAF3Me8PunuGHa","cqvH7qYjg2CFDbs3C","cxBWjbyTwmeZL6j3M","czdG4YkZnTSCYyg7T","drCZKqmYEKrJT2yDT","dxPqF7TGd2crSkpns","fEes37cobF4YfyMY6","gnbqqkoEbEPCmzvvJ","hYnuzdEe3swq9A4di","i2h4cFtAg2WwdjjyQ","ipRg8AW5QzftH2yCm","jG3oe6BXzhYySQ68L","kiLtLvgEdDfauDAcg","mmQQQL6xtzu2zz9iW","nXP7rWymg4cjcn44q","npiycu9QvjSqPAzjb","riPiKvw9a7fgwfH4F","sq2rTZrxzLgcY2zrc","t8DMAu4fGHoCFaLe5","ufMJtsYPDLDPZbTYS","ukoLMrPpXZy4574DM","vxhCcDCkuNgjF7H4X","x3qLc7DMPKF5FR8SA","yKJGc9aXvBwP4utwc"],"dataSources":["nHDichzRuRdGMsJQG","cfNfJKkdJZ7LeZWkg"]}