Abstract
To discover web vulnerabilities before they are exploited by malicious attackers, black-box vulnerability scanners scan all the web pages of a web application. However, a web application implemented by several server-side programs with a backend database can generate a massive number of web pages, and may raise an unaffordable time consuming. The root cause of vulnerabilities is the mal-implemented server-side program, instead of any certain web pages that generated by the server-side program. In this paper, an efficient black-box web vulnerability scanning method – handler-ready – is proposed, which highlights the scanning on the server-side programs – handlers – rather than concrete web pages. Handler-ready reduces the HTTP requests of massive web pages to a small number of handlers, and gives the handlers an even chance of being scanned. Therefore, the handler-ready can avoid being stuck with massive web pages that generated by the same handler when scanning. The experimental result shows that the proposed scanning method can discover more vulnerabilities than traditional methods in a limited amount of time.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Martin, R.A., Christey, S.: Vulnerability type distributions in CVE. MITRE Report (2007)
China Software Developer Network (CSDN) leaked 6 million user information. http://www.williamlong.info/archives/2933.html
Blanco, L., Dalvi, N., Machanavajjhala, A.: Highly efficient algorithms for structural clustering of large websites. In: WWW, pp. 437–446 (2011)
Medeiros, I., Neves, N.F., Correia, M.: DEKANT: a static analysis tool that learns to detect web application vulnerabilities. In: ISSTA, pp. 1–11 (2016)
Felmetsger, V., Cavedon, L., Kruegel, C., Vigna, G.: Toward automated detection of logic vulnerabilities in web applications. In: USS, pp. 143–160 (2010)
Halfond, W.G.J., Choudhary, S.R., Orso, A.: Penetration testing with improved input vector identification. In: ICST, pp. 346–355 (2009)
McAllister, S., Kirda, E., Kruegel, C.: Leveraging user interactions for in-depth testing of web applications. In: RAID, pp. 191–210 (2008)
Austin, A., Holmgreen, C., Williams, L.: A comparison of the efficiency and effectiveness of vulnerability discovery techniques. IST 55(7), 1279–1288 (2013)
Doupé, A., Cova, M., Vigna, G.: Why Johnny can’t pentest: an analysis of black-box web vulnerability scanners. In: DIMVA, pp. 111–131 (2010)
Doupé, A., Cavedon, L., Kruegel, C., Vigna, G.: Enemy of the state: a state-aware black-box web vulnerability scanner. In: USS, pp. 523–538 (2012)
Hernndez, I., Rivero, C.R., Ruiz, D., Corchuelo, R.: CALA: classifying links automatically based on their URL. JSS 115, 130–143 (2016)
Grahne, G., Zhu, J.: Fast algorithms for frequent itemset mining using FP-trees. TKDE 17(10), 1347–1362 (2005). https://doi.org/10.1109/TKDE.2005.166
Shezaf, O.: Rest assessment cheat sheet. http://tinyurl.com/mkqd8br
Acknowledgements
This work is supported by the National Key R&D Plan of China under grant no. 2016YFB0800201, the Natural Science Foundation of China under grant no. 61070212 and 61572165, the State Key Program of Zhejiang Province Natural Science Foundation of China under grant no. LZ15F020003, the Key research and development plan project of Zhejiang Province under grant no. 2017C01065, the Key Lab of Information Network Security, Ministry of Public Security, under grant no C16603.
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Jin, H., Xu, M., Yang, X., Wu, T., Zheng, N., Yang, T. (2018). An Efficient Black-Box Vulnerability Scanning Method for Web Application. In: Romdhani, I., Shu, L., Takahiro, H., Zhou, Z., Gordon, T., Zeng, D. (eds) Collaborative Computing: Networking, Applications and Worksharing. CollaborateCom 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 252. Springer, Cham. https://doi.org/10.1007/978-3-030-00916-8_42
Download citation
DOI: https://doi.org/10.1007/978-3-030-00916-8_42
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-00915-1
Online ISBN: 978-3-030-00916-8
eBook Packages: Computer ScienceComputer Science (R0)