Detecting Insufficient Access Control in Web Applications

Noseevich, G.; Petukhov, A.

Авторы: Noseevich G., Petukhov A.
Сборник: SysSec Workshop (SysSec), 2011 First
Год издания: 2011
Место издания: IEEE Computer Society Amsterdam
Первая страница: 11
Последняя страница: 18
DOI: 10.1109/SysSec.2011.28
Аннотация: Web applications have become a de facto standard for delivering services on the internet. Often they contain sensitive data and provide functionality which should be protected from unauthorized access. Explicit access control policies can be leveraged for validating the access control, but, unfortunately, these policies are rarely defined in case of web applications. Previous research shows that access control flaws in web applications may be revealed with black-box analysis, but the existing “differential analysis” approach has certain limitations. We believe that taking the state of the web application into account could help to overcome the limitations of exiting approach. In this paper we propose a novel approach to black-box web application testing, which utilizes a use-case graph. The graph contains classes of actions within the web application and their dependencies. By traversing the graph and applying differential analysis at each step of the traversal, we were able to improve the accuracy of the method. The proposed method was implemented in the proof- of-concept tool AcCoRuTe. Evaluation with several real-world web applications demostrates better results in comparison to simple differential analysis.
Добавил в систему: Петухов Андрей Александрович

	ИСТИНА	Войти в систему Регистрация
	Интеллектуальная Система Тематического Исследования НАукометрических данных
	Главная Поиск Статистика О проекте Помощь

ИСТИНА

Интеллектуальная Система Тематического Исследования НАукометрических данных

Detecting Insufficient Access Control in Web Applicationsстатья

Прикрепленные файлы