Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications
Avinash Sudhodanan, Alessandro Armando, Roberto Carbone, Luca Compagna · 2016
The advent of Software-as-a-Service (SaaS) has led to the development of multi-party web applications (MPWAs).MPWAs rely on core trusted third-party systems (e.g., payment servers, identity providers) and protocols such as Cashier-as-a-Service (CaaS), Single Sign-On (SSO) to deliver business services to users.Motivated by the large number of attacks discovered against MPWAs and by the lack of a single general-purpose application-agnostic technique to support their discovery, we propose an automatic technique based on attack patterns for black-box, security testing of MPWAs.Our approach stems from the observation that attacks against popular MPWAs share a number of similarities, even if the underlying protocols and services are different.In this paper, we target six different replay attacks, a login CSRF attack and a persistent XSS attack.Firstly, we propose a methodology in which security experts can create attack patterns from known attacks.Secondly, we present a security testing framework that leverages attack patterns to automatically generate test cases for testing the security of MPWAs.We implemented our ideas on top of OWASP ZAP (a popular, open-source penetration testing tool), created seven attack patterns that correspond to thirteen prominent attacks from the literature and discovered twenty one previously unknown vulnerabilities in prominent MPWAs (e.g., twitter.com,