Semi-Automatic Security Testing of Web Applications with Fault Models and Properties
Matthias Büchler · 2015
Web applications are complex and face complex attacks, as well. Thus, security vulnerabilities are hard to find. To tackle this complexity we analyze abstract models of these web applications. We generate test cases by (semi-) automatically injecting faults into the models and utilize systematic verification techniques to generate abstract test cases. To test real implementations, we operationalize them with the help of web browsers and penetration testing techniques. Our evaluation shows that non-trivial multi-step XSS and SQL attacks can effectively be found.