Toward automated detection of logic vulnerabilities in web applications

摘要: Web applications are the most common way to make services and data available on Internet. Unfortunately, with increase in number complexity of these applications, there has also been an vulnerabilities. Current techniques identify security problems web have mostly focused input validation flaws, such as crosssite scripting SQL injection, much less attention devoted application logic vulnerabilities. Application vulnerabilities important class defects that result faulty logic. These specific functionality particular and, thus, they extremely difficult characterize identify. In this paper, we propose a first step toward automated detection To end, use dynamic analysis observe normal operation infer simple set behavioral specifications. Then, leveraging knowledge about typical execution paradigm filter learned specifications reduce false positives, model checking over symbolic program paths likely violate under conditions, indicating presence certain type flaws. We developed tool, called Waler, based our ideas, applied it finding previously-unknown