Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Supporting security testers in discovering injection flaws

: Türpe, S.; Poller, A.; Trukenmüller, J.; Repp, J.; Bornmann, C.


IEEE Computer Society:
Testing: Academic and Industrial Conference. Practice and Research Techniques, TAIC PART 2008. Proceedings : Held at Cumberland Lodge, Windsor, UK, August 29-31, 2008
Los Alamitos, Calif.: IEEE Computer Society Press, 2008
ISBN: 978-0-7695-3383-4
Testing - Academic and Industrial Conference <2008, Windsor>
Fraunhofer SIT ()
security testing; tool; vulnerability; SQL injection; cross site scripting; Softwaretest

We present a platform for software security testing primarily designed to support human testers in discovering injection flaws in distributed systems. Injection is an important class of security faults, caused by unsafe concatenation of input into strings interpreted by other components of the system. Examples include two of the most common security issues in Web applications, SQL injection and cross site scripting. This paper briefly discusses the fault model, derives a testing strategy that should discover a large subset of the injection flaws present, and describes a platform that helps security testers to discover injection flaws through dynamic grey-box testing. Our platform combines the respective strengths of machines and humans, automating what is easily automated while leaving to the tester the artistic portion of security testing. Although designed with a specific fault model in mind, our platform may be useful in a wide range of security testing tasks.