An Automated Approach to Generate Web Applications Attack Scenarios

Eric Alata (1) , Mohamed Kaâniche (1) , Vincent Nicomette (1) , Rim Akrout (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

—Web applications have become one of the most popular targets of attacks during the last years. Therefore it is important to identify the vulnerabilities of such applications and to remove them to prevent potential attacks. This paper presents an approach that is aimed at the vulnerability assessment of Web applications following a black-box approach. The objective is to detect vulnerabilities in Web applications and their dependencies and to generate attack scenarios that reflect such dependencies. Our approach aims to move a step forward toward the automation of this process. The paper presents the main concepts behind the proposed approach and an example that illustrates the main steps of the algorithm leading to the identification of the vulnerabilities of a Web application and their dependencies.

Mots clés: Security; vulnerability scanner; vulnerability detection; SQL injection; attack scenario; Web vulnerabilities

Domaines: Cryptographie et sécurité [cs.CR]; Web

Eric Alata, Mohamed Kaâniche, Vincent Nicomette, Rim Akrout. An Automated Approach to Generate Web Applications Attack Scenarios. The 6th Latin-American Symposium on Dependable Computing (LADC-2013), Apr 2013, Rio de Janeiro, Brazil. pp.78-85, ⟨10.1109/LADC.2013.22⟩. ⟨hal-01176046⟩