Web applications require access to the file-system for many different tasks. When analyzing the security of a web application, secu- rity analysts should thus consider the impact that file-system operations have on the security of the whole application. Moreover, the analysis should take into consideration how file-system vulnerabilities might in- teract with other vulnerabilities leading an attacker to breach into the web application. In this paper, we first propose a classification of file- system vulnerabilities, and then, based on this classification, we present a formal approach that allows one to exploit file-system vulnerabilities. We give a formal representation of web applications, databases and file- systems, and show how to reason about file-system vulnerabilities. We also show how to combine file-system vulnerabilities and SQL-Injection vulnerabilities for the identification of complex, multi-stage attacks. We have developed an automatic tool that implements our approach and we show its efficiency by discussing several real-world case studies, which are witness to the fact that our tool can generate, and exploit, complex attacks that, to the best of our knowledge, no other state-of-the-art-tool for the security of web applications can find.
The Chained Attack'' approach of @cite_7 considers multiple attacks to compromise a , but it does not consider file-system vulnerabilities nor interactions between vulnerabilities, which means that it can't reason about using a to access the file-system. Moreover, it requires an extra effort of the security analyst, who should provide an instantiation library for the concretization phase, while we use well-known external state-of-the-art tools.
@cite_7
2483259815 2498394137 2159160833 1509934111
We present the Chained Attacks approach, an automated model-based approach to test the security of web applications that does not require a background in formal methods. Starting from a set of HTTP conversations and a configuration file providing the testing surface and purpose, a model of the System Under Test (SUT) is generated and input, along with the web attacker model we defined, to a model checker acting as test oracle. The HTTP conversations, payload libraries, and a mapping created while generating the model aid the concretization of the test cases, allowing for their execution on the SUT's implementation. We applied our approach to a real-life case study and we were able to find a combination of different attacks representing the concrete chained attack performed by a bug bounty hunter. Protecting critical files in file systems is very important to computer systems. To protect critical files, the VMI-based Real-time File-system Monitor tools are promising options. However, these tools are always operation-based and introduce high overhead. The operation-based approaches intercept some kind of file operation to monitor critical files. The selected file operation is intercepted by the monitor whenever it is being executed. As file operation are high-frequency, the operationbased methods always result in the high performance degradation. In this paper, we present a VMI-based low overhead real-time critical file monitor method, CFWatcher, to meet the performance requirements of real-time monitor tools. CFWatcher is a target-based monitor tool which means it only intercepts the file operations accessing the user-defined critical files, and then obtains enough information to check the rules. The overhead of CFWatcher is related to the frequency of the target being accessed. Besides monitoring critical files, CFWatcher can take actions to prevent the illegal access if there is any rule violation. We implemented the prototype of CFWatcher and then evaluated the performance. Experimental results show that the overhead of our approach is low. Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, and novel techniques such as transient ramp-up behavior and spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlying reasons for the characteristics observed. In addition to helping understand attack dynamics, classification mechanisms such as ours are important for the development of realistic models of DoS traffic, can be packaged as an automated tool to aid in rapid response to attacks, and can also be used to estimate the level of DoS activity on the Internet. AbstractThe exploitation of buffer overﬂow vulnerabilities in proc ess stacks constitutes a signiﬁcant portion of securityattacks. We present a new method to detect and handle such attacks. In contrast to previous methods, this newmethod works with any existing pre-compiled executable andcan be used transparently, even on a system-wide basis.The method intercepts all calls to library functions that are known to be vulnerable. A substitute version of thecorresponding function implements the original functionality, but in a manner that ensures that any buffer overﬂowsare contained within the current stack frame. This method has been implemented on Linux as a dynamically loadablelibrarycalled libsafe. Libsafe has been shown to detect several known attacks and can potentially prevent yet unknownattacks. Experiments indicate that the performance overhead of libsafe is negligible. 1 Introduction As the Internet has grown, the opportunities for attempts to access remote systems improperly have increased. Severalsecurity attacks, such as the 1988 Internet Worm [7, 18, 19], have even become entrenched in Internet history. Someattacks, such as the Internet Worm, merely annoy or occupy system resources. However, other attacks are moreinsidious because they seize root privileges and modify, corrupt, or steal data.0510152025301988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999YearNumber of alertsbuffer overflow total