Automated detection of session management vulnerabilities in web applications

Yusuke Takamatsu, Yuji Kosuga, Kenji Kono

研究成果: Conference contribution

7 被引用数 (Scopus)

抄録

Many web applications employ session management to keep track of visitors' activities across pages and over periods of time. A session is a period of time linked to a visitor, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks. Even though such session management vulnerabilities can be eliminated in the development phase of web applications, the test operator is required to have detailed knowledge on the attacks and to set up a test environment each time he/she attempts to detect vulnerabilities. We propose a technique that automatically detects session management vulnerabilities in web applications by simulating real attacks. Our technique requires the test operator to only enter a few pieces of basic information about the web application, without requiring a test environment to be set up or detailed knowledge on the web application. Our experiments demonstrated that our technique could detect vulnerabilities in five web applications deployed in the real world.

本文言語English
ホスト出版物のタイトル2012 10th Annual International Conference on Privacy, Security and Trust, PST 2012
ページ112-119
ページ数8
DOI
出版ステータスPublished - 2012 11 6
イベント2012 10th Annual International Conference on Privacy, Security and Trust, PST 2012 - Paris, France
継続期間: 2012 7 162012 7 18

出版物シリーズ

名前2012 10th Annual International Conference on Privacy, Security and Trust, PST 2012

Other

Other2012 10th Annual International Conference on Privacy, Security and Trust, PST 2012
国/地域France
CityParis
Period12/7/1612/7/18

ASJC Scopus subject areas

  • 人工知能
  • コンピュータ グラフィックスおよびコンピュータ支援設計
  • ハードウェアとアーキテクチャ

フィンガープリント

「Automated detection of session management vulnerabilities in web applications」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル