Title :
Enhancing Penetration Testing with Attack Signatures and Interface Monitoring for the Detection of Injection Vulnerabilities in Web Services
Author :
Antunes, Nuno ; Vieira, Marco
Author_Institution :
Dept. of Inf. Eng., Univ. of Coimbra-Portugal, Coimbra, Portugal
Abstract :
Web services are often deployed with critical software bugs that may be maliciously exploited. Developers often trust on penetration testing tools to detect those vulnerabilities but the effectiveness of such technique is limited by the lack of information on the internal state of the tested services. This paper proposes a new approach for the detection of injection vulnerabilities in web services. The approach uses attack signatures and interface monitoring to increase the visibility of the penetration testing process, yet without needing to access web service´s internals (as these are frequently not available). To demonstrate the feasibility of the approach we implemented a prototype tool to detect SQL Injection vulnerabilities in SOAP. An experimental evaluation comparing this prototype with three commercial penetration testers was conducted. Results show that our prototype is able to achieve much higher detection coverage than those testers while avoiding false positives, indicating that the proposed approach can be used in real development scenarios.
Keywords :
SQL; Web services; digital signatures; program debugging; program testing; SOAP; SQL injection vulnerabilities detection; Web services; attack signatures; commercial penetration testers; critical software bugs; interface monitoring; penetration testing enhancement; Instruments; Monitoring; Prototypes; Runtime; Security; Testing; Web services; attack signatures; interface monitoring; penetration testing; security; vulnerability detection; web-services;
Conference_Titel :
Services Computing (SCC), 2011 IEEE International Conference on
Conference_Location :
Washington, DC
Print_ISBN :
978-1-4577-0863-3
Electronic_ISBN :
978-0-7695-4462-5
DOI :
10.1109/SCC.2011.67