NDLI logo
  • Content
  • Similar Resources
  • Metadata
  • Cite This
  • Log-in
  • Fullscreen
Log-in
Do not have an account? Register Now
Forgot your password? Account recovery
  1. Proceedings of the 2006 workshop on Programming languages and analysis for security (PLAS '06)
  2. Precise alias analysis for static detection of web application vulnerabilities
Loading...

Please wait, while we are loading the content...

Applying flow-sensitive CQUAL to verify MINIX authorization check placement
Combining type-based analysis and model checking for finding counterexamples against non-interference
Specifying distributed trust management in LolliMon
Empirical relation between coupling and attackability in software systems:: a case study on DOS
Object capabilities for security
Certified In-lined Reference Monitoring on .NET
Precise alias analysis for static detection of web application vulnerabilities
A microkernel virtual machine:: building security with clear interfaces
Trusted declassification:: high-level policy for a security-typed language
Refactoring programs to secure information flows
Efficient type inference for secure information flow

Similar Documents

...
Precise alias analysis for static detection of web application vulnerabilities.

...
JSPChecker: Static Detection of Context-Sensitive Cross-Site Scripting Flaws in Legacy Web Applications

Article

...
Abstract Precise Alias Analysis for Static Detection of Web Application Vulnerabilities

...
Static detection of cross-site scripting vulnerabilities

Article

...
Detecting PHP-based Cross-Site Scripting Vulnerabilities Using Static Program Analysis

Article

...
XSSDM: Towards detection and mitigation of cross-site scripting vulnerabilities in web applications

Article

...
Static detection of cross-site scripting vulnerabilities

Article

...
Security testing of web applications: a search based approach for cross-site scripting vulnerabilities.

...
Web Security: Detection of Cross Site Scripting in PHP Web Application using Genetic Algorithm

Article

Precise alias analysis for static detection of web application vulnerabilities

Content Provider ACM Digital Library
Author Kruegel, Christopher Kirda, Engin Jovanovic, Nenad
Abstract The number and the importance of web applications have increased rapidly over the last years. At the same time, the quantity and impact of security vulnerabilities in such applications have grown as well. Since manual code reviews are time-consuming, error-prone and costly, the need for automated solutions has become evident. In this paper, we address the problem of vulnerable web applications by means of static source code analysis. To this end, we present a novel, precise alias analysis targeted at the unique reference semantics commonly found in scripting languages. Moreover, we enhance the quality and quantity of the generated vulnerability reports by employing a novel, iterative two-phase algorithm for fast and precise resolution of file inclusions.We integrated the presented concepts into Pixy~\cite{jovanovic06:pixy_short}, a high-precision static analysis tool aimed at detecting cross-site scripting vulnerabilities in PHP scripts. To demonstrate the effectiveness of our techniques, we analyzed three web applications and discovered 106 vulnerabilities. Both the high analysis speed as well as the low number of generated false positives show that our techniques can be used for conducting effective security audits.
Starting Page 27
Ending Page 36
Page Count 10
File Format PDF
ISBN 1595933743
DOI 10.1145/1134744.1134751
Language English
Publisher Association for Computing Machinery (ACM)
Publisher Date 2006-06-10
Publisher Place New York
Access Restriction Subscribed
Subject Keyword Scripting languages security Web application security Cross-site scripting Static analysis Php Alias analysis Data flow analysis Program analysis
Content Type Text
Resource Type Article
  • About
  • Disclaimer
  • Feedback
  • Sponsor
  • Contact
About National Digital Library of India (NDLI)
NDLI logo

National Digital Library of India (NDLI) is a virtual repository of learning resources which is not just a repository with search/browse facilities but provides a host of services for the learner community. It is sponsored and mentored by Ministry of Education, Government of India, through its National Mission on Education through Information and Communication Technology (NMEICT). Filtered and federated searching is employed to facilitate focused searching so that learners can find the right resource with least effort and in minimum time. NDLI provides user group-specific services such as Examination Preparatory for School and College students and job aspirants. Services for Researchers and general learners are also provided. NDLI is designed to hold content of any language and provides interface support for 10 most widely used Indian languages. It is built to provide support for all academic levels including researchers and life-long learners, all disciplines, all popular forms of access devices and differently-abled learners. It is designed to enable people to learn and prepare from best practices from all over the world and to facilitate researchers to perform inter-linked exploration from multiple sources. It is developed, operated and maintained from Indian Institute of Technology Kharagpur.

Learn more about this project from here.

Disclaimer

NDLI is a conglomeration of freely available or institutionally contributed or donated or publisher managed contents. Almost all these contents are hosted and accessed from respective sources. The responsibility for authenticity, relevance, completeness, accuracy, reliability and suitability of these contents rests with the respective organization and NDLI has no responsibility or liability for these. Every effort is made to keep the NDLI portal up and running smoothly unless there are some unavoidable technical issues.

Feedback

Sponsor

Ministry of Education, through its National Mission on Education through Information and Communication Technology (NMEICT), has sponsored and funded the National Digital Library of India (NDLI) project.

Contact National Digital Library of India
Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302
See location in the Map
03222 282435
Mail: support@ndl.gov.in
Sl. Authority Responsibilities Communication Details
1 Ministry of Education (GoI),
Department of Higher Education
Sanctioning Authority https://www.education.gov.in/ict-initiatives
2 Indian Institute of Technology Kharagpur Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project https://www.iitkgp.ac.in
3 National Digital Library of India Office, Indian Institute of Technology Kharagpur The administrative and infrastructural headquarters of the project Dr. B. Sutradhar  bsutra@ndl.gov.in
4 Project PI / Joint PI Principal Investigator and Joint Principal Investigators of the project Dr. B. Sutradhar  bsutra@ndl.gov.in
Prof. Saswat Chakrabarti  will be added soon
5 Website/Portal (Helpdesk) Queries regarding NDLI and its services support@ndl.gov.in
6 Contents and Copyright Issues Queries related to content curation and copyright issues content@ndl.gov.in
7 National Digital Libarray of India Club (NDLI Club) Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach clubsupport@ndl.gov.in
8 Digital Preservation Centre (DPC) Assistance with digitizing and archiving copyright-free printed books dpc@ndl.gov.in
9 IDR Setup or Support Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops idr@ndl.gov.in
Cite this Content
Loading...