NDLI: Automated black-box detection of access control vulnerabilities in web applications

Please wait, while we are loading the content...

On the suitability of dissemination-centric access control systems for group-centric sharing

KameleonFuzz: evolutionary fuzzing for black-box XSS detection

Virtualization and security: happily ever after?

On protection in federated social computing systems

Measuring the robustness of source program obfuscation: studying the impact of compiler optimizations on the obfuscation of C programs

Systematic audit of third-party android phones

On quantitative dynamic data flow tracking

Shared responsibility is better than no responsibility: federated encryption in the cloud

Efficient privacy-aware search over encrypted databases

TrustID: trustworthy identities for untrusted mobile devices

An efficient privacy-preserving system for monitoring mobile users: making searchable encryption practical

Streamforce: outsourcing access control enforcement for stream data to the clouds

Automated black-box detection of access control vulnerabilities in web applications

COMPARS: toward an empirical approach for comparing the resilience of reputation systems

Interaction provenance model for unified authentication factors in service oriented computing

PREC: practical root exploit containment for android devices

Security of graph data: hashing schemes and definitions

DroidBarrier: know what is executing on your android

Keystroke biometrics: the user perspective

Is it really you?: user identification via adaptive behavior fingerprinting

Compac: enforce component-level access control in android

PhishSafe: leveraging modern JavaScript API's for transparent and robust protection

RiskMon: continuous and automated risk assessment of mobile applications

Detecting man-in-the-middle attacks on non-mobile systems

DIVILAR: diversifying intermediate language for anti-repackaging on android platform

Inference attack against encrypted range queries on outsourced databases

RopSteg: program steganography with return oriented programming

Relationship-based information sharing in cloud-based decentralized social networks

Wiretap-proof: what they hear is not what you speak, and what you speak they do not hear

Situational awareness through reasoning on network incidents

A modular multi-location anonymized traffic monitoring tool for a WiFi network

SobTrA: a software-based trust anchor for ARM cortex application processors

WebWinnow: leveraging exploit kit workflows to detect malicious urls

Consistency checking in access control

Privacy-preserving audit for broker-based health information exchange

POSTER: a pairing-free certificateless hybrid sign-cryption scheme for advanced metering infrastructures

Spoilt for choice: graph-based assessment of key management protocols to share encrypted data

Trust ranking of medical websites

A cloud architecture for protecting guest's information from malicious operators with memory management

Privacy-preserving publication of provenance workflows

Large-scale machine learning-based malware detection: confronting the "10-fold cross validation" scheme with reality

Securing OAuth implementations in smart phones

Minimizing lifetime of sensitive data in concurrent programs

Automated black-box detection of access control vulnerabilities in web applications

Content Provider	ACM Digital Library
Author	Li, Xiaowei Xue, Yuan Si, Xujie
Abstract	Access control vulnerabilities within web applications pose serious security threats to the sensitive information stored at back-end databases. Existing approaches are limited from several aspects, including the coarse granularity at which the access control is modeled, the incapability of handling complex relationship between data entities and the requirement of source code and the specific application platform. In this paper, we present an automated black-box technique for identifying a broad range of access control vulnerabilities, which can be applied to applications that are developed using different languages and platforms. We model the access control policy based on a novel virtual SQL query concept, which captures both the database access operations (i.e., through SQL queries) and the post-processing filters within the web application. We leverage a crawler to automatically explore the application and collect execution traces. From the traces, we identify the set of database access operations that are allowed for each role (i.e., role-level policy inference) and extract the constraints over the operation parameters to characterize the relationship between the users and the accessed data (i.e., user-level policy inference). Based on the inferred policy, we construct test inputs to exploit the application for potential access control flaws. We implement a prototype system BATMAN and evaluate it over a set of PHP and JSP web applications. The experiment results demonstrate the effectiveness and accuracy of our approach.
Starting Page	49
Ending Page	60
Page Count	12
File Format	PDF
ISBN	9781450322782
DOI	10.1145/2557547.2557552
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-03-03
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Web application security Web crawler Black-box detection Role/user-level policy inference Access control vulnerability
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in