Penetration testing with improved input vector identification

Proceedings - 2nd International Conference on Software Testing, Verification, and Validation, ICST 2009

Volumn , Issue , 2009, Pages 346-355

  Halfond, William G J ^a   Choudhary, Shauvik Roy ^a   Orso, Alessandro ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANALYSIS TECHNIQUES; CURRENT TECHNIQUES; INPUT VECTOR; NEW APPROACHES; PENETRATION TESTING; TARGET APPLICATION; WEB APPLICATION;

COMPUTER SOFTWARE SELECTION AND EVALUATION; SOFTWARE TESTING; VERIFICATION; WORLD WIDE WEB;

VECTORS;

EID: 67650177535     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICST.2009.26     Document Type: Conference Paper

References (21)

1. A. A. Andrews, J. Offutt, and R. T. Alexander. Testing Web Applications by Modeling with FSMs. In Software Systems and Modeling, pages 326-345, July 2005. (Pubitemid 40984097)
2. B. Arkin, S. Stender, and G. McGraw. Software penetration testing. IEEE Security & Privacy, 3(1):84 - 87, 2005. (Pubitemid 40325588)
3. M. Bishop. About Penetration Testing. IEEE Security & Privacy, 5(6):84-87, 2007.
4. Y. Deng, P. Frankl, and J.Wang. TestingWeb Database Applications. SIGSOFT Software Engineering Notes, 29(5):1- 10, 2004.
5. S. Elbaum, K.-R. Chilakamarri, M. F. II, and G. Rothermel. Web Application Characterization Through Directed Requests. In International Workshop on Dynamic Analysis, May 2006.
6. S. Elbaum, S. Karre, and G. Rothermel. ImprovingWeb Application Testing with User Session Data. In International Conference on Software Engineering, November 2003.
7. S. Elbaum, G. Rothermel, S. Karre, and M. F. II. Leveraging User-Session Data to Support Web Application Testing. IEEE Transactions On Software Engineering, 31(3):187- 202, March 2005. (Pubitemid 40890001)
8. D. Geer and J. Harthorne. Penetration testing: a duet. In Proceedings of the 18th Annual Computer Security Applications Conference., December 2002.
9. C. Gould, Z. Su, and P. Devanbu. Static Checking of Dynamically Generated Queries in Database Applications. In Proc. of the 26th International Conference on Software Engineering, May 2004.
10. W. Halfond, A. Orso, and P.Manolios. Using Positive Tainting and Syntax-Aware Evaluation to Counter SQL Injection Attacks. In Proceedings of the ACM SIGSOFT Symposium on the Foundations of Software Engineering, November 2006.
11. W. Halfond, A. Orso, and P. Manolios. WASP: Protecting Web Applications Using Positive Tainting and Syntax-Aware Evaluation. IEEE Transactions on Software Engineering, 34(1):65-81, 2008. (Pubitemid 351343903)
12. W. G. Halfond and A. Orso. Improving Test Case Generation for Web Applications Using Automated Interface Discovery. In Proceedings of the ESEC/SIGSOFT Symposium on the Foundations of Software Engineering, Sep. 2007.
13. W. G. Halfond, J. Viegas, and A. Orso. A Classification of SQL-Injection Attacks and Countermeasures. In Proc. of the Intl. Symp. on Secure Software Engineering, Mar. 2006.
14. Y. Huang, S. Huang, T. Lin, and C. Tsai. Web Application Security Assessment by Fault Injection and Behavior Monitoring. In Proc. of the 12th International World Wide Web Conference , May 2003.
15. X. Jia and H. Liu. Rigorous and Automatic Testing of Web Applications. In 6th IASTED International Conference on Software Engineering and Applications, November 2002.
16. C. Kallepalli and J. Tian. Measuring and Modeling Usage and Reliability for Statistical Web Testing. IEEE Transactions on Software Engineering, 27(11):1023-1036, 2001. (Pubitemid 33106030)
17. B. P. Miller, L. Fredriksen, and B. So. An empirical study of the reliability of UNIX utilities. Communications of the ACM, 33(12), 1990.
18. F. Ricca and P. Tonella. Analysis and Testing ofWeb Applications. In International Conference on Software Engineering, May 2001.
19. J. Sant, A. Souter, and L. Greenwald. An Exploration of StatisticalModels for Automated Test Case Generation. In Proceedings of the International Workshop on Dynamic Analysis, May 2005.
20. M. Sutton, A. Greene, and P. Amini. Fuzzing: Brute Force Vulnerability Discovery. Addison-Wesley, 2007.
21. H. H. Thompson. Application penetration testing. IEEE Security & Privacy, 3(1):66 - 69, 2005. (Pubitemid 40325585)