By Davide Balzarotti Marco Cova Viktoria V. FelmetsgerGiovanni Vigna Presented by: Mostafa Saad

Problem statement  Web applications have become popular, and nowadays they are used in security-critical environments, such as financial, and military systems.  More critical services  more sophistications of attacks.  Multi Module data/flow attacks  Current solutions: Firewalls or before deployment vulnerability analysis techniques to identify security problems.  The vulnerability analysis of web applications is difficult  Applications use scripting languages  Structuring of the application logic into separate pages and code modules  Interaction with back-end databases.  Current vulnerability analysis approaches focused on single application modules  Unfortunately, these approaches are limited in scope, and, therefore, they cannot detect multi-step attacks that exploit the interaction among multiple modules of an application.

Related work  The WebSSARI tool is one of the first works that applies static taint propagation analysis to find security vulnerabilities in PHP.  Cross site scripting & SQL injection.  An approach that uses the syntactic structure of the program-generated output to identify SQL injection only.  Tools either focus on a single application module analysis or better dynamic analysis that do not model or take into account the application’s intended workflow.

Solution approach  Intra Module Analysis phase  Examines each module of the application in isolation.  Inter Module Analysis phase  Examine whole application.

Intended workflow of an application  An application consists of 3 files.

Evaluation

Conclusion and future work  Because of the heterogeneous nature of web applications, it is important to develop new techniques that are able to analyze the interaction among multiple application modules and different technologies.  Paper presented a novel vulnerability analysis approach that takes into account the multi-module, multi-technology nature of complex web applications.  Additional technologies needs to be supported so that we can cover a larger class of applications.  Leveraging the findings of the static analysis to automatically generate test drivers to reduce the number of the false positives.