Ardilla is an automated tool for creating SQL injection and XSS attack vectors in PHP Web applications. SQL Injection (SQLI) and cross-site scripting (XSS) attacks are widespread forms of attack in which the attacker crafts the input to the application to access or modify user data and execute malicious code. In the most serious attacks (called second-order, or persistent, XSS), an attacker can corrupt a database so as to cause subsequent users to execute malicious code. Ardilla automatically creates inputs that expose SQLI and XSS vulnerabilities. Ardilla generates sample inputs, symbolically tracks taints through execution (including through database accesses), and mutates the inputs to produce concrete exploits. Ours is the first analysis of which we are aware that precisely addresses second-order XSS attacks. Ardilla creates real attack vectors, has few false positives, incurs no runtime overhead for the deployed application, works without requiring modification of application code, and handles dynamic programming-language constructs. We evaluated Ardilla on five PHP applications and found 68 previously unknown vulnerabilities (23 SQLI, 33 first-order XSS, and 12 second-order XSS). PaperAdam Kieżun, Philip J. Guo, Karthick Jayaraman, and Michael D. Ernst“Automatic Creation of SQL Injection and Cross-Site Scripting Attacks” The paper was published in the proceedings of ICSE'09 (31st International Conference on Software Engineering, Vancouver, Canada, May 16-24, 2009). Availability
We regret that Ardilla's implementation is not available as open source.
ContributorsAdam Kieżun project leader (Harvard)Philip J. Guo (Stanford University) Karthick Jayaraman (Syracuse University) Shay Artzi (IBM Research) Michael D. Ernst (professor, University of Washington) Experimental Results
XSS attack patterns, SQLI attack patterns |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||