Research on Fuzzing Test Data Engine for Web Vulnerability

Abstract:

With the rapid growth of e-commerce, various types of complex applications appear in web environments. web-based system testing is different from traditional software testing. The unpredictability of Internet and web systems makes it difficult to test web-based system. This paper presents an engine for Fuzzing test data towards web control vulnerabilities, and introduces "heuristic rules" and "tagged words" to generate the test data. This method can increase the intelligence of security testing and build the foundation of web vulnerability detection model.

• Periodical: Advanced Materials Research (Volumes 211-212)
• Pages: 500-504
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.211-212.500
• Online since: February 2011
• Authors: Quan Long Guan, Guo Xiang Yao, Kai Bin Ni, Mei Xiu Zhou
• Keywords: Fuzzing Test, Heuristic Rules, Security Testing, Test Data Engine

References

[1] T. Leek, G. Baker, R. Brown, M. Zhivich, and R. Lippmann. Coverage maximization using dynamictaint tracing. Technical Report TR-1112, MIT Lincoln Laboratory, (2007).

[2] P. Godefroid. Compositional Dynamic Test Generation. The 34th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, 2007, pp.47-54.

DOI: 10.1145/1190216.1190226

[3] C. Cadar, V. Ganesh, P. Pawlowski, D. Dill, and D. Engler. EXE: automatically generating inputs of death. Proceedings of the ACM Conference on Computer and Communications Security, 2006, pp.322-335.

DOI: 10.1145/1180405.1180445

[4] R. Majumdar and K. Sen. LATEST: Lazy dynamic test input generation. Technical Report UCB/EECS-2007-36, EECS Department, University of California, Berkeley, (2007).

[5] P. Boonstoppel, C. Cadar, and D. R. Engler. Rwset: Attacking path explosion in constraint-based test generation. Tools and Algorithms for the Construction and Analysis of Systems, 2008, P. 351–366.

DOI: 10.1007/978-3-540-78800-3_27

[6] C. Pacheco, S. K. Lahiri, M. D. Ernst, and T. Ball. Feedback-directed random test generation. 29th International Conference on Software Engineering, 2007. pp.75-84.

DOI: 10.1109/icse.2007.37

[7] Guan Quan-long, Ye Saizhi，Yao Guo-xiang. Research and design of internet public opinion analysis system，IITA International Conference on Services Science, Management and Engineering, 2009, pp.173-177.

DOI: 10.1109/ssme.2009.62

[8] Dai HN, Murphy C and Kaiser G. Configuration fuzzing for software vulnerability detection. 5th International Conference on Availability, Reliability, and Security, 2010, pp.525-530.

DOI: 10.1109/ares.2010.22

[9] Kim, Hyoungchun; Choi, Younghan; Lee, Dohoon; Lee, Donghoon. Practical security testing using file fuzzing. 10th International Conference on Advanced Communication Technology, - Proceedings, Vol 2(2008), pp.1304-1307.

DOI: 10.1109/icact.2008.4494003

[10] Oehlert, Peter. Violating assumptions with fuzzing. IEEE Security and Privacy, v 3, n 2, pp.58-62, March/April (2005).

DOI: 10.1109/msp.2005.55

[11] Liu, Qixu, Zhang, Yuqing. TFTP vulnerability finding technique based on fuzzing. Computer Communications, v 31, n 14, pp.3420-3426, September 5, (2008).

DOI: 10.1016/j.comcom.2008.05.041

[12] Zhang, Xiao-Song, Shao, Lin, Zheng, Jiong. A novel method of software vulnerability detection based on fuzzing technique. International Conference on Apperceiving Computing and Intelligence Analysis, 2008, pp.270-273.

DOI: 10.1109/icacia.2008.4770021

[13] Antunes, João, Neves, Nuno; Correia, Miguel; Verissimo, Paulo; Neves, Rui. Vulnerability discovery with attack injection. IEEE Transactions on Software Engineering, Vol 36(2010), pp.357-370.

DOI: 10.1109/tse.2009.91

[14] Neves, Nuno; Antunes, João; Correia, Miguel; Veríssimo, Paulo; Neves, Rui. Using attack injection to discover new vulnerabilities . International Conference on Dependable Systems and Networks, v 2006(2006), pp.457-466.

DOI: 10.1109/dsn.2006.72

[15] Yao, Guo-Xiang, Guan, Quan-Long, et al. Research and implementation of next generation network intrusion detection system based on protocol analysis, ISECS International Colloquium on Computing, Communication, Control, and Management, Vol 2(2008).

DOI: 10.1109/cccm.2008.30