Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Reports of rampant cross-site scripting (XSS) vulnerabilities raise growing concerns on the effectiveness of current Static Analysis Security Testing (SAST) tools as an internet security device. Attentive to these concerns, this study aims to examine seven open-source SAST tools in order to account for their capabilities in detecting XSS vulnerabilities in PHP applications and to determine their performance in terms of effectiveness and analysis runtime. The representative tools - categorized as either text-based or graph-based analysis tools - were all test-run using real-world PHP applications with known XSS vulnerabilities. The collected vulnerability detection reports of each tool were analyzed with the aid of PhpStorm's data flow analyzer. It is observed that the detection rates of the tools calculated from the total vulnerabilities in the applications can be as high as 0.968 and as low as 0.006. Furthermore, the tools took an average of less than a minute to complete an analysis. Notably, their runtime is independent of their analysis type.
Abstract
Reports of rampant cross-site scripting (XSS) vulnerabilities raise growing concerns on the effectiveness of current Static Analysis Security Testing (SAST) tools as an internet security device. Attentive to these concerns, this study aims to examine seven open-source SAST tools in order to account for their capabilities in detecting XSS vulnerabilities in PHP applications and to determine their performance in terms of effectiveness and analysis runtime. The representative tools - categorized as either text-based or graph-based analysis tools - were all test-run using real-world PHP applications with known XSS vulnerabilities. The collected vulnerability detection reports of each tool were analyzed with the aid of PhpStorm's data flow analyzer. It is observed that the detection rates of the tools calculated from the total vulnerabilities in the applications can be as high as 0.968 and as low as 0.006. Furthermore, the tools took an average of less than a minute to complete an analysis. Notably, their runtime is independent of their analysis type.
참고문헌 (35)
- "Vulnerability distribution of cve security vulnerabilities by types"[URL]
- "CVE - Search Results"[URL]
- "Source Code Analysis Tools - OWASP"[URL]
- "Phpcs-security-audit"[URL]
- "CodeSniffer Part 4: How does CodeSniffer Work | King Kludge"[URL]
- Paulo Nunes, "PhpSAFE: A Security Analysis Tool for OOP Web Application Plugins", Proc. Int. Conf. Dependable Syst. Networks, 2015, pp.299~306 (2015)
- Nenad Jovanovic, "Pixy: a static analysis tool for detecting Web application vulnerabilities", 2006 IEEE Symp. Secur. Priv., pp.6~ (2006)
- Johannes Dahse, "RIPS-A static source code analyser for vulnerabilities in PHP scripts", Retrieved Febr., 28, pp.2012~ (2010)
- "Visual Code Grepper"[URL]
- Ibéria Medeiros, "Automatic detection and correction of web application vulnerabilities using data mining to predict false positives", Proc. 23rd Int. Conf. World wide web - WWW '14, pp.63~74 (2014)
- "Yasca: Yet Another Source Code Analyzer"[URL]
- "PMD"[URL]
- "Excess XSS: A comprehensive tutorial on cross-site scripting"[URL]
- "DokuWiki"[URL]
- "PHPMyWind"[URL]
- "Ultimate PHP Board"[URL]
- "Gift Certificate Creator"[URL]
- "Slideshow Gallery Pro - WordPress Plugins"[URL]
- Alfred V. Aho, "Compilers: Principles, Techniques, and Tools" (2006)
- Flemming Nielson, "Principles of Program Analysis" (1999), Springer Berlin Heidelberg
- Misha Zitser, "Testing static analysis tools using exploitable buffer overflows from open source code", ACM SIGSOFT Software Engineering Notes, 29(6), pp.97~106 (2004), Association for Computing Machinery (ACM)[DOI]
- Nurul Atiqah Abu Talib, "Assessment of Dynamic Open-source Cross-site Scripting Filters for Web Application", KSII Transactions on Internet and Information Systems, 15(10), pp.3750~3770 (2021), 한국인터넷정보학회
- D. Pasetto, "Tools for Very Fast Regular Expression Matching", Computer, 43(3), pp.50~58 (2010), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Yao-Wen Huang, "Securing web application code by static analysis and runtime protection", Proc. 13th Conf. World Wide Web - WWW '04, pp.40~ (2004)
- H. G. Rice, "Classes of recursively enumerable sets and their decision problems", Transactions of the American Mathematical Society, 74(2), pp.358~366 (1953), American Mathematical Society (AMS)[DOI]
- B. Chess, "Static analysis for security", IEEE Security and Privacy Magazine, 2(6), pp.76~79 (2004), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Michael Buckland, "The relationship between Recall and Precision", Journal of the American Society for Information Science, 45(1), pp.12~19 (1994), Wiley[DOI]
- M. Belyaev, "Fast and Safe Concrete Code Execution for Reinforcing Static Analysis and Verification", Modeling and Analysis of Information Systems, 22(6), pp.763~772 (2016), P.G. Demidov Yaroslavl State University[DOI]
- Görel Hedin, "Compiler Construction, vol. 9031" (2015)
- Lucas Torri, "An evaluation of free", open source static analysis tools applied to embedded software, 2010 (2010), 1~6
- Aniqua Z. Baset, "IDE Plugins for Detecting Input-Validation Vulnerabilities" (2017)
- "Analyzing the Accuracy and Time Costs of Web Application Security Scanners" (2010)[URL]
- Mansour Alsaleh, "Performance- Based Comparative Assessment of Open Source Web Vulnerability Scanners", Secur. Commun. Networks, 2017, pp.1~14 (2017)[DOI]
- Nuno Antunes, "Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services", 2009 15th IEEE Pacific Rim Int. Symp. Dependable Comput., pp.301~306 (2009)
- Nuno Antunes, "Security Testing in SOAs: Techniques and Tools BT - Innovative Technologies for Dependable OTS-Based Critical Systems: Challenges and Achievements of the CRITICAL STEP Project", pp.159~174 (2013), Springer Milan