[Paper Review] Automatic Web Security Unit Testing: XSS Vulnerability Detection

Mahmoud Mohammadi, Bill Chu+2 more|arXiv (Cornell University)|Apr 2, 2018

Web Application Security Vulnerabilities11 references17 citations

TL;DR

This paper presents an automated approach to detect Cross-Site Scripting (XSS) vulnerabilities by analyzing encoding functions in web applications and generating malicious payloads to test their effectiveness. The method identifies 0-day XSS flaws missed by static analysis tools and efficiently covers a common class of XSS vulnerabilities through dynamic unit testing of input sanitization routines.

ABSTRACT

Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an automatic testing approach to detect a common type of Cross Site Scripting (XSS) vulnerability caused by improper encoding of untrusted data. We automatically extract encoding functions used in a web application to sanitize untrusted inputs and then evaluate their effectiveness by automatically generating XSS attack strings. Our evaluations show that this technique can detect 0-day XSS vulnerabilities that cannot be found by static analysis tools. We will also show that our approach can efficiently cover a common type of XSS vulnerability. This approach can be generalized to test for input validation against other types injections such as command line injection.

Motivation & Objective

• To integrate security testing into the software development lifecycle to reduce costs and improve vulnerability detection timing.
• To address the challenge of detecting 0-day XSS vulnerabilities caused by improper input encoding in web applications.
• To develop an automated method that evaluates the effectiveness of encoding functions used to sanitize untrusted inputs.
• To enable efficient, targeted unit testing of input sanitization logic for XSS protection.
• To generalize the approach to detect other injection vulnerabilities such as command injection.

Proposed method

• Automatically extract encoding functions used in web applications to sanitize untrusted inputs.
• Generate malicious XSS attack strings based on the structure and context of input handling.
• Evaluate the effectiveness of encoding functions by checking whether generated payloads bypass sanitization.
• Integrate the testing process into unit testing workflows for automated, repeatable security validation.
• Use dynamic analysis to assess real behavior of encoding functions under crafted inputs.
• Generalize the technique to other injection vulnerabilities by adapting payload generation to different contexts.

Experimental results

Research questions

• RQ1 Can automated unit testing detect 0-day XSS vulnerabilities that static analysis tools miss?
• RQ2 How effective is the approach in identifying weaknesses in input encoding functions used to prevent XSS?
• RQ3 To what extent can this method achieve high code coverage for common XSS vulnerability patterns?
• RQ4 Can the technique be extended to detect other injection vulnerabilities beyond XSS?
• RQ5 How efficiently can the method be integrated into existing software development workflows?

Key findings

• The proposed method successfully detected 0-day XSS vulnerabilities that were undetected by static analysis tools.
• The approach achieved high coverage of a common class of XSS vulnerabilities through targeted unit testing of encoding functions.
• Automated generation of attack strings effectively exposed flaws in input sanitization logic.
• The technique demonstrated feasibility in identifying real-world XSS flaws during early development phases.
• The method proved generalizable to other injection vulnerabilities, such as command-line injection, by adapting payload construction.
• The integration of security testing into unit testing workflows reduced the cost and effort of fixing vulnerabilities post-deployment.