# LogInjector: Detecting Web Application Log Injection Vulnerabilities
## 5 Design
### Dynamic Testing of Feedback-Guided Mutations
#### 5.3.3 Mutation Operations  
The purpose of mutation is to allow injected code to both retain execution semantics and bypass the web application's input-filter checks. The research on the payload composition of log injection vulnerabilities found that it mainly includes five core parts: prefix, tag, attribute, code snippet, and suffix, as shown in Figure 3.  
We further observed the implementation of different web applications' input-filter check modules. We found that it mainly detects whether the data input by the user contain dangerous tags, attributes, and code snippets. Once it is found that the user enters these dangerous data, the web application will filter out these dangerous data or prohibit the input. However, because different web applications use different input-filter check modules and different web application developers have different levels of security awareness, there are usually input detection module defects and corresponding bypass methods. Therefore, we propose six mutation operations for the five core parts of prefix, suffix, tag, attribute, and code snippet and the whole test case. Each mutation operation serves both of the purposes mentioned above. We take the HTTP request parameters in the log-injectable interfaces recorded in Section 5.1 as the mutation vector. The six mutation operations are as follows:  
**M1: Add prefix:** The purpose of this mutation operation is to close or annotate the HTML or PHP code before the injection point so that the injected code can retain the execution semantics. The mutation is added before the test case: ', ', ', '>, '>, ->, '/, '; '; and other characters.  
**M2: Add suffix:** The injected data usually break the syntax of the original code and cannot be executed correctly. In order to ensure that the grammar rules are not violated, we propose this mutation operation, adding characters such as <!-, ', ', '//, #, ;, and other characters after the test case. These characters will comment out the code behind the injection point or close the code behind the injection point.  
**M3: Tag transformation:** Tag transformation mainly performs operations such as uppercase and lowercase transformation, double-writing tags, replacing tags, deleting tags, and tag encoding on the tags in the test case to bypass the detection of dangerous labels by the input-filtering check module.  
**M4: Attribute transformation:** Attribute transformation mainly transforms the attributes in the test case, including case transformation, double-writing attributes, replacement attributes, coding attributes, etc.  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**ID** & **Initial Inputs** & **Description** \\ \hline S1 & \textlesscript=alert(1)\textless/script\textgreater{} &
\begin{tabular}{c}Script Tag \\ Event Attributes \\ \end{tabular} \\ S2 & \textless{img src=}\text  
**M5: Code snippet transformation:** Code snippet transformation includes the replacement of code functions injected into the payload, code block splitting, code block encoding, and bracket removal, etc., to bypass the input detection module's filtering of dangerous characters, such as alert(1)=>confirm(1), alert(1)=>var A=\"ale\"+\"rt\"+(1);\"eval(A); phpinfo()=>(%8F\(\%\)97\(\%\)8F\(\%\)96\(\%\)91\(\%\)99\(\%\)90)(), alert(1)=>onerror=alert; throw 1.  
**M6: Overall transformation:** Overall transformation includes transforming the entire test case, including encoding the entire test case, replacing spaces and parentheses in the test case, and so on.