Test Case Generation Based on ClientServer of Web Applications by Memetic Algorithm Currently, more than 90% web applications are potentially vulnerable to attacks from both the client side and server side. Test case generation plays a crucial role in testing web applications, where most existing studies focus on test case generation either from clientside or from serverside to detect vulnerabilities, regardless of the interactions between client and server. Consequently, it is difficult for those test cases to discover certain faults which involve both client and server. In this paper, the serverside sensitive paths are considered as vulnerable code paths due to insufficient or erroneous filtering mechanisms. An evolutionary testing approach based on the memetic algorithm is proposed to connect the serverside and clientside, in which test cases are generated from the clientside behavior model, while guided by the coverage of sensitive paths from serverside. The experiments are conducted on four open source web applications, and the results demonstrate that our approach can generate test cases from the clientside behavior model that can cover the serverside sensitive paths, on which the vulnerabilities can be detected more effectively.

Trustworthiness Assessment of Web Applications: Approach and Experimental Study using Input Validation Coding Practices The popularity of web applications and their worldwide use to support business critical operations raised the interest of hackers on exploiting security vulnerabilities to perform malicious operations. Fostering trust calls for assessment techniques that provide indicators about the quality of a web application from a security perspective. This paper studies the problem of using coding practices to characterize the trustworthiness of web applications from a security perspective. The hypothesis is that applying feasible security practices results in applications having a reduced number of unknown vulnerabilities, and can therefore be considered more trustworthy. The proposed approach is instantiated for the concrete case of input validation practices, and includes a Quality Model to compute trustworthiness scores that can be used to compare different applications or different code elements in the same application. Experimental results show that the higher scores are obtained for more secure code, suggesting that it can be used in practice to characterize trustworthiness, also providing guidance to compare andor improve the security of web applications.