Web applications have become one of the preferred means for users to perform a number of crucial and security-sensitive operations such as selling and buying goods or managing bank accounts, official documents, personal health records, smart houses and so on. The pervasive adoption of such web applications calls for an extensive security analysis in order to avoid attacks. Penetration testing is the most common approach for testing the security of web applications, but model-based security testing has been steadily maturing into a viable alternative and/or complementary approach. Penetration testing is very efficient but the experience of the security analyst is crucial; model-based security testing relies on formal methods but the security analyst has to first create a suitable model of the web application. In this paper, we introduce MobSTer, a formal and flexible model-based security testing framework that contributes to filling the gap between these two security testing approaches. The main idea underlying this framework is that the use of model-checking techniques can automate the search for possible vulnerable entry points in the web application, i.e., it permits an analyst to perform security testing without missing important checks. Moreover, the framework also allows for reuse: the analyst can collect her expertise into the framework and (re)use it during future tests on possibly different web applications. We have implemented MobSTer as a prototype and applied it to test a number of case studies to assess its strength and concretely evaluate it with respect to four state-of-the-art tools normally used by penetration testers. Test Execution Engine Test Web Application Model CE(s) Web Application Login • simplicity (e.g., of the modeling activity), 2 Throughout the paper we will refer to the security analyst as "she". 3 The formalization used in our approach can also be adapted to represent software that is not web-based. However, our concretization phase (which is important for testing the results of the formal phase) works specifically for web-based software. Thus, migrating the approach to non-web-based software would require one to address different challenges related to the low-level behavior of such software. • reusability (in our framework, actions are associated with data they handle and properties they have, thus, reusing actions also means to reuse these associations during the testing of different web applications). Actions are defined by the security analyst who decides the abstraction level and the granularity she wishes to consider. As a concrete example of the actions' characteristics (i.e., their use in the framework as well as the expertise used in their identification), consider the "login" functionality. Web applications usually employ one of the following types of authentication mechanism (we also add the attacks that the security analyst can exploit in order to attack the action): • Basic Authentication: the tester can try to perform a brute-force attack, and the password is sniffable if not passed via HTTPS. • HTTP Digest Authentication: brute-force attacks and man-in-the-middle attacks are possible. • Form-based Authentication: brute-force attacks are possible, injection vulnerabilities (e.g., , Cross-Site Scripting XSS [22], etc.) have to be tested, and the attacker should try to capture the authentication token (i.e., session tokens or cookies). 4 The source code of the MobSTer tool is available at https://github.com/REGIS-lab/MobSTer.
Peroli et al. REF proposed MobSTer, which is a combination of a formal method and a penetration testing for web security.
MobSTer: A model-based security testing framework for web applications
Softw. Test. Verification Reliab.
Softw. Test. Verification Reliab.
Computer Science