Finding bugs in dynamic web applications

ABSTRACT

Web script crashes and malformed dynamically-generated Web pages are common errors, and they seriously impact usability of Web applications. Current tools for Web-page validation cannot handle the dynamically-generated pages that are ubiquitous on today's Internet. In this work, we apply a dynamic test generation technique, based on combined concrete and symbolic execution, to the domain of dynamic Web applications. The technique generates tests automatically, uses the tests to detect failures, and minimizes the conditions on the inputs exposing each failure, so that the resulting bug reports are small and useful in finding and fixing the underlying faults. Our tool Apollo implements the technique for PHP. Apollo generates test inputs for the Web application, monitors the application for crashes, and validates that the output conforms to the HTML specification. This paper presents Apollo's algorithms and implementation, and an experimental evaluation that revealed 214 faults in 4 PHP Web applications.

References

1. S. Anand, P. Godefroid, and N. Tillmann. Demand-driven compositional symbolic execution. In TACAS, 2008.
2. M. Benedikt, J. Freire, and P. Godefroid. VeriWeb: Automatically testing dynamic Web sites. In WWW, 2002.
3. C. Braband, A. Moller, and M. Schwartzbach. Static validation dynamically generated HTML. In PASTE, 2001.
4. C. Cadar and D. R. Engler. Execution generated test cases: How to make systems code crash itself. In SPIN, 2005.
5. C. Cadar and D. R. Engler. Execution generated test cases: How to make systems code crash itself. In SPIN, 2005.
6. H. Cleve and A. Zeller. Locating causes of program failures. In ICSE, 2005.
7. C. Csallner, N. Tillmann, and Y. Smaragdakis. DySy: Dynamic symbolic execution for invariant inference. In ICSE, 2008.
8. D. Dean and D. Wagner. Intrusion detection via static analysis. In Symposium on Research in Security and Privacy, May 2001.
9. S. Elbaum, K.-R. Chilakamarri, M. Fisher, and G. Rothermel. Web application characterization through directed requests. In WODA, 2006.
10. S. Elbaum, S. Karre, G. Rothermel, and M. Fisher. Leveraging user-session data to support Web application testing. IEEE Trans. Softw. Eng., 31(3), 2005.
11. M. Emmi, R. Majumdar, and K. Sen. Dynamic test input generation for database applications. In ISSTA, 2007.
12. M. Fisher, S. G. Elbaum, and G. Rothermel. Dynamic characterization of Web application interfaces. In FASE, 2007.
13. P. Godefroid. Compositional dynamic test generation. In POPL, 2007.
14. P. Godefroid, A. Kiezun, and M. Y. Levin. Grammar-based whitebox fuzzing. In PLDI, 2008.
15. P. Godefroid, N. Klarlund, and K. Sen. DART: Directed automated random testing. In PLDI, 2005.
16. P. Godefroid, M. Y. Levin, and D. Molnar. Automated whitebox fuzz testing. In NDSS, 2008.
17. W. G. J. Halfond and A. Orso. Improving test case generation for Web applications using automated interface discovery. In ESEC-FSE, 2007.
18. K. Inkumsah and T. Xie. Evacon: a framework for integrating evolutionary and concolic testing for object-oriented programs. In ASE, 2007.
19. M. Johns and C. Beyerlein. SMask: preventing injection attacks in Web applications by approximating automatic data/code separation. In SAC, 2007.
20. N. Jovanovic, C. Kruegel, and E. Kirda. Pixy: A static analysis tool for detecting Web application vulnerabilities (short paper). In Security and Privacy, 2006.
21. R. Majumdar and K. Sen. Hybrid concolic testing. In ICSE, 2007.
22. R. Majumdar and R.-G. Xu. Directed test generation using symbolic grammars. In ASE, 2007.
23. Y. Minamide. Static approximation of dynamically generated Web pages. In WWW, 2005.
24. G. Misherghi and Z. Su. HDD: hierarchical delta debugging. In ICSE, 2006.
25. R. O'Callahan. Personal communication, 2008.
26. T. Pietraszek and C. V. Berghe. Defending against injection attacks through context-sensitive string evaluation. In RAID, 2005.
27. F. Ricca and P. Tonella. Analysis and testing of Web applications. In ICSE, 2001.
28. K. Sen, D. Marinov, and G. Agha. CUTE: A concolic unit testing engine for C. In FSE, 2005.
29. S. Sprenkle, E. Gibson, S. Sampath, and L. Pollock. Automated replay and failure detection for Web applications. In ASE, 2005.
30. Z. Su and G. Wassermann. The essence of command injection attacks in Web applications. In POPL, 2006.
31. G. Wassermann and Z. Su. Sound and precise analysis of Web applications for injection vulnerabilities. In PLDI, 2007.
32. G. Wassermann and Z. Su. Static detection of cross-site scripting vulnerabilities. In ICSE, 2008.
33. Y. Xie and A. Aiken. Static detection of security vulnerabilities in scripting languages. In USENIX-SS, 2006.
34. A. Zeller. Yesterday, my program worked. Today, it does not. Why? In FSE, 1999.

Index Terms

• General and reference

  • Cross-computing tools and techniques

    • Verification

• Software and its engineering

  • Software creation and management

    • Software development process management

    • Software verification and validation

      • Formal software verification

      • Software defect analysis

        • Software testing and debugging

  • Software organization and properties

    • Software functional properties

      • Formal methods

        • Software verification

• Theory of computation

  • Semantics and reasoning

    • Program reasoning

      • Program verification