Automatically Checking for Session Management Vulnerabilities in Web Applications

• Item type: Trans(1)
• 公開日: 2013-01-31
• タイトル: Automatically Checking for Session Management Vulnerabilities in Web Applications
• タイトル / 言語: en
• タイトル: Automatically Checking for Session Management Vulnerabilities in Web Applications
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: [ウェブアプリケーション] web application security, session management, vulnerability, session fixation, cross site request forgery
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_6501
• 資源タイプ: journal article
• 著者所属: Keio University
• 著者所属: Everforth Co., Ltd.
• 著者所属: Keio University / JST CREST
• 著者所属(英): en
• 著者所属(英): Keio University
• 著者所属(英): en
• 著者所属(英): Everforth Co., Ltd.
• 著者所属(英): en
• 著者所属(英): Keio University / JST CREST
• 著者名: Yusuke, Takamatsu; Yuji, Kosuga; Kenji, Kono
• 著者名(英): Yusuke, Takamatsu; Yuji, Kosuga; Kenji, Kono
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Many web applications employ session management to keep track of visitors' activities across pages and over periods of time. A session is a period of time linked to a visitor, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks. Even though such session management vulnerabilities can be eliminated in the development phase of web applications, the test operator is required to have detailed knowledge of the attacks and to set up a test environment each time he/she attempts to detect vulnerabilities. We propose a technique that automatically detects session management vulnerabilities in web applications by simulating real attacks. Our technique requires the test operator to enter only a few pieces of basic information about the web application, without requiring a test environment to be set up or detailed knowledge of the web application. Our experiments demonstrated that our technique could detect vulnerabilities in a web application we built and in seven web applications deployed in the real world.
• 論文抄録(英) / 内容記述タイプ: Other
• 論文抄録(英) / 内容記述: Many web applications employ session management to keep track of visitors' activities across pages and over periods of time. A session is a period of time linked to a visitor, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks. Even though such session management vulnerabilities can be eliminated in the development phase of web applications, the test operator is required to have detailed knowledge of the attacks and to set up a test environment each time he/she attempts to detect vulnerabilities. We propose a technique that automatically detects session management vulnerabilities in web applications by simulating real attacks. Our technique requires the test operator to enter only a few pieces of basic information about the web application, without requiring a test environment to be set up or detailed knowledge of the web application. Our experiments demonstrated that our technique could detect vulnerabilities in a web application we built and in seven web applications deployed in the real world.
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AA11833852
• 書誌情報: 情報処理学会論文誌コンピューティングシステム（ACS）; 巻 6, 号 1, p. 45-55, 発行日 2013-01-31
• ISSN / 収録物識別子タイプ: ISSN
• ISSN / 収録物識別子: 1882-7829
• 出版者 / 言語: ja
• 出版者: 情報処理学会