Research and implementation of fuzzing testing based on HTTP proxy

Xin SUN; Yi-yang YAO; Xin-dai LU; Xue-jiao LIU; Yong-han WU

doi:10.11959/j.issn.2096-109x.2016.00022

您当前的位置：

首页 >

文章列表页 >

Research and implementation of fuzzing testing based on HTTP proxy

Papers | 更新时间：2024-06-03

- Research and implementation of fuzzing testing based on HTTP proxy
- Chinese Journal of Network and Information Security Vol. 2, Issue 2, Pages: 75-86(2016)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00022
  CLC： TP391
- Online First：2016-02，
  
  Published：15 February 2016
- 稿件说明：
移动端阅览
Xin SUN, Yi-yang YAO, Xin-dai LU, et al. Research and implementation of fuzzing testing based on HTTP proxy[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 75-86.
DOI：

Xin SUN, Yi-yang YAO, Xin-dai LU, et al. Research and implementation of fuzzing testing based on HTTP proxy[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 75-86. DOI： 10.11959/j.issn.2096-109x.2016.00022.

摘要

常用的Web应用测试工具普遍存在着测试功能欠优化、可配置程度较低、测试结果不够智能等问题，无法较好地辅助测试。进行了基于HTTP代理的模糊测试技术研究，设计了相应的测试工具。该工具应用模糊测试理论，异步监听实现了HTTP代理与服务器、浏览器间的高性能通信；采用基于伪码的可配置测试用例生成策略，灵活进行自动化测试；通过解析网络数据分组，为用户提供全面的测试分析结果。实验结果表明，该工具支持主流 Web 应用漏洞检测、测试策略配置，可检测出目录遍历、SQL 注入、跨站脚本等漏洞。

Abstract

Most of the security testing tools lack of optimization of testing

configured strategy and intelligent analysis of testing results.These problems lead to the status that these tools can’t be used in Web application testing well.A fuzzing testing method towards Web application security based on HTTP proxy was proposed.The high-performance communication between HTTP proxy server and browser through the mechanism of asynchronous monitoring was realized.Configured strategy of testing cases based on pseudo code could help to do flexible and automatic tests.By using multi-dimensional ways to parse the packet

intelligent analysis of testing results was achieved.Experiments show that the tool supports mainstream Web application vulnerabilities detection and configured strategy of testing.It can detect the vulnerabilities such as directory traversal

SQL injection

cross-site scripting.

关键词

Keywords

references

崔光耀 . 启明星辰IPS突破Web防御僵局 [J ] . 信息安全与通信保密 2008 ( 6 ): 33 .

CUI G Y . Venus IPS breakthrough Web defense deadlock [J ] . In-formation Security and Communications Privacy , 2008 ( 6 ): 33 .

HUANG Y W , HUANG S K , LIN T P , et al . Web application security assessment by fault injection and behavior monitor-ing[C]//The 12th International World Wide Web Conference . New York , c 2003 : 148 - 159 .

MILLER B . Project:operating system utility program reliabil-ity-the fuzz generator [EB/OL ] . http://pages.cs.wisc.edu/～bart/fuzz/fuzz.html http://pages.cs.wisc.edu/～bart/fuzz/fuzz.html .

OEHLERT P . Violating assumptions with fuzzing [J ] . IEEE Security and Privacy , 2005 , 3 ( 2 ): 58 - 62 .

SUTTON M , GREENE A , AMINI P . Fuzzing:brute force vulner-ability discovery [M ] . 2007 .

吴志勇 , 王红川 , 孙乐昌 , 等 . Fuzzing技术综述 [J ] . 计算机应用研究 , 2007 , 27 ( 3 ): 829 - 832 .

WU Z Y , WANG H C , SUN L C , et al . Survey on fuzzing [J ] . Ap-plication Research of Computers , 2007 , 27 ( 3 ): 829 - 832 .

MILLER B P , FREDRIKSEN L , SO B . An empirical study of the reliability of UNIX utilities [J ] . Communications of the ACM , 1990 , 33 ( 12 ): 32 - 44 .

LIN J C , CHEN J M . An automated mechanism for secure input handing [J ] . Journal of Computers , 2009 , 4 ( 9 ): 837 - 844 .

ERIKSSON B I , DAHL O E , BÜLLER R , et al . A new oral direct thrombin inhibitor,dabigatran etexilate,compared with enoxaparin for prevention of thromboembolic events following total hip or knee replacement:the BISTROⅡ randomized trial [J ] . Journal of Thrombosis and Haemostasis , 2005 , 3 ( 1 ): 103 - 111 .

SPI Dynamics . Web application security assessment [R ] . 2003 .

于莉莉 , 杜蒙杉 , 张平 , 等 . Web 安全性测试技术综述 [J ] . 计算机应用研究 2012 , 29 ( 29 ): 4000 - 4002 .

YU L L , DU M S , ZHANG P , et al . Survey on Web security testing technologies [J ] . Application Research of Computers , 2012 , 29 ( 29 ): 4000 - 4002 .

HAMMERSLAND R , SNEKKENES E . Fuzz testing of Web ap-plications [EB/OL ] . Journal of Computer and System Sciences , http://rune.hammersland.net/tekst/fuzzing-article.pdf http://rune.hammersland.net/tekst/fuzzing-article.pdf .

GRAAF M D . Intelligent fuzzing of Web applications [D ] . Amster-dam:University of Amsterdam , 2009 .

STOECKEL D M , STELZER E A , DICK L K . Evaluation of two spike-and-recovery controls for assessment of extraction efficiency in microbial source tracking studies [J ] . Water Research , 2009 , 43 ( 19 ): 4820 - 4827 .

都娟 . 基于模糊测试方法的 Web 应用安全性测试技术的研究及其工具实现 [D ] . 上海:华东师范大学 , 2011 .

DU J . Web application security testing technique based on fuzzing and implementation of the tool [D ] . Shanghai:East China Normal University , 2011 .

刘为 . 基于模糊测试的XSS漏洞检测系统研究与实现 [D ] . 长沙:湖南大学 , 2010 .

LIU W . Research on and implementation of XSS vulnerability mining based on fuzzing technology [D ] . Changsha:Hunan Univer-sity , 2010 .

Damn vulnerable Web application [EB/OL ] . http://www.dvwa.co.uk/ http://www.dvwa.co.uk/ .

Fuzzing:brute force vulnerability discovery [EB/OL ] . http://www.fuzzing.org/ http://www.fuzzing.org/ .

Web security [EB/OL ] . https://portswigger.net/burp/ https://portswigger.net/burp/ .

Views

615

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Self-adaptive fuzzing optimization method based on distribution divergence

Survey of evolutionary kernel fuzzing

Survey of attack graph based network security metric

Discovery and research of network security vulnerabilities based on Web application

Related Author

XU Hang

JI Jiangan

MA Zheyu

ZHANG Chao

Yan SHI

Weizhong QIANG

Deqing ZOU

Hai JIN

Related Institution

Key Laboratory of Cyberspace Security, Ministry of Education

Institute for Network Sciences and Cyberspace, Tsinghua University

National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab

Hubei Key Laboratory of Distributed System Security

School of Cyber Science and Engineering, Huazhong University of Science and Technology

⁰