Pixy: a static analysis tool for detecting Web application vulnerabilities
By Nenad Jovanovic, Christopher Krügel, Engin Kirda. IEEE Symposium on Security and Privacy, 2006
820 citations recorded by the source corpus.
Subfields: Artificial Intelligence, Information Systems, Software
View Paper: https://www.semanticscholar.org/paper/1743802b43a7dca265ca8e792c87875f2e4906e8
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Konrad Rieck
- Adam Kiezun
- Christopher Krügel
- Giovanni Vigna
- Philip J. Guo
- Michael D. Ernst
- Engin Kirda
- Zhendong Su
In Information Systems
- Zhendong Su
- Adam Kiezun
- Michael D. Ernst
- Giovanni Vigna
- Christopher Krügel
- Davide Balzarotti
- Philip J. Guo
- Benjamin Livshits
In Software
- Zhendong Su
- Michael D. Ernst
- Aditya V. Nori
- Giovanni Vigna
- Philip J. Guo
- Adam Kiezun
- Sriram K. Rajamani
- Benjamin Livshits
Citations in the corpus
- Merlin: specification inference for explicit information flow problems (2009, background): “Several projects that came after WebSSARI improve on the quality of static analysis for PHP [ 9 ,33].”
- Automatic creation of SQL Injection and cross-site scripting attacks (2009, background): “Static approaches can, in principle, prove the absence of vulnerabilities [7, 12, 16, 28, 31].”
- Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, methodology): “A number of past research efforts [9,13, 17 ,18,22,45] have focused on the problem of identifying vulnerabilities in which external input is used without any prior sanitization.”
- Modeling and Discovering Vulnerabilities with Code Property Graphs (2014, background): “As a result of this situation, security research has initially focused on statically finding specific types of vulnerabilities, such as flaws induced by insecure library functions [6], buffer overflows [45], integer overflows [40] or insufficient validation of input data [18].”
- Predicting vulnerable software components (2007, methodology): “For other approaches, see for example linear programming [12], data-flow analysis [ 14 ], locating functions near a program’s input [8]9, checking against an axiomatization of correct pointer usage [11],”
- discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code (2016, background): “I. INTRODUCTION One key problem in computer security is the identification of bugs and security-critical vulnerabilities in software.”
- Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis (2007, methodology): “A techniquebased ondataflow analysis for detectingXSS and similar vulnerabilities (such as SQL injection or command injection) is presented in [ 13 ].”
- Sound and precise analysis of web applications for injection vulnerabilities (2007, background): “sought to address this last shortcoming with Pixy [12, 13], a static taint analysis for PHP that propagates limited string information and implements a finely tuned alias analysis.”
- Static detection of cross-site scripting vulnerabilities (2008, background): “Jovanovic, Kruegel, and Kirda designed Pixy to propagate limited string value information in order to handle some of PHP’s more dynamic features [13, 14].”
- State of the Art: Automated Black-Box Web Application Vulnerability Testing (2010, background): “Work by Wassermann [20], Lam [21], Kie˙ [22], Jovanovic [ 23 ], and Huang [24] all fall into this category.”