Automatically Hardening Web Applications Using Precise Tainting

By Anh Nguyen-Tuong, S. Guarnieri, D. Greene, J. Shirley, David E. Evans. IFIP International Information Security Conference, 2005

456 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/adcd4d715ab68dafcc7678a873d4c1a8217232e8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Finding application errors and security flaws using PQL: a program query language (2005, unknown): “[40] are dy namic systems that detects failures to validate input and ou tput in PHP applications.”
AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks (2005, background): “William Halfond – ASE 2005 – November 10th, 2005 Related Work • Require learning new API[2,8] • Customized runtime environments and high overhead[6,9,12,10,11] • Address only a subset of SQLIA[3,14] • Limited by machine learning[4,13] • Overly conservative static analysis[5,7]”
Taint-based directed whitebox fuzzing (2009, methodology): “The idea is to use the taint information to detect situations in which the program uses input data in a potentially dangerous way (such as the target of a branch instruction) [13, 19, 20].”
Using parse tree validation to prevent SQL injection attacks (2005, background): “tomate the discovery of susceptible sites have given rise to increased invention by the research community [1, 9, 8, 19].”
Sound and precise analysis of web applications for injection vulnerabilities (2007, methodology): “[23] and Pietraszek and Berghe [24] propose to enforce the same policy for PHP more rigorously.”
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, background): “[28] propose modifications of the PHP interpreter to dynamically track tainted data in PHP programs, and Haldar et al.”
Automatic creation of SQL Injection and cross-site scripting attacks (2009, methodology): “Dynamic taint propagation has been applied in the context of dynamic monitoring [22–24] and for increasing coverage of test suites [15].”
Merlin: specification inference for explicit information flow problems (2009, unknown): “The growing importance of explicit information flow is evidenced by the abundance of analysis tools for information flow tracking and violation detection at the level of the language, runtime, operating system, and hardware [1, 2, 6, 8–11, 15, 17, 18, 23, 28, 29, 33, 36].”
Static Detection of Security Vulnerabilities in Scripting Languages (2006, methodology): “Nguyen-Tuong [11] proposes a taint mode for PHP, which, unlike the Perl taint mode, not define sanitizing operations.”
Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis (2007, background): “This is necessary to ensure that functions and methods that operate on the array as a whole, such as arr.length, return a tainted value.”
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, methodology): “, [7, 9, 2, 22, 28, 5] handle buffer overflows, [6] handles format string attacks, and [24, 23] handle injection attacks involving strings.”
The essence of command injection attacks in web applications (2006, background): “Th re is also recent work on runtime taint tracking [31, 32].”
Pixy: a static analysis tool for detecting Web application vulnerabilities (2006, methodology): “Dynamic tools (e.g., [9] [18] [21], and Perl's taint mode try to detect attacks while executing the audited program, whereas static analyzers ([10] [11] [15] [16]) scan the Web application's source code for vulnerabilities.”
All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask) (2010, background): “Many analyses of Web applications utilize dynamic taint analysis to detect common attacks such as SQL injections [3, 38, 39, 50, 55, 61] and cross-site”