Static Detection of Security Vulnerabilities in Scripting Languages
By Yichen Xie, A. Aiken. USENIX Security Symposium, 2006
436 citations recorded by the source corpus.
View Paper: https://www.semanticscholar.org/paper/b4b35425ec0f1102f8cbf2bdc9ae59d3e70fcd42
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Davide Balzarotti
- Christopher Krügel
- Marco Cova
- Gary Wassermann
- Giovanni Vigna
- Engin Kirda
- Wei Xu
- Zhendong Su
Citations in the corpus
- Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, background): “For example, an application might check that the number of items to purchase, sent as part of a form submission, is actually provided as an integer value and not as a nonnumeric string or a float.”
- Pixy: a static analysis tool for detecting Web application vulnerabilities (2006, background): “As mentioned in an unpublished paper by Xie and Aiken [25], static analysis of scripting languages is regarded as a difficult problem and has not achieved much attention so far.”
- Sound and precise analysis of web applications for injection vulnerabilities (2007, methodology): “Xie andAiken designed amoreprecise andscalable analysisfor finding SQLCIVs in PHP by using block- and function-summaries [31].”
- Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, background): “Static taint analysis techniques have been proposed by many for finding security vulnerabilities, including input validation errors in web applications [17, 14, 32], user/kernel pointer bugs [15], format string bugs [26], and bugs in placement of authorization hooks [34].”
- Static detection of cross-site scripting vulnerabilities (2008, background): “Xie and Aiken designed an SQL injection vulnerability analysis that gains scalability and efficiency in exchange for soundness by using block- and function-summaries [27].”
- Insights into User Behavior in Dealing with Internet Attacks (2012, background): “We also show that trick banners that are common in file sharing websites and shortened URLs have high success rates of deceiving non-technical users, thus posing a severe security risk.”