Systematically enhancing black-box web vulnerability scanners

Abstract

Black-box web vulnerability scanners are a class of tools that can be used in finding security vulnerabilities in web applications automatically regardless of server-side language implementation. These tools access a web application in the same way users do. Unfortunately, black-box tools both commercial and open-source suffer from a number of limitations. In particular, advanced SQL Injection (SQLI) vulnerabilities and authentication protocol implementation flaws are not currently detected by any of these tools. In this thesis, we propose two approaches to handle the above limitations - SQLR(SQLi Revisited) and WeakAuthScan.