SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications
SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications
复制标题
DOI：
10.14722/ndss.2023.24632
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
An Chen;Jiho Lee;Basanta Chaulagain;Yonghwi Kwon;K. H. Lee
中科院分区：
文献类型：
--
作者：
An Chen;Jiho Lee;Basanta Chaulagain;Yonghwi Kwon;K. H. Lee
测试数据库支持的Web应用程序是具有挑战性的，因为它们的行为（例如，控制流）高度依赖于从SQL查询返回的数据。如果没有包含足够和真实数据的数据库，则很难找到潜在易受攻击的代码片段，从而限制了各种现有的基于动态的安全测试方法。然而，实际上很难获得这种数据库进行测试，因为它通常包含敏感信息。共享它可能会导致数据泄露和隐私问题。在本文中，我们提出了S YNTH DB，基于程序分析的数据库生成技术的数据库支持的PHP应用程序。S YNTH DB利用concolic执行引擎来识别PHP代码库和SQL查询之间的交互。然后，它收集并解决各种约束，以重建一个数据库，可以在不违反数据库完整性的情况下探索未覆盖的程序路径。我们的评估结果表明，S YNTH DB生成的数据库优于国家的最先进的数据库生成技术的代码和查询覆盖率在17个真实世界的PHP应用程序。具体来说，S YNTH DB生成的数据库实现了62.9%的代码覆盖率和77.1%的查询覆盖率，比最先进的技术在代码和查询覆盖率上分别高出14.0%和24.2%。此外，我们的安全分析结果表明，S YNTH DB有效地辅助现有的安全测试工具：Burp Suite，Wfuzz和webFuzz。由S YNTH DB辅助的Burp Suite可以检测到76.8%的漏洞，而其他现有技术只能检测到55.7%或更少。令人印象深刻的是，通过S YNTH DB，Burp Suite发现了33个以前未知的
—Testing database-backed web applications is challenging because their behaviors (e.g., control flow) are highly dependent on data returned from SQL queries. Without a database containing sufficient and realistic data, it is challenging to reach potentially vulnerable code snippets, limiting various existing dynamic-based security testing approaches. However, obtaining such a database for testing is difficult in practice as it often contains sensitive information. Sharing it can lead to data leaks and privacy issues. In this paper, we present S YNTH DB, a program analysis-based database generation technique for database-backed PHP applications. S YNTH DB leverages a concolic execution engine to identify interactions between PHP codebase and the SQL queries. It then collects and solves various constraints to reconstruct a database that can enable exploring uncovered program paths without violating database integrity. Our evaluation results show that the database generated by S YNTH DB outperforms state-of-the-arts database generation techniques in terms of code and query coverage in 17 real-world PHP applications. Specifically, S YNTH DB generated databases achieve 62.9% code and 77.1% query coverages, which are 14.0% and 24.2% more in code and query coverages than the state-of-the-art techniques. Furthermore, our security analysis results show that S YNTH DB effectively aids existing security testing tools: Burp Suite, Wfuzz, and webFuzz. Burp Suite aided by S YNTH DB detects 76.8% of vulnerabilities while other existing techniques cover 55.7% or fewer. Impressively, with S YNTH DB, Burp Suite discovers 33 previously unknown