CAREER: Next Generation Black-Box Web Application Vulnerability Analysis

最近的敏感数据泄露是由web应用程序中被忽视的漏洞引起的。为了确保网络应用程序的安全，公司通常会雇佣专业黑客来入侵他们的网络应用程序。虽然这个过程可以发现漏洞，但成本很高，而且无法扩展。黑盒漏洞扫描器试图自动执行此过程。通过将web应用程序视为黑盒（不知道应用程序的源代码），这些工具可以发现未知的漏洞。传统上，这些工具的工作方式是爬取web应用程序，识别输入向量，然后注入恶意输入。然而，尽管商业上以数万美元的价格出售，PI已经表明它们是无效的。该项目旨在创建一个新颖有效的黑盒漏洞分析框架，发现任何web应用程序中的未知漏洞。PI提出了一种称为归纳逆向工程的新技术，该技术利用归纳编程的最新进展，可以自动地对web应用程序源代码的抽象进行逆向工程。然后，该工具将使用静态分析技术来发现逆向工程代码抽象中的潜在漏洞。该项目的目标是在黑盒漏洞分析工具中推进最先进的技术。所有的工具和技术都将是开源的，这样研究人员和工业界都能从中受益。在实际软件上使用该工具将导致发现和修复更多漏洞，从而从整体上提高软件安全性。此外，PI将创建和领导动手研讨会，让所有CS学生学习和利用漏洞，以及了解道德考虑因素。所需的教育模块和软件基础设施将被发布。

Recent sensitive data breaches are caused by overlooked vulnerabilities in web applications. To secure their web applications, companies typically hire professional hackers to break into their web applications. While this process finds vulnerabilities, it is costly and does not scale. Black-box vulnerability scanners attempt to automate this process. By treating the web application as a black-box (no knowledge of the source code of the application), these tools can discover unknown vulnerabilities. Traditionally, these tools work by crawling the web application, identifying input vectors, then injecting malicious input. However, despite being sold commercially for tens of thousands of dollars, the PI has shown that they are ineffective. This project aims to create a novel and effective black-box vulnerability analysis framework that finds unknown vulnerabilities in any web application.The PI proposes a novel technique called inductive reverse engineering which, using recent advances in inductive programming, can automatically reverse engineer an abstraction of the web application's source code. Then, the tool will use static analysis techniques to discover potential vulnerabilities in the abstraction of the reverse engineered code. The goal of this project is advance the state-of-the-art in black-box vulnerability analysis tools. All tools and techniques will be open-sourced, so that researchers and industry can benefit. Use of the tool on real-world software will result in more vulnerabilities found and fixed, thus improving software security as a whole. In addition, the PI will create and lead hands-on workshops that allow all CS students to study and exploit vulnerabilities, as well as understand the ethical considerations. The education modules and the software infrastructure required will be released.