CAREER: Next Generation Black-Box Web Application Vulnerability Analysis

最近的敏感数据泄露是由Web应用程序中被忽视的漏洞造成的。为了保护他们的Web应用程序，公司通常会雇佣专业黑客来入侵他们的Web应用程序。虽然这个过程可以发现漏洞，但成本高昂，而且无法扩展。黑盒漏洞扫描程序试图自动执行此过程。通过将Web应用程序视为黑盒（不了解应用程序的源代码），这些工具可以发现未知的漏洞。传统上，这些工具的工作原理是抓取Web应用程序，识别输入向量，然后注入恶意输入。然而，尽管在商业上以数万美元的价格出售，PI已经表明它们是无效的。该项目旨在创建一个新的和有效的黑盒漏洞分析框架，发现任何Web应用程序中的未知漏洞。PI提出了一种称为归纳逆向工程的新技术，利用归纳编程的最新进展，可以自动逆向工程Web应用程序的源代码的抽象。然后，该工具将使用静态分析技术来发现逆向工程代码抽象中的潜在漏洞。该项目的目标是推进最先进的黑盒漏洞分析工具。所有的工具和技术都将是开源的，以便研究人员和行业能够受益。在现实世界的软件中使用该工具将导致发现和修复更多的漏洞，从而提高软件的整体安全性。此外，PI将创建并领导实践研讨会，让所有CS学生学习和利用漏洞，以及了解道德方面的考虑。将发布所需的教育模块和软件基础设施。

Recent sensitive data breaches are caused by overlooked vulnerabilities in web applications. To secure their web applications, companies typically hire professional hackers to break into their web applications. While this process finds vulnerabilities, it is costly and does not scale. Black-box vulnerability scanners attempt to automate this process. By treating the web application as a black-box (no knowledge of the source code of the application), these tools can discover unknown vulnerabilities. Traditionally, these tools work by crawling the web application, identifying input vectors, then injecting malicious input. However, despite being sold commercially for tens of thousands of dollars, the PI has shown that they are ineffective. This project aims to create a novel and effective black-box vulnerability analysis framework that finds unknown vulnerabilities in any web application.The PI proposes a novel technique called inductive reverse engineering which, using recent advances in inductive programming, can automatically reverse engineer an abstraction of the web application's source code. Then, the tool will use static analysis techniques to discover potential vulnerabilities in the abstraction of the reverse engineered code. The goal of this project is advance the state-of-the-art in black-box vulnerability analysis tools. All tools and techniques will be open-sourced, so that researchers and industry can benefit. Use of the tool on real-world software will result in more vulnerabilities found and fixed, thus improving software security as a whole. In addition, the PI will create and lead hands-on workshops that allow all CS students to study and exploit vulnerabilities, as well as understand the ethical considerations. The education modules and the software infrastructure required will be released.