Enhancing Penetration Testing with Attack Signatures and Interface Monitoring for the Detection of Injection Vulnerabilities in Web Services

Abstract

Web services are often deployed with critical software bugs that may be maliciously exploited. Developers often trust on penetration testing tools to detect those vulnerabilities but the effectiveness of such technique is limited by the lack of information on the internal state of the tested services. This paper proposes a new approach for the detection of injection vulnerabilities in web services. The approach uses attack signatures and interface monitoring to increase the visibility of the penetration testing process, yet without needing to access web service's internals (as these are frequently not available). To demonstrate the feasibility of the approach we implemented a prototype tool to detect SQL Injection vulnerabilities in SOAP. An experimental evaluation comparing this prototype with three commercial penetration testers was conducted. Results show that our prototype is able to achieve much higher detection coverage than those testers while avoiding false positives, indicating that the proposed approach can be used in real development scenarios.