“Invalidating web applications attacks by employing the right secure code”
From Navigators
Ricardo Morgado (advised by Ibéria Medeiros, Nuno Ferreira Neves)
Master’s thesis, Mestrado em Informática, Departamento de Informática, Faculdade de Ciências da Universidade de Lisboa, Sept. 2019
Abstract: Currently, web applications are the most common way to access companies’ services and resources. However, since their appearance, they are known to contain vulnerabilities in their source code. These vulnerabilities, when exploited, can cause serious damage to organizations, such as the theft of millions of user credentials and access to confidential data. For this reason, accessing critical services, such as health care and financial services, with safe web applications is crucial to its well-functioning. Often, vulnerabilities are left in the source code unintentionally by programmers because they do not have the necessary knowledge about how to write secure code. On the other hand, programmers that use secure functions from the programming language in their applications, employing thus secure code, believe that their applications are protected. However, some of those functions do not invalidate all attacks, leaving applications vulnerable. This dissertation has two main objectives: to study the diverse types of web application vulnerabilities, namely different attacks that exploit them, and different forms to build secure code for invalidating such attacks, and to develop a tool capable of protecting PHP web applications by inserting small corrections in their source code. The proposed solution was evaluated with both artificial and real code and the results showed that it can insert safe corrections while maintaining the original behavior of the web applications in the vast majority of the cases, which is very encouraging.
Export citation
Project(s): Project:SEAL
Research line(s): Fault and Intrusion Tolerance in Open Distributed Systems (FIT)
