Model-based Testing - From Safety to Security

Transcription

1 Model-based Testing - From Safety to Security Josip Bozic, Franz Wotawa Graz University of Technology {jbozic, wotawa}@ist.tugraz.at October 24, 2012 Josip Bozic, Franz Wotawa October 24, 2012 Page 1/28

2 Introduction Objects of Research model-based testing SQL injection black-box testing white-box testing fuzzing mutation testing Josip Bozic, Franz Wotawa October 24, 2012 Page 2/28

3 Introduction Model-based Testing Active testing methodology with the objective to generate test suites from models of the SUT. When using models for test suite generation it can be guaranteed that the test suite is complete with respect to the given model. Some faults might still not be detected either because of shortcomings regarding the system s model or combinations of test inputs that make use of unintended interactions between the system under test and its environment. Josip Bozic, Franz Wotawa October 24, 2012 Page 3/28

4 Intention Exploit SQL injection (SQLI) vulnerabilities of a given application. Avoid SUTs built-in input filters, which check every submitted piece of data for suspiciousness. Definition of methods for generating inputs, which will be able to escape all predefined filters so a valid query may be submitted to the database, retrieving stored information (e.g. passwords etc.). Josip Bozic, Franz Wotawa October 24, 2012 Page 4/28

5 Model-based Fuzzing Testing technique, which generates random or semi-random inputs through a fuzz generator. White-box testing method: the structure of the SUT is known. The goal of a SQLI fuzzer is to modify a part of the structure of a SQL statement as a new input without violating its existing syntactic validity. Josip Bozic, Franz Wotawa October 24, 2012 Page 5/28

6 Model-based Fuzzing Approach Description Josip Bozic, Franz Wotawa October 24, 2012 Page 6/28

7 Model-based Fuzzing Approach Description Grammar-based white-box fuzzing method Josip Bozic, Franz Wotawa October 24, 2012 Page 6/28

8 Model-based Fuzzing Approach Description Grammar-based white-box fuzzing method Uses symbolic tokens and input grammar Josip Bozic, Franz Wotawa October 24, 2012 Page 6/28

9 Model-based Fuzzing Approach Description Grammar-based white-box fuzzing method Uses symbolic tokens and input grammar Josip Bozic, Franz Wotawa October 24, 2012 Page 6/28

10 Model-based Fuzzing Josip Bozic, Franz Wotawa October 24, 2012 Page 7/28

11 Model-based Fuzzing 1. Predefined input is symbolically executed. 2. Create constraints on inputs from conditional statements ( input filters). 3. Negation of constraints. 4. Processing in a constraint solver. Find a concrete input that satisfies the constraints according to the grammar. Josip Bozic, Franz Wotawa October 24, 2012 Page 8/28

12 Model-based Fuzzing Example: Given input filters: Initial input: Josip Bozic, Franz Wotawa October 24, 2012 Page 9/28

13 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Josip Bozic, Franz Wotawa October 24, 2012 Page 9/28

14 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Josip Bozic, Franz Wotawa October 24, 2012 Page 9/28

15 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Negate constraint in path Josip Bozic, Franz Wotawa October 24, 2012 Page 9/28

16 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Negate constraint in path Josip Bozic, Franz Wotawa October 24, 2012 Page 10/28

17 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Negate constraint in path Satisfy constraint according to grammar Josip Bozic, Franz Wotawa October 24, 2012 Page 10/28

18 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Negate constraint in path Satisfy constraint according to grammar Josip Bozic, Franz Wotawa October 24, 2012 Page 11/28

19 Model-based Fuzzing Example: Given input filters: Initial input: Define symbolic token constraints: Negate constraint in path Satisfy constraint according to grammar Josip Bozic, Franz Wotawa October 24, 2012 Page 12/28

20 Model-based Fuzzing Fillter white spaces: URL encode the apostrophe: Double-, triple- etc. encodings may be also applied on other input characters, thus getting a very huge number of possible input patterns. Josip Bozic, Franz Wotawa October 24, 2012 Page 13/28

21 Model Inference Assisted Evolutionary Fuzzing Black-box testing approach Combines the usage of model inference and an evolutionary algorithm (EA) in order to generate better input parameters Uses an attack grammar G for generating test cases Mutation of individuals from initial population pool: replacement, crossover Fitness function for evaluation of individual input parts from initial population Goal: reach all locations within a program Josip Bozic, Franz Wotawa October 24, 2012 Page 14/28

22 Model Inference Assisted Evolutionary Fuzzing Evolutionary algorithm 1. generate initial population of individuals 2. evaluate the fitness of each individual using a fitness function 3. select best-fit individuals for reproduction 4. apply mutation and crossover over parents new offspring 5. evaluate the individual fitness of new individuals 6. replace least-fit individuals with new ones new population Josip Bozic, Franz Wotawa October 24, 2012 Page 15/28

23 Model Inference Assisted Evolutionary Fuzzing 1. Infer a model of the SUT with tools from the SPaCIos project all state transitions are obtained. Josip Bozic, Franz Wotawa October 24, 2012 Page 16/28

24 Model Inference Assisted Evolutionary Fuzzing 1. Infer a model of the SUT with tools from the SPaCIos project all state transitions are obtained. Josip Bozic, Franz Wotawa October 24, 2012 Page 17/28

25 Model Inference Assisted Evolutionary Fuzzing 2. Navigate through the entire system for user-controlled input (username, password etc.). Josip Bozic, Franz Wotawa October 24, 2012 Page 18/28

26 Model Inference Assisted Evolutionary Fuzzing 2. Navigate through the entire system for user-controlled input (username, password etc.). Josip Bozic, Franz Wotawa October 24, 2012 Page 19/28

27 Model Inference Assisted Evolutionary Fuzzing 3. Apply fuzzing from the initial state: according to the attack grammar G, generate input parts of SQL statement. Josip Bozic, Franz Wotawa October 24, 2012 Page 20/28

28 Model Inference Assisted Evolutionary Fuzzing 3. Apply fuzzing from the initial state: according to the attack grammar G, generate input parts of SQL statement. Josip Bozic, Franz Wotawa October 24, 2012 Page 21/28

29 Model Inference Assisted Evolutionary Fuzzing Initial query: Josip Bozic, Franz Wotawa October 24, 2012 Page 22/28

30 Model Inference Assisted Evolutionary Fuzzing Initial query: First mutation: Josip Bozic, Franz Wotawa October 24, 2012 Page 22/28

31 Model Inference Assisted Evolutionary Fuzzing Initial query: First mutation: Second mutation: Josip Bozic, Franz Wotawa October 24, 2012 Page 22/28

32 Model Inference Assisted Evolutionary Fuzzing Initial query: First mutation: Second mutation: Crossover: Josip Bozic, Franz Wotawa October 24, 2012 Page 22/28

33 Model-based Mutation Testing Proposed approach White-box approach Uses attack model which describes concrete syntax and order of attacks includes input queries but also alternative attacking directions and bears all known types of filter techniques Generation process of test sequences is directed Level of randomness is minimized Grammar for test case generation Josip Bozic, Franz Wotawa October 24, 2012 Page 23/28

34 Model-based Mutation Testing Josip Bozic, Franz Wotawa October 24, 2012 Page 24/28

35 Model-based Mutation Testing The idea behind this method is to mutate the attack model, either by changing parts of SQL injection statements or by changing the order of the execution. Josip Bozic, Franz Wotawa October 24, 2012 Page 25/28

36 Model-based Mutation Testing Josip Bozic, Franz Wotawa October 24, 2012 Page 26/28

37 Conclusion and Future Work New ideas concerning the implementation of several model-based testing techniques regarding SQLI. The implementation is still an area with high demand for further scientific research. Cover practical problems and examine further fundamental research. The same techniques may also be applied for other security breaking methods. Josip Bozic, Franz Wotawa October 24, 2012 Page 27/28

38 Questions? Thank You / Vielen Dank! Josip Bozic, Franz Wotawa October 24, 2012 Page 28/28