Abstract
Web application/service is now omnipresent but its security risks, such as malware and vulnerabilities, are indeed underestimated. In this paper, we propose a protective, extensible and hybrid platform, named GuruWS, for automatically detecting both web application vulnerabilities and malicious web shells. Based on the original PHP vulnerability scanner THAPS, we propose E-THAPS which implements a novel detection mechanism, an improved SQL injection, Cross-site Scripting and vulnerability detection capabilities. For malicious web shell detection, taint analysis and pattern matching methods are chosen to be implemented in GuruWS. A number of extensive experiments are carried out to prove the outstanding performance of our proposed platform in comparison with several existing solutions in detecting either web application vulnerabilities or malicious web shells.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
https://sourceforge.net/p/laudanum/code/25/tree/, Github: /tennc/webshell,/shiqiaomu/webshell-collector, /tdifg/WebShell, /BlackArch/webshells, /JohnTroony/other-webshells, /lhlsec/webshell, /fuzzdb-project/fuzzdb, /JohnTroony/php-webshells.
- 9.
- 10.
- 11.
- 12.
- 13.
References
Internet Live Stats. http://www.internetlivestats.com/. Accessed 21 May 2017
Le, V.-G., Nguyen, H.-T., Lu, D.-N., Nguyen, N.-H.: A solution for automatically malicious web shell and web application vulnerability detection. In: Nguyen, N.-T., Manolopoulos, Y., Iliadis, L., Trawiński, B. (eds.) ICCCI 2016. LNCS (LNAI), vol. 9875, pp. 367–378. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-45243-2_34
Mazumder, M., Braje, T.: Safe client/server web development with Haskell. In: 2016 IEEE Cybersecurity Development (SecDev), p. 150 (2016)
Bherde, G.P., Pund, M.A.: Recent attack prevention techniques in web service applications. In: International Conference on Automatic Control and Dynamic Optimization Techniques (ICACDOT), pp. 1174–1180 (2016)
Khari, M., Sangwan, P., Vaishali: Web-application attacks: a survey. In: 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, pp. 2187–2191 (2016)
Kals, S., Kirda, E., Kruegel, C., Jovanovich, N.: SecuBat: a web vulnerability scanner. In: 15th International Conference on World Wide Web, pp. 247–256 (2006)
Jensen, T., Pedersen, H., Olesen, M.C., Hansen, R.R.: THAPS: automated vulnerability scanning of PHP applications. In: Jøsang, A., Carlsson, B. (eds.) NordSec 2012. LNCS, vol. 7617, pp. 31–46. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-34210-3_3
Dahse, J.: RIPS - a static source code analyser for vulnerabilities in PHP scripts. In: Seminar Work at Chair for Network and Data Security (2010)
Sasi, R.: Web backdoors - attack, evasion and detection. In: C0C0N Sec Conference (2011)
Petukhov, A., Dmitry, K.: Detecting security vulnerabilities in Web applications using dynamic analysis with penetration testing. In: OWASP Application Security Conference. Computing Systems Lab, Department of Computer Science, Moscow State University (2008)
Dahse, J., Holz, T.: Static detection of second-order vulnerabilities in web applications. In: 23rd USENIX Security Symposium (USENIX Security 2014), pp. 989–1003 (2014)
Starov, O., Dahse, J., Ahmad, S., Holz, T., Nikiforakis, N.: No honor among thieves: a large-scale analysis of malicious web shells. In: 25th International Conference on World Wide Web, pp. 1021–1032 (2016)
Le, H.H., Nguyen, N.H., Nguyen, T.T.: Exploiting GPU for large scale fingerprint identification. In: Nguyen, N.T., Trawiński, B., Fujita, H., Hong, T.-P. (eds.) ACIIDS 2016. LNCS (LNAI), vol. 9621, pp. 688–697. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49381-6_66
Wang, H., Liu, T., Guan, X., Shen, C., Zheng, Q., Yang, Z.: Dependence guided symbolic execution. IEEE Trans. Softw. Eng. 43(3), 252–271 (2017)
Bhme, M., Paul, S.: A probabilistic analysis of the efficiency of automated software testing. IEEE Trans. Softw. Eng. 42(4), 345–360 (2016)
Web Technology Surveys. http://w3techs.com/technologies/overview/programming_language/all/. Accessed 21 May 2017
YARA - The pattern matching swiss knife for malware researchers. http://virustotal.github.io/yara/. Accessed 10 May 2017
Popov, N.: PHP-parser introduction. https://github.com/nikic/PHP-Parser/blob/master/doc/0_Introduction.markdown. Accessed 15 Apr 2016
The Open Web Application Security Project. Static Code Analysis. https://www.owasp.org/index.php/Static_Code_Analysis. Accessed 22 May 2017
The Open Web Application Security Project. Attack Category: Command Injection. https://www.owasp.org/index.php/Command_Injection. Accessed 18 May 2017
The Open Web Application Security Project. Attack Category: PHP Object Injection. https://www.owasp.org/index.php/PHP_Object_Injection. Accessed 18 May 2017
The Open Web Application Security Project. Testing for Local File Inclusion. https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion. Accessed 18 May 2017
The Open Web Application Security Project. Attack Category: Direct Dynamic Code Evaluation (‘Eval Injection’). https://www.owasp.org/index.php/Direct_Dynamic_Code_Evaluation_(’Eval_Injection’). Accessed 18 May 2017
Bernardo Damele, A.G., Stampar, M.: SQLMap - automatic SQL injection and database takeover tool. http://www.sqlmap.org/. Accessed 12 May 2017
Deng, W., Liu, Q., Cheng, H., Qin, Z.: A malware detection framework based on Kolmogorov complexity. J. Comput. Inf. Syst. 7, 2687–2694 (2011)
Acknowledgments
The authors would like to thank the anonymous reviewers for their valuable comments and suggestions to improve this paper.
This work is partially supported by the national research project No. KC.01/16-20, granted by the Ministry of Science and Technology of Vietnam (MOST).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer-Verlag GmbH Germany, part of Springer Nature
About this chapter
Cite this chapter
Le, VG., Nguyen, HT., Pham, DP., Phung, VO., Nguyen, NH. (2019). GuruWS: A Hybrid Platform for Detecting Malicious Web Shells and Web Application Vulnerabilities. In: Nguyen, N., Kowalczyk, R., Hernes, M. (eds) Transactions on Computational Collective Intelligence XXXII. Lecture Notes in Computer Science(), vol 11370. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-58611-2_5
Download citation
DOI: https://doi.org/10.1007/978-3-662-58611-2_5
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-662-58610-5
Online ISBN: 978-3-662-58611-2
eBook Packages: Computer ScienceComputer Science (R0)