Model-Based Penetration Test Framework for Web Applications Using TTCN-3

Based on our experience of collaborating with industry, we observed that test case generation usually relies on test case specifications (TCSs), commonly written in natural language, specifying test cases of a System Under Test at a high level of abstraction. In practice, TCSs are commonly used by test engineers as reference documents to perform these activities: 1) Manually executing test cases in TCSs; 2) Manually coding test cases in a test scripting language for automated test case execution. In the latter case, the gap between TCSs and executable test cases has to be filled by test engineers, requiring a significant amount of coding effort and domain knowledge. Motivated by the above observations from the industry, we first propose, in this paper, a TCS language, named as Restricted Test Case Modeling (RTCM), which is based on natural language and composed of an easy-to-use template, a set of restriction rules and keywords. Second, we propose a test case generation tool (aToucan4Test), which takes TCSs in RTCM as input and generates either manual test cases or automatically executable test cases, based on various coverage criteria defined on RTCM. To assess the applicability of RTCM, we manually modeled two industrial case studies and examined 30 automatically generated TCSs. To evaluate aToucan4Test, we modeled three subsystems of a Video Conferencing System developed by Cisco Systems, Norway and automatically generated executable test cases. These test cases were successfully executed on two commercial software versions. In the paper, we also discuss our experience of applying RTCM and aToucan4Test in an industrial context and compare our approach with other model-based testing methodologies.

Since the emergence of web 2.0, the architecture of web applications has been transformed significantly and its complexity has grown enormously. In such web applications, the user interface (UI) is an important ingredient and with the increased complexity, its testing is getting increasingly complex and cost/time-consuming process. Recently introduced, interaction flow modeling language (IFML) is an object management group (OMG) standard. IFML is gaining popularity for developing web applications, primarily, because of its excellent features for modeling UI elements, their content, and their interaction capturing capabilities. However, despite its superior UI modeling features, its UI testing is accomplished through traditional time-consuming techniques, which are employed after implementing the UI code. Hence, to overcome these limitations, this paper introduces a novel model-based testing approach for IFML UI elements. The proposed approach provides complete navigation testing using formal models. Moreover, the approach transforms the IFML models to all necessary UI testing artifacts by generating state transition matrix plus detailed UI test case document. As a part of a research, model-based user interface test case (MBUITC) generator tool is implemented to automatically generate navigation model for formal verification, test case document, and transition matrices from IFML models. The applicability of the proposed approach is validated through two benchmark case studies. The results have shown that the proposed approach provides test cases at the early stages of development, i.e., specification and analysis, which eventually helps in building a right product at the right time at a comparatively lower cost.

Evolving multi-parameter, multi-configuration systems require regression test suite that can be customized. This is in terms of run time. Run time can be customized by generating the combinations using combinatorial techniques. For systems like Contiki operating system, the test cases need to be executed in its simulator Cooja. Executing test cases in a simulator requires functional test cases to be generated from the combinatorial parameter combinations obtained. In this work we present a methodology to generate the functional test cases. We present Functional Test Case Generator for Contiki and Cooja (FTCGCC), which is a tool developed using our methodology. We demonstrate use of our tool by generating customizable regression test suite for Contiki and Cooja using code coverage as criteria. FTCGCC is developed for the test case generation when target System Under Test is IoT operating system Contiki and its simulator Cooja.

The main issues of current web application is easily hacking the user information by unauthorized person. The development of entire web application depends on scripting languages that easily displays the user authentication code to the web browser. All code must be transferred through query string parameter (URL) of the web application. This kind of application security fails when verifying it by penetration testing which is based on XSS languages. This study overcomes the security issues by developing a web application based on cross site scripting technique which the user codes are encrypted using RSA algorithm and cookies, cross domain verification based on encrypted use code. XSS vulnerabilities come in different forms and may be categorized into two varieties: reflected and stored. Reflected is on type of attack which can be performed against applications that employ a dynamic page error message to users. Stored XSS vulnerability appears when data submitted by one user is store in the application or in the back-end database. The user cookies of the web browser store only the encrypted key values. These techniques applied in Enterprise web application it support multiple organization for processing product purchase order, sales order and invoice details.

In the last decade, the automotive industry incorporated multiple electronic components into vehicles introducing various capabilities for adversaries to generate diverse types of attacks. In comparison to older types of vehicles, where the biggest concern was physical security, modern vehicles might be targeted remotely. As a result, multiple attack vectors aiming to disrupt different vehicle components emerged. Research and practice lack a comprehensive attack taxonomy for the automotive domain. In this regard, we conduct a systematic literature study, wherein 48 different attacks were identified and classified according to the proposed taxonomy of attack mechanisms. The taxonomy can be utilized by penetration testers in the automotive domain as well as to develop more sophisticated attacks by chaining multiple attack vectors together. In addition, we classify the identified attack vectors based on the following five dimensions: (1) AUTOSAR layers, (2) attack domains, (3) information security principles, (4) attack surfaces, and (5) attacker profile. The results indicate that the most applied attack vectors identified in literature are GPS spoofing, message injection, node impersonation, sybil, and wormhole attack, which are mostly applied to application and services layers of the AUTOSAR architecture.

Today almost all organizations have changed their traditional systems and have improved their performance using web-based applications. This process will make more profit and at the same time will increase the efficiency of their activities through customer support services and data transactions. Usually, web application take inputs from users through web form and send this input to get the response from database. Modern web-based application use web database to store all critical information such as user credentials, financial and payment information, company statistics etc. However error in validation of user input can cause database vulnerable to Structured Query Language Injection (SQLI) attack. By using SQLI attack, the attackers might insert malicious code in the user input and trying to gain access to the confidential and sensitive data from database. Security tester need to identify the appropriate test cases before starting exploiting SQL vulnerability in web-based application during testing phase. Identifying the test cases of a web application and analyzing the test results of an attack are important parts and consider as critical issues that affects the effectiveness of security testing. Thus, this research focused on the developing a framework for testing and detecting SQL injection vulnerability in web application. In this research, test cases will be generated automatically based on SQLI attack pattern and then the results will be executed automatically based on generated test cases. The primary focus in this paper is to develop a framework to automate security testing based on input injection attack pattern. To test our framework, we install a vulnerable web application and test result shows that the proposed framework can detect SQLI vulnerability successfully.

The rising of technology in the 21st century grows in a way that we never thought of before. The COVID-19 pandemic shifted many organizations in different sizes, specialties, and sectors to work online, resulting in a critical need to secure their software, applications, and web-based applications. Furthermore, Organizations that do not implement security in the Software Development Life Cycle (SDLC) process often discover that their applications suffer from security flaws and security bugs, thus exposing their applications to attacks. Applying security measures to the SDLC will ensure that applications are secure from the early planning stages until release. Penetration testing is an essential security measure and is counted as one of the best security practices applied to applications because it focuses on the technical part of application security. Each kind of application the organization uses, in-house developed applications or on-the-shelf applications, has its method for penetration testing. This paper is a systematic literature review that examines the web application security measures and the penetration testing methods and tools to detect vulnerabilities on web applications. Moreover, it gives a general view of adapting penetration testing as a security approach to the SDLC.

Web applications are crucial role for daily user activities such as online banking, online shopping and searching. It is important to ensure the reliability and web application testing has been used in finding various faults in order to improve the quality of reliable web services. Among test cases generation approaches, user session based testing is an approach to create test cases with real user data. However, real user data usage is extremely large and executing all the test cases can be time consuming in practice. This paper describes the test cases reduction approach for analyzing and replaying the large number of test cases generated from user session data. The entropy gain theory is applied in test cases reduction process to get the best test suite that covers all user accesses of web application. To evaluate the effectiveness of proposed method, the analytical results are described in terms of URLs coverage, reduction time and test cases reduction rate.

We present experiences from a case study where a model-based approach to black-box testing is applied to verify that aWireless Application Protocol (WAP) gateway conforms to its specification. TheWAP gateway is developed by Ericsson and used in mobile telephone networks to connect mobile phones with the Internet. We focus on testing the software implementing the session (WSP) and transaction (WTP) layers of the WAP protocol. These layers, and their surrounding environment, are described as a network of timed automata. To model the many sequence numbers (from a large domain) used in the protocol, we introduce an abstraction technique. We believe the suggested abstraction technique will prove useful to model and analyse other similar protocols with sequence numbers, in particular in the context of model-based testing. A complete test bed is presented, which includes generation and execution of test cases. It takes as input a model and a coverage criterion expressed as an observer, and returns a verdict for each test case. The test bed includes existing tools from Ericsson for test-case execution. To generate test suites, we use our own tool CO/ER--a new test-case generation tool based on the real-time model-checker UPPAAL.

Web application testing based on user session reduces artificial efforts while designing and generating test cases. It attracts more and more researchers and forms a hot spot of web application testing. Reduction, prioritization, and selection of test cases are widely used for the testing based on user session. In this paper, web application test cases optimization based on clustering is researched, and a novel method named USCHC (User Sessions Clustering based on Hierarchical Clustering algorithm for test cases optimization) is proposed. This method firstly gives the function to calculate the distance between the user sessions, and then employs the bottom-up agglutinate hierarchical clustering algorithm to cluster the initial testing cases and produces different kinds of test suites. From the clustered test suites, representative test cases are selected to replace the original test cases in each kind of test suites to test the functionality of web applications. The experiments show that the number of test cases is reduced through USCHC while the testing efficiency is improved.

A PN (place/transition net) is known as an algebraic model that is useful for describing concurrent, distributed and asynchronous properties of software, and it is also recognized as a model of MBT (model-based testing) that is an important technique for developing high quality software. We propose a concurrent N-switch coverage criterion to generate test cases of high coverage levels from a PN representing test specifications of software. All sequences of successive fireable transitions of length N+1 on the PN can be covered by executing test cases that satisfy the concurrent N-switch coverage criterion. This paper shows its processes, work products, algorithms, and examples.

Services are highly reusable, flexible and loosely coupled, which makes the evolution and the maintenance of composite services more complex. Evolution of BPEL composite service covers changes of processes, bindings and interfaces. In this paper, an approach is proposed to select and generate test cases during the evolution of BPEL composite service. The approach identifies the changes by using control-flow analysis technique and comparing the paths in new composite service version and the old one using extensible BPEL flow graph (or XBFG). Message flow is appended to the control flow so that XBFG can describe the behavior of composite service integrally. The binding and predicate constraint information added in XBFG elements can be used in path selection and test case generation. Theory analysis and case study both show that the approach is effective, and test cases coverage rate is high for the changes of processes, bindings and interfaces.

Test cases are essential parts to perform software testing as they play very significant role defining the test steps to work. Test cases can be generated either manually or automatically. Creating test cases manually has several disadvantages, such as higher probability in producing inaccurate results. Furthermore, generating test cases manually is ineffective since manual methods will take longer and require high human efforts. Therefore, generating test cases automatically is more preferable to limit the previous problems. Automated testing can also provide more accurate results than manual testing because it is less prone to human errors encouraging software developers to generate test cases automatically. Test cases can be generated from various sources, including UML diagrams. In this paper, we propose a method to generate test cases automatically by utilising depth-first search algorithms. The UML diagram used in this study is an activity diagram. This paper also provides a method to parse activity diagram that is created using the visual paradigm application that has been converted into an XML format. Our method is able to parse and convert the XML format into graph or tree form. Using our proposed method, a test case search will be carried out using the depth-first search on the tree form to generate test cases. Lastly, we also evaluate our method by comparing the generated test cases with cyclomatic complexity, the method will be performed manually and automatically to validate the results of many scenarios. Our result showed that our method could generate the same scenario (100% coverage) as the manual validation method.

Software testing is the key to ensuring software quality. Test case generation and software fault localization are two important research objects of testing. Spectrum-based fault localization (SBFL) method is a mainstream dynamic fault localization method, which inputs test cases into the program for execution and collects statement coverage information and execution results. By analysing this information, a fault report can be generated. The performance of SBFL is affected by test case quality. Therefore, this paper proposes a test case generation method based on improved genetic algorithm to assist SBFL. This method uses a small number of initial test cases to execute the program, then uses the XGBoost model to pre-process the spectrum information and generates a list of potential fault statements to guide the iterative process of the genetic algorithm. The experimental results show that the test cases generated using the improved genetic algorithm have certain advantages over the test cases generated by general genetic algorithm and the baseline test cases.

In recent years, web applications have evolved from small websites into large multi-tiered applications. The quality of web applications depends on the richness of contents, well structured navigation and most importantly its security. Web application testing is a new field of research so as to ensure the consistency and quality of web applications. In the last ten years there have been different approaches. Models have been developed for testing web applications but only a few focused on content testing, a few on navigation testing and a very few on security testing of web applications. There is a need to test content, navigation and security of an application in one go. The objective of this paper is to propose Dual Security Testing Model to test the security of web applications using UML modeling technique which includes web socket interface. In this research paper we have described how our security testing model is implemented using activity diagram, activity graph and based on this how test cases is generated.