JMODEX: Model extraction for verifying security properties of web applications

Abstract

Detecting security vulnerabilities in web applications is an important task before taking them on-line. We present JMODEX, a tool that analyzes the code of web applications to extract behavioral models. The security properties of these models can then be verified with a model checker. An initial evaluation, in which a confirmed security flaw is identified using a model extracted by JMODEX, shows the tool potential.