Discovering Authorization Business Rules toward Detecting Web Applications Logic Flaws

Abstract

Aggressive integration of validation checks into web framework software has altered the attack surface of web applications by reducing the opportunity for traditional injection flaws. The hacking community's reaction has shifted to a more subtle - and more challenging to detect - form of attacks, that of discovering and exploiting underlying application business logic. The lack of accurate business rules defining the final application product extends its logical vulnerability surface. We propose a novel black-box approach for discovering authorization business rules in web applications through users' dynamic behavior. Allowing applications that lack formal specifications to be better tested for logic vulnerabilities. Our approach discovers groups using agglomerative hierarchical clustering based on different profiling techniques that capture users' actions and privileges. We also automated the process of identifying the optimal number of roles. The results indicated high quality and stability in discovering business rules, even in smaller datasets.