Later archive addition

BLOCK: A Black-Box Approach for Detection of State Violation Attacks Towards Web Applications

Xiaowei Li and Yuan Xue

BLOCK infers a web application's intended behaviour model from attack-free traffic alone, extracting invariants over request/response sequences and their associated session variable values. At runtime any request or response violating its invariants is flagged as a state violation attack. Built on the WebScarab proxy, it needs no source code and was evaluated on real applications.

Record

Researcher

Xiaowei Li and Yuan Xue

In the archive

• Added to the 2011 archive after the original list was published

Tags

• detection
• dynamic-analysis
• proxy
• defence
• auth-bypass
• tooling
• owasp-a01-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Xiaowei Li and Yuan Xue, first published at the original source. Preserved copies are kept so the citation survives its host.