CODE BLUE 2016 - Method of Detecting Vulnerability in Web Apps
11 likes8,708 views
This document summarizes a presentation about using machine learning to detect web application vulnerabilities. The speaker discusses developing an AI called SAIVS that can automatically crawl web apps and detect vulnerabilities. SAIVS uses techniques like naive Bayes and multilayer perceptrons to recognize page types, detect crawling failures, and input correct form values through reinforcement learning. It is pre-trained on sample web apps to efficiently learn crawling before analyzing real client apps. The goal is to develop fully automated security assessment that does not rely on human skills.
![MBSD
<h2>2 errors prohibited this user from being saved </h2>
<p>There were problems with these fields:</p>
<ul>
<li> Password doesn't match confirmation </li>
<li> Email is invalid </li>
["Password doesn't match confirmation","Email is invalid
"]
</ul>
CODE BLUE 2016
Extracts keywords that characterize failure.
Excludes “Stop words”.
Recognition of page crawling success/fail by machines](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-46-320.jpg)
![Example of the use of the text generation.
MBSD CODE BLUE 2016
Generation of source code.（from Andrej Karpathy blog)
static int indicate_policy(void)
{
int error;
if (fd == MARN_EPT) {
if (ss->segment < mem_total)
unblock_set_blocked();
else
ret = 1;
goto bail;
}
segaddr = in_SB(in.addr);
selector = seg / 16;
・・・
Training Data
static void settings(struct *tty)
{
if (tty == tty)
disable_single_st_p(dev);
pci_disable_spool(port);
return 0;
}
static void command(struct seq_file *m)
{
int column = 32 << (cmd[2] & 0x80);
if (state)
・・・
Generated source code by LSTM
It can generate a code from the starting point (seed).](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-107-320.jpg)
![MBSD
_satellite.pageBottom();']
(function(window) {
var _gaq = _gaq || [];
var methods = ['log', 'dir', 'trace'];
if (typeof window.console === 'undefined') {
window.console = {};
}
for (var i in methods) {
if (!(methods[i] in window.console)) {
window.console[methods[i]] = function() {};
}
}
}(window));
CODE BLUE 2016
10,000 pages of JavaScript syntax.
Learning data for LSTM (JavaScript)](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-114-320.jpg)
![Generated syntax by learned LSTM (one example)
MBSD
Seed Generated syntax
<textarea cols="60">xxx </textarea>
<!– mbsdtest xxx -->
<input type="" value=“xxx ">
var hoge = ['log', ‘xxx red’];¥r¥n
/* mbsdtest xxx */
function(){ xxx }¥r¥n
CODE BLUE 2016
It can generate a syntax from the seeds.](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-115-320.jpg)
![Test patterns（one example）
MBSD
Output point Test pattern
attribute value :「”」
attribute value :「'」
attribute value : noquote
outside of HTML tags
“event handler
"><sCriPt>xxx
"><img src=xxx
‘event handler
‘><sCriPt>xxx
<svg/onload=alert()>
<sCriPt>xxx</sCriPt>
JavaScript
";alert();//
[CR][LF]alert();
¥";alert();//
CODE BLUE 2016](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-124-320.jpg)
![MBSD
WAVSEP
CODE BLUE 2016
ReflectedXSS GET Input Vector
Case06 output ：SRC attr value of IMG tag.
sanitize ：< , > ⇒ < , >
testing value："onmouseover=alert(3122);"
Case10 output ：onClick value of SCRIPT tag.
sanitize ：“ , < , > ⇒ " , < , >
testing value：';alert(3122);//
Case27 output ：single line comment of JavaScript
sanitize ：comment out
testing value：[CR][LF]alert(3122);//
Web Apps for pre-training（one example）.](https://image.slidesharecdn.com/codeblue201620161017shareen-161023224701/85/CODE-BLUE-2016-Method-of-Detecting-Vulnerability-in-Web-Apps-134-320.jpg)
![Politiques Sécurité de l'Information - [SCASSI] [Club 27001] [TLS] [2013]](https://cdn.slidesharecdn.com/ss_thumbnails/scassi-politiques-secu-club27001tls-20130412-140226193022-phpapp02-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
Viewers also liked (20)
Similar to CODE BLUE 2016 - Method of Detecting Vulnerability in Web Apps (20)
Ad
More from Isao Takaesu (11)
Ad
Recently uploaded (20)
CODE BLUE 2016 - Method of Detecting Vulnerability in Web Apps
- 1. CODE BLUE 2016 Presented by Isao Takaesu Method of Detecting Vulnerability in Web Apps Using Machine Learning
- 2. About the speaker • Occupation: Web security engineer • Company: Mitsui Bussan Secure Directions • Hobbies: Making scanners, Machine Learning • Blog: http://www.mbsd.jp/blog/ • Presented in “Black Hat Asia 2016” Arsenal • hosted “AISECjp” Isao Takaesu MBSD (@bbr_bbq) CODE BLUE 2016
- 3. Agenda MBSD CODE BLUE 2016 1. Introduction 2. Objectives of research 3. Overview of SAIVS 4. Realized methods 5. Validation results 6. Demonstration 7. Future Prospects
- 4. Introduction MBSD CODE BLUE 2016 In Japan, there is a significant lack of security engineers.
- 5. MBSD CODE BLUE 2016 About 240,000 people short. (according to a survey by IPA) Introduction
- 6. MBSD CODE BLUE 2016 Are we facing the limit of human-only resources? Introduction
- 7. Objectives of research MBSD CODE BLUE 2016 Fully automated information security.
- 8. MBSD CODE BLUE 2016 The first step is Web application vulnerability assessment. Objectives of research
- 9. What is web app vul assessment？ MBSD CODE BLUE 2016 Detect vulnerabilities on web apps.
- 10. MBSD Security engineer Web Server Web Apps Our company Client company Pseudo-attack Analyze response CODE BLUE 2016 Performs pseudo-attacks while crawling the pages of web apps. Analyzes the response and detects vulnerabilities. What is web app vul assessment？
- 11. MBSD Web Server Web Apps SQLi? XSS? CODE BLUE 2016 Our company Client company Pseudo-attack Analyze response Security engineer Performs pseudo-attacks while crawling the pages of web apps. Analyzes the response and detects vulnerabilities. What is web app vul assessment？
- 12. Issues of web app vul assessment MBSD CODE BLUE 2016 Depends on the skilled craftsmanship of security engineers.
- 13. Our “GOAL” Realize ALL MACHINE web app vulnerability assessment. MBSD The AI Web Server Web Apps CODE BLUE 2016 Our company Client company Pseudo-attack Analyze response SQLi? XSS?
- 14. Overview of AI ”SAIVS” MBSD SAIVS Spider Artificial Intelligence Vulnerability Scanner CODE BLUE 2016 AI that performs web app vul assessment.
- 15. Abilities of SAIVS MBSD Crawls web apps Detects vulnerabilities CODE BLUE 2016
- 16. Abilities of SAIVS MBSD Crawls web apps Detects vulnerabilities CODE BLUE 2016
- 17. Importance of crawling MBSD CODE BLUE 2016 Top Login Register Confirm Contact Us My Page Complete vulnerability Send message
- 18. MBSD CODE BLUE 2016 Top Login Register Confirm Contact Us My Page Complete It is necessary to log in correctly. Importance of crawling Send message
- 19. MBSD CODE BLUE 2016 Top Login Register Confirm Contact Us My Page Complete Importance of crawling. It is necessary to register correctly. Send message
- 20. MBSD CODE BLUE 2016 Top Login Register Confirm Contact Us My Page Complete It is important to exhaustively crawl pages. Importance of crawling Send message
- 21. MBSD Crawling web apps is difficult. Why？ CODE BLUE 2016
- 22. What is the type of this page ? MBSD CODE BLUE 2016 Humans : Easily recognize the page type. Machine : Difficult. (Log in? Register?)
- 23. What has just happened? MBSD Humans : Recognize failed crawling attempts from the message. Machine : Difficult to interpret the message. CODE BLUE 2016
- 24. What are your input values to crawl to the next page ? MBSD crawl Humans : Input correct values in the form. Machine : Difficult to interpret the meaning of the form. ??? ??? ??? ??? ??? CODE BLUE 2016
- 25. MBSD Crawling requires complex thinking. CODE BLUE 2016
- 26. 3 requirements for crawling MBSD Recognize the page type Recognize the success/fail of crawling Input correct values in the forms CODE BLUE 2016
- 27. MBSD CODE BLUE 2016 How do you achieve them？
- 28. Our approach MBSD CODE BLUE 2016 Reverse engineering of the human brain.
- 29. MBSD CODE BLUE 2016 Each thinking pattern implemented in machine learning. Our approach
- 30. 3 requirements for crawling MBSD CODE BLUE 2016 Recognize the page type Recognize the success/fail of crawling Input correct values in the forms
- 31. Page recognition by humans MBSD CODE BLUE 2016
- 32. Page recognition by humans MBSD CODE BLUE 2016 Recognize the keywords that characterize the page.
- 33. Page recognition by machines MBSD CODE BLUE 2016 Using Naive Bayes.
- 34. What is Naive Bayes? Naive Bayes is used for auto classification of texts. Uses pre-defined categories & laws of probability. MBSD examples) Spam mail filter. Classify blog post genres. Improvement of defensive accuracy for WAF. CODE BLUE 2016
- 35. MBSD SPAM：0.672 ← Selected HAM ：0.03 limited SPAM：40％ HAM ：10％ Category period click here http:// wana.jp SPAM：10％ HAM ：30％ SPAM：70％ HAM ：50％ SPAM：30％ HAM ：40％ SPAM：80％ HAM ：5％ Extracting a keyword from the mail text. Example of the use of the spam e-mail filter. CODE BLUE 2016 To calculate the probability of SPAM and HAM, to select the probability is high category.
- 36. MBSD CODE BLUE 2016 Page recognition by Naive Bayes
- 37. Page recognition by Naive Bayes MBSD <h1>Sign in</h1> <form action="/cyclone/sessions" method="post"> <label for="email">Email</label> <input id="email" name="email" type="text" /> <label for="password">Password</label> <input id="password" name="password" type="password" /> </form> Extracts keywords that characterize the page. Excludes “Stop words”. CODE BLUE 2016
- 38. Category table for page recognition MBSD Categories Keywords Log in Email, User ID, Password, Sign in … Register user Email, Password, Confirm, Sign up … Search Word, Text, String, Sort, Search … Purchase goods Credit, Account, Expire, Purchase … Change password Password, Old Password, Change … CODE BLUE 2016 Selects the category that contain the many keywords. Keywords : Sign in, Email, Password
- 39. MBSD Categories Keywords Log in Email, User ID, Password, Sign in … Register user Email, Password, Confirm, Sign up … Search Word, Text, String, Sort, Search … Purchase goods Credit, Account, Expire, Purchase … Change password Password, Old Password, Change … CODE BLUE 2016 “Log in” category contains many of the keywords. ⇒ The highest probability of the category "Log in". Category table for page recognition
- 40. MBSD CODE BLUE 2016 This page is recognized as ”Log in”. Page recognition by Naive Bayes
- 41. 3 requirements for crawling MBSD CODE BLUE 2016 Recognize the page type (✔) Recognize the success/fail of crawling Input correct values in the forms
- 42. MBSD CODE BLUE 2016 Recognition of page crawling success/fail by humans
- 43. MBSD CODE BLUE 2016 Recognition of page crawling success/fail by humans Recognizes the keywords that characterize failure.
- 44. MBSD CODE BLUE 2016 Using Naive Bayes. Recognition of page crawling success/fail by machines
- 45. MBSD CODE BLUE 2016 Recognition of page crawling success/fail by machines
- 46. MBSD <h2>2 errors prohibited this user from being saved </h2> <p>There were problems with these fields:</p> <ul> <li> Password doesn't match confirmation </li> <li> Email is invalid </li> ["Password doesn't match confirmation","Email is invalid "] </ul> CODE BLUE 2016 Extracts keywords that characterize failure. Excludes “Stop words”. Recognition of page crawling success/fail by machines
- 47. Category table for page crawling success/fail MBSD Categories Keywords Success good, valid, success, normal, fine, clean, nice, can, match, confirmation, ok, finish, thank … Failure bad, invalid, failure, error, problem, unmatch, doesn’t match, can’t, too, wrong, ng, blank … CODE BLUE 2016 Selects the category that contain the many keywords. Keywords : errors, problem, doesn’t match, invalid
- 48. MBSD Categories Keywords Success good, valid, success, normal, fine, clean, nice, can, match, confirmation, ok, finish, thank … Failure bad, invalid, failure, error, problem, wrong, doesn’t match, can’t, too, ng, blank … CODE BLUE 2016 “Failure“ category contains many of the keywords. ⇒ The highest probability of the category "Failure". Category table for page crawling success/fail
- 49. MBSD CODE BLUE 2016 This is recognized as a page transition ”failure”. Recognize the success/fail of crawling by machines
- 50. 3 requirements for crawling MBSD CODE BLUE 2016 Recognize the page type (✔). Recognize the success/fail of crawling (✔). Input correct values in the forms.
- 51. MBSD CODE BLUE 2016 Interprets the meaning of the form and inputs correct values. crawl Isao Takaesu [email protected] mbsd1234 mbsd1234 Inputting correct values by humans
- 52. MBSD CODE BLUE 2016 Using multilayer perceptron & Q-Learning. Inputting correct values by machines
- 53. What is multilayer perceptron（MLP）？ MBSD examples) Image recognition. Hand-written number recognition. CODE BLUE 2016 MLP is used for image recognition. The model simulates the neural structure and function.
- 54. ・ ・ ・ ・ ・ ・ ・ ・ ・ Data Label 0 1 2 Training Data Example of the use of the hand-written number recognition CODE BLUE 2016MBSD ・ ・ ・ ・ ・ ・ ・ ・ ・ X₁ X₂ X784 X0 Y₁ Y₂ Y300 Y0 Z₁ Z₂ Z10 MLP Learn It can output the answer depending on the input data.
- 55. Learned MLP 014679 425970401967 CODE BLUE 2016MBSD Example of the use of the hand-written number recognition
- 56. An algorithm that learns the best behavior of the agent. Evaluates effectiveness of the behavior using the Q-value. MBSD examples) Locomotive learning in robots. Playing video games. Route search. CODE BLUE 2016 What is Q-Learning？
- 57. Example of the use of the locomotive learning in robots MBSD CODE BLUE 2016 Agent Environment a1 Forward a2 Left turn a3 Right turn a4 Backward Action State s ・・・ Next state s’ Policy ( a | s ) Transition probability ( s’ | s, a ) hole in the front of the eye … Reward r = R( s, a, s’ ) Task : The goal to avoid obstacles. Learn the policies that total of reward is the maximum. Update Q( s, a )
- 58. Model to attain correct input values MBSD Learns correct input values while attempting to crawl. CODE BLUE 2016 ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 59. MBSD CODE BLUE 2016 Model to attain correct input values ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight Learns correct input values while attempting to crawl.
- 60. Patterns of input value MBSD Pattern Input value Char abc, abcdef, aBc, aBcdEf, ABCDEF … Num 123, 12345, 4111111111111111 … Char,Num abc123, 123abc, aBc123, 1a2b3c … Char,Symbol abc!, abc!#$, abcdef!, abcdef!#$ … Num,Symbol 123!, 123!#$, 12345!, !#$12345 … Char,Num,Symbol abc123!, 123abc!, abc!123, !#$%&a1 … Mail address [email protected], [email protected] … CODE BLUE 2016 Set a combination of input values to the parameter. Target : INPUT TYPE ＝ text, password
- 61. MBSD Inputs ”current" and "next" page to MLP. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 62. MBSD Selects any input pattern from the input of MLP. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 63. MBSD Attempts to crawl using the selected input pattern of MLP. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 64. MBSD Observe the result of crawling. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 65. MBSD Gives a reward depending on the result of crawling. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 66. MBSD Update the weight of MLP using backpropagation. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 67. MBSD Learning can be completed at approx. 300 attempts. CODE BLUE 2016 Learning flow ・ ・ ・ ・ ・ ・ Current page MLP Input values Q-Learning Next page p1=abc, xyz・・・ p1=123, 12a・・・ p1=abc@xxx・・・ observe state evaluate update weight
- 68. Problem MBSD CODE BLUE 2016 300 attempts ⇒ Inefficient
- 69. MBSD CODE BLUE 2016 Pre-training. Solution
- 70. Web apps for pre-training（one example）. MBSD OWASP Broken Web Apps CODE BLUE 2016
- 71. Training SAIVS MBSD CODE BLUE 2016 BodgeIt peruggia WackoPicko Yazd SAIVS Web Apps Attempts crawling & learning ⇒ Each 300 times Achieves the correct input values for each form. ・・・
- 72. Achieved correct input values (one example). MBSD Input form Correct input value ID abc, abcdef, aBc, aBcdEf, ABCDEF … Password abc123!, 123abc!, abc!123, !#$%&a1 … FirstName abc, abcdef, aBc, aBcdEf, ABCDEF … LastName abc, abcdef, aBc, aBcdEf, ABCDEF … Email address [email protected], [email protected] … Username abc, abcdef, aBc, aBcdEf, ABCDEF … Signature abc, abcdef, aBc, aBcdEf, ABCDEF … CODE BLUE 2016
- 73. Problem：mismatch of form strings MBSD CODE BLUE 2016 Used in Training Used in actual assessment Mismatch!!
- 74. MBSD CODE BLUE 2016 Calculate the similarity of form strings. Solution
- 75. Calculate similarity MBSD CODE BLUE 2016 Using word2vec.
- 76. What is word2vec？ Calculation method for similar words in NLP. A word is represented by a vector. MBSD CODE BLUE 2016 examples) Adding and subtracting words word cos distance email 0.956302 mail 0.927386 reply 0.920610 formula answer Iraq - Violence Jordan Human - Animal Ethics Japan – Tokyo + France Paris Similarity between words Input : e-mail
- 77. Example of the use of the similarity calculation MBSD CODE BLUE 2016 Calculate similarity using words around the word of interest. Training data) interpretation further. However, if anyone wishes to discuss this, I‘m certainly willing (either offline - e-mail - or Stephen In article [email protected] (Mathemagician) writes: Just what do gay people do that straight・・・ carries archives of old alt.atheism.moderated articles and assorted other files. For more information, send mail to [email protected] saying help send atheism/index and it will mail back a reply. mathew An・・・ send mail to [email protected] saying help send atheism/index and it will mail back a reply. mathew An Introduction to Atheism by Mathew. This article attempts to provide a general introduction・・・ The similarity of the "e-mail", "mail", "reply" is high.
- 78. Word2vec training data MBSD CODE BLUE 2016 The 20 Newsgroups data set. A collection of newsgroups : about 20,000 news. examples of newsgroup) Computer（Graphics, MS-Windows, Hardware） Science（Cryptography, Electronics, Space） Hobby（Motorcycles, Baseball, Hockey）
- 79. MBSD CODE BLUE 2016 Windows Crypt Hardware Space SAIVS The 20 Newsgroups data set Learns the similarity Learns the similarity between the words. word2vec Training SAIVS ・・・
- 80. MBSD candidate similarity email 0.956302 mail 0.927386 E-mail 0.900249 address 0.893337 reply 0.865438 contact 0.846801 message 0.792930 chat 0.754903 newsgroup 0.747636 CODE BLUE 2016 candidate similarity names 0.962508 username 0.939661 nickname 0.933694 naming 0.898254 surname 0.863966 initials 0.861093 firstname 0.849641 lastname 0.847604 title 0.782467 candidate similarity homepage 0.794415 blog 0.752945 site 0.708534 webpage 0.701838 portal 0.701374 forum 0.692067 com 0.641086 archive 0.537914 org 0.531096 Extracts candidate words of Top 10. Learned similarities in the training Target ：websiteTarget ：nameTarget ： e-mail
- 81. MBSD candidate similarity email 0.956302 mail 0.927386 E-mail 0.900249 address 0.893337 reply 0.865438 contact 0.846801 message 0.792930 chat 0.754903 newsgroup 0.747636 CODE BLUE 2016 candidate similarity names 0.962508 username 0.939661 nickname 0.933694 naming 0.898254 surname 0.863966 initials 0.861093 firstname 0.849641 lastname 0.847604 title 0.782467 candidate similarity homepage 0.794415 blog 0.752945 site 0.708534 webpage 0.701838 portal 0.701374 forum 0.692067 com 0.641086 archive 0.537914 org 0.531096 Selects a candidate word that matches the form string of training. Learned similarities in the training Target ：websiteTarget ：nameTarget ： e-mail
- 82. MBSD candidate similarity email 0.956302 mail 0.927386 E-mail 0.900249 address 0.893337 reply 0.865438 contact 0.846801 message 0.792930 chat 0.754903 newsgroup 0.747636 CODE BLUE 2016 candidate similarity names 0.962508 username 0.939661 nickname 0.933694 naming 0.898254 surname 0.863966 initials 0.861093 firstname 0.849641 lastname 0.847604 title 0.782467 candidate similarity homepage 0.794415 blog 0.752945 site 0.708534 webpage 0.701838 portal 0.701374 forum 0.692067 com 0.641086 archive 0.537914 org 0.531096 Learned similarities in the training Target ：websiteTarget ：nameTarget ： e-mail ⇒ [email protected] ⇒ aBcdEf ⇒ http://hoge.com
- 83. MBSD CODE BLUE 2016 3 requirements for crawling Recognize the page type (✔). Recognize the success/fail of crawling (✔). Input correct values in the forms (✔).
- 84. Demonstration of crawling MBSD Target：OWASP Broken Web Apps Cyclone CODE BLUE 2016
- 85. MBSD CODE BLUE 2016 Top Login Register Confirm User Search Complete １．Create a login account in "register". ２．Log in. ３．Search users. Demonstration of crawling vulnerability
- 86. MBSD CODE BLUE 2016 Top Login Register Confirm User Search Complete １．Create a login account in "register". ２．Log in. ３．Search users. Demonstration of crawling
- 87. MBSD CODE BLUE 2016 Top Login Register Confirm User Search Complete １．Create a login account in "register". ２．Log in. ３．Search users. Demonstration of crawling
- 88. MBSD CODE BLUE 2016 Top Login Register Confirm User Search Complete Demonstration of crawling １．Create a login account in "register". ２．Log in. ３．Search users.
- 89. MBSD CODE BLUE 2016 Top Login Register Confirm User Search Complete １．Create login account in "register". ２．Log in. ３．Search users. Demonstration of crawling
- 90. MBSD CODE BLUE 2016 https://www.youtube.com/watch?v=aXw3vgXbl1U Demonstration movie of crawling
- 91. Abilities of SAIVS MBSD Crawls web apps. (✔) Detects vulnerabilities. CODE BLUE 2016
- 92. MBSD CODE BLUE 2016 To detect vulnerabilities with less trouble. Objective of this research
- 93. MBSD CODE BLUE 2016 There are many web application vulnerabilities...
- 94. MBSD CODE BLUE 2016 Reflected Cross-Site Scripting (RXSS) Target vulnerability of this research
- 95. Example of RXSS Pattern 1：very vulnerable web app MBSD <html> <head> <meta http-equiv="Content-Type" content="text/html"> <title>Case 3 - RXSS</title> </head> <body> <input type="text" value="testData"> </body> </html> http://xxx/case3/?input=testData Input value is echoed in the "VALUE" attribute of the INPUT tag. CODE BLUE 2016
- 96. MBSD <html> <head> <meta http-equiv="Content-Type" content="text/html"> <title>Case 3 - RXSS</title> </head> <body> <input type="text" value=""/><script>alert('XSS');</script>"> </body> </html> http://xxx/case3/?input="/><script>alert(‘XSS');</script> JavaScript is inserted in the HTML syntax. CODE BLUE 2016 Example of RXSS Pattern 1：attacking a web app
- 97. Example of RXSS Pattern 2：a little more secure web app MBSD <html> <head> <meta http-equiv="Content-Type" content="text/html"> <title>Case 4 - RXSS</title> </head> <body> <input type="text" value=""/> alert('XSS');"> </body> </html> SCRIPT tag is sanitized by the web app. http://xxx/case4/?input="/><script>alert(‘XSS');</script> CODE BLUE 2016
- 98. Example of RXSS Pattern 2：attacking web app MBSD <html> <head> <meta http-equiv="Content-Type" content="text/html"> <title>Case 4 - RXSS</title> </head> <body> <input type="text" value=""onmouseout=alert('XSS')""> </body> </html> JavaScript is inserted to avoid sanitization. http://xxx/case4/?input=“onmouseout=alert(‘XSS')” CODE BLUE 2016
- 99. MBSD Understanding HTML syntax. Understanding JavaScript syntax. Avoiding sanitization. CODE BLUE 2016 3 requirements for detecting RXSS
- 100. MBSD CODE BLUE 2016 How do you achieve them？
- 101. Our approach MBSD CODE BLUE 2016 Reverse engineering the human brain.
- 102. MBSD CODE BLUE 2016 Each thinking pattern implemented in machine learning. Our approach
- 103. MBSD Understanding HTML syntax. Understanding JavaScript syntax. Avoiding sanitization. CODE BLUE 2016 3 requirements for detecting RXSS
- 104. MBSD Understanding of HTML/JavaScript syntax by machines Using LSTM CODE BLUE 2016
- 105. What is LSTM（Long-Short Term Memory）？ It can learn chronological data. It can learn dependencies in short & long term data. MBSD examples) Machine translation. Text generation. (novel, lyrics, source code） Sound generation. (music, human voice） CODE BLUE 2016
- 106. What is LSTM（Long-Short Term Memory）？ It can learn chronological data. It can learn dependencies in short & long term data. MBSD examples) Machine translation. Text generation. (novel, Lyrics, source code） Sound generation. (music, human voice） CODE BLUE 2016
- 107. Example of the use of the text generation. MBSD CODE BLUE 2016 Generation of source code.（from Andrej Karpathy blog) static int indicate_policy(void) { int error; if (fd == MARN_EPT) { if (ss->segment < mem_total) unblock_set_blocked(); else ret = 1; goto bail; } segaddr = in_SB(in.addr); selector = seg / 16; ・・・ Training Data static void settings(struct *tty) { if (tty == tty) disable_single_st_p(dev); pci_disable_spool(port); return 0; } static void command(struct seq_file *m) { int column = 32 << (cmd[2] & 0x80); if (state) ・・・ Generated source code by LSTM It can generate a code from the starting point (seed).
- 108. Why LSTM？ MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <FORM> <textarea name="in" rows="5" cols="60">xxx</textarea> ・・・ http://xxx/textarea1?in=xxx CODE BLUE 2016 Input value is echoed in the TEXTAREA tag.
- 109. MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <FORM> <textarea name="in" rows="5" cols="60"> <script>alert('XSS');</script></textarea> ・・・ http://xxx/textarea1?in=<script>alert(‘XSS’);</script> JavaScript doesn’t run. ⇒ Simple script injection is not allowed. CODE BLUE 2016 Why LSTM？
- 110. MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <FORM> <textarea name="in" rows="5" cols="60">xxx</textarea> ・・・ http://xxx/textarea1?in=xxx “Is JavaScript inserted after closing the TEXTAREA tag ?” CODE BLUE 2016 Why LSTM？
- 111. MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <FORM> <textarea name="in" rows="5" cols="60"></textarea><script>alert('XSS');</script></t extarea> ・・・ http://xxx/textarea1?in=</textarea><script>alert(‘XSS’);</script> CODE BLUE 2016 Understands the context of HTML and inserts a script. ⇒ JavaScript run. Why LSTM？
- 112. MBSD CODE BLUE 2016 How can LSTM be learned ?
- 113. Learning data for LSTM (HTML) MBSD <abbr class="" data-utime="" title=""></abbr> <abbr class='' title=''></abbr> <abbr data-utime='' title=''></abbr> ・・・ <input name="" type="" value=""/> <input alt="" id="" onclick="" src="" type=""/> <input alt='' id="" src='' type=''/> <input alt='' name='' src='' type=''/> ・・・ <video autoplay="" loop="" muted=""></video> <video class="" height="" id="" width=""></video> <video src='' tabindex=''></video> <video src=''></video> 20,000 pages of HTML syntax. (about 12,000 types) CODE BLUE 2016
- 114. MBSD _satellite.pageBottom();'] (function(window) { var _gaq = _gaq || []; var methods = ['log', 'dir', 'trace']; if (typeof window.console === 'undefined') { window.console = {}; } for (var i in methods) { if (!(methods[i] in window.console)) { window.console[methods[i]] = function() {}; } } }(window)); CODE BLUE 2016 10,000 pages of JavaScript syntax. Learning data for LSTM (JavaScript)
- 115. Generated syntax by learned LSTM (one example) MBSD Seed Generated syntax <textarea cols="60">xxx </textarea> <!– mbsdtest xxx --> <input type="" value=“xxx "> var hoge = ['log', ‘xxx red’];¥r¥n /* mbsdtest xxx */ function(){ xxx }¥r¥n CODE BLUE 2016 It can generate a syntax from the seeds.
- 116. MBSD Understanding HTML syntax (✔). Understanding JavaScript syntax (✔). Avoiding sanitization. CODE BLUE 2016 3 requirements for detecting RXSS
- 117. Avoidance of sanitization by machines MBSD CODE BLUE 2016 Using Multilayer perceptron & Q-Learning.
- 118. MBSD ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning Model to avoid sanitization ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > Learns the pattern of avoiding sanitization while attempting to test. CODE BLUE 2016 observe state evaluate update weight
- 119. MBSD ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning Model to avoid sanitization. ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > CODE BLUE 2016 observe state evaluate update weight
- 120. Patterns of Output point MBSD Output point Example attribute value :「”」 <～value="xxx"> attribute value :「'」 <～value='xxx'> attribute value : noquote <～value=xxx> JavaScript <script>xxx</script> outside of HTML tags <～>xxx</～> CODE BLUE 2016
- 121. MBSD CODE BLUE 2016 Model to avoid sanitization ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight
- 122. Patterns of sanitization MBSD Sanitization Example 「“」: translate entity reference, exclude 「”」⇒「"」 「‘」: translate entity reference, exclude 「’」⇒「'」 「<」: translate entity reference, exclude 「<」⇒「<」 「>」: translate entity reference, exclude 「>」⇒「>」 「alert();」: exclude 「alert();」⇒「」 CODE BLUE 2016
- 123. MBSD CODE BLUE 2016 Model to avoid sanitization ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight
- 124. Test patterns（one example） MBSD Output point Test pattern attribute value :「”」 attribute value :「'」 attribute value : noquote outside of HTML tags “event handler "><sCriPt>xxx "><img src=xxx ‘event handler ‘><sCriPt>xxx <svg/onload=alert()> <sCriPt>xxx</sCriPt> JavaScript ";alert();// [CR][LF]alert(); ¥";alert();// CODE BLUE 2016
- 125. MBSD Inputs ”Output point" and "pattern of sanitization" to MLP. CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow
- 126. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow Selects any test pattern from the input of MLP.
- 127. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow Attempts to test using the selected test pattern of MLP.
- 128. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow Observe the result of the test.
- 129. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow Gives a reward depending on the result of the test.
- 130. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow Update the weight of MLP using backpropagation.
- 131. MBSD CODE BLUE 2016 ・ ・ ・ ・ ・ ・ attribute JS ・・・ Output point MLP Out of tag “sCriPt” Other tag URL encode Test pattern Event handler ・ ・ ・ Q-Learning ・ ・ ・ “ ⇒ " < ⇒ < ・・・ Sanitize > ⇒ > observe state evaluate update weight Learning flow. Learning is completed at approx. 100 attempts.
- 132. Problem MBSD CODE BLUE 2016 100 attempts ⇒ Inefficient
- 133. MBSD CODE BLUE 2016 Pre-training. Solution
- 134. MBSD WAVSEP CODE BLUE 2016 ReflectedXSS GET Input Vector Case06 output ：SRC attr value of IMG tag. sanitize ：< , > ⇒ < , > testing value："onmouseover=alert(3122);" Case10 output ：onClick value of SCRIPT tag. sanitize ：“ , < , > ⇒ " , < , > testing value：';alert(3122);// Case27 output ：single line comment of JavaScript sanitize ：comment out testing value：[CR][LF]alert(3122);// Web Apps for pre-training（one example）.
- 135. MBSD CODE BLUE 2016 Case06 Case08 Case10 Case27 SAIVS WAVSEP Achieve the best test string to avoid each sanitize pattern. Training SAIVS Attempts testing & learning ⇒ Each 100 times. ・・・
- 136. MBSD Understanding HTML syntax (✔). Understanding JavaScript syntax (✔). Avoiding sanitization (✔). CODE BLUE 2016 3 requirements for detecting RXSS
- 137. MBSD Test flow of SAIVS Primary inspection. Secondary inspection. CODE BLUE 2016
- 138. Sends normal request to examine the output point. MBSD Web Server Web Apps SAIVS Sends normal request CODE BLUE 2016 Primary inspection
- 139. Recognizes the output point of the input value. MBSD Web Server Web Apps SAIVS Sends normal request Analyzes response CODE BLUE 2016 <～value="xxx"> Primary inspection.
- 140. Extracts the seed based on the output point. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 <～value="xxx"> Primary inspection Sends normal request Analyzes response
- 141. Generates HTML / JavaScript syntax from the seed. (using learned LSTM) MBSD Web Server Web Apps SAIVS CODE BLUE 2016 <～value=“”> Primary inspection Sends normal request Analyzes response
- 142. Adds the script to the generated HTML syntax. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 <～value=“”><script>alert(3122);</script> Primary inspection Analyzes response Sends normal request
- 143. Sends test request to detect RXSS. MBSD Web Server Web Apps SAIVS Sends test request CODE BLUE 2016 <～value=“”><script>alert(3122);</script> Primary inspection
- 144. Determines the presence or absence of RXSS. RXSS detected ⇒ Test finishes. Not detected⇒ Secondary inspection. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 RXSS？ Analyzes response Sends test request Primary inspection
- 145. Recognizes the sanitizing pattern. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 <～value=“”><script>alert(3122);・・・ Secondary inspection Analyzes response Sends test request
- 146. Selects the test pattern to avoid sanitization. (Using learned MLP) MBSD Web Server Web Apps SAIVS CODE BLUE 2016 Event handler? Secondary inspection Analyzes response Sends test request
- 147. Sends the test request to avoid sanitization. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 Event handler? Secondary inspection Resends test request
- 148. MBSD Web Server Web Apps SAIVS CODE BLUE 2016 Secondary inspection Analyzes response Sends test request RXSS？ Determines presence or absence of RXSS. RXSS detected ⇒ Test finishes. Not detected ⇒ Repeat secondary inspection.
- 149. Demonstration of detecting RXSS MBSD Target：webseclab CODE BLUE 2016 Case Overview /reflect/full1 output : BODY tag sanitize : none /reflect/textarea1 output : TEXTAREA tag sanitize : none /reflect/onmouseover output : attribute value of INPUT tag sanitize : exclude “</script>” /reflect/js4_dq output : SCRIPT tag sanitize : none
- 150. Demonstration of detecting RXSS MBSD Target：webseclab CODE BLUE 2016 Case Overview /reflect/full1 output : BODY tag sanitize : none /reflect/textarea1 output : TEXTAREA tag sanitize : none /reflect/onmouseover output : attribute value of INPUT tag sanitize : exclude “</script>” /reflect/js4_dq output : SCRIPT tag sanitize : none
- 151. MBSD <!doctype html><html><head><title>Full Javascript Injection (full.1)</title></head><body> Hello!<BR> The value of cgi parameter "in" is:saivs12345 </body></html> http://xxx/reflect/full1?in=saivs12345 output ：BODY tag sanitize : None Case1：Sending normal request CODE BLUE 2016
- 152. MBSD <!doctype html><html><head><title>Full Javascript Injection (full.1)</title></head><body> Hello!<BR> The value of cgi parameter "in" is: lasther=''></form>D0i7Q"VW53N'nT7t0<script>alert(3122) ;kc5i3</script>ueFj8 </body></html> http://xxx/reflect/full1?in=lasther=''%3E%3C/form%3ED0i7Q%22VW 53N'nT7t0%3Cscript%3Ealert(3122);kc5i3%3C/script%3EueFj8 attempted times：1 Case1：Sending test request CODE BLUE 2016
- 153. MBSD Case1：Demo movie CODE BLUE 2016 https://www.youtube.com/watch?v=3RkhSED5DQU
- 154. Demonstration of detecting RXSS MBSD Target：webseclab CODE BLUE 2016 Case Overview /reflect/full1 output : BODY tag sanitize : none /reflect/textarea1 output : TEXTAREA tag sanitize : none /reflect/onmouseover output : attribute value of INPUT tag sanitize : exclude “</script>” /reflect/js4_dq output : SCRIPT tag sanitize : none
- 155. MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <p> <FORM> <textarea name="in" rows="5" cols="60">saivs12345 </textarea> <p> http://xxx/reflect/textarea1?in=saivs12345 CODE BLUE 2016 Case2：Sending normal request output ：TEXTAREA tag sanitize : None
- 156. MBSD <!doctype html><html><head><title>Reflected XSS in textarea (textarea1)</title></head><body> <H2>Textarea injection test</H2> <p> <FORM> <textarea name="in" rows="5" cols="60"></textarea>7Q7p N"MBPcc'PA6tz<script>alert(3122);WKr8J</script>fowCP</ textarea> <p> http://xxx/reflect/textarea1?in=%3C/textarea%3E7Q7pN%22MBPcc' PA6tz%3Cscript%3Ealert(3122);WKr8J%3C/script%3EfowCP CODE BLUE 2016 Case2：Sending test request attempted times：1
- 157. MBSD Case2：Demo movie CODE BLUE 2016 https://www.youtube.com/watch?v=6UHbMGdqr_0
- 158. Demonstration of detecting RXSS MBSD Target：webseclab CODE BLUE 2016 Case Overview /reflect/full1 output : BODY tag sanitize : none /reflect/textarea1 output : TEXTAREA tag sanitize : none /reflect/onmouseover output : attribute value of INPUT tag sanitize : exclude “</script>” /reflect/js4_dq output : SCRIPT tag sanitize : none
- 159. MBSD <!doctype html><html> <head><title>Reflected XSS - attribute injection in ta gs (dq.2)</title></head><body> <H2>Update Your Preferences</H2><p> <FORM> Homepage: <input value=""><script>alert()" name="in" s ize="40"><BR> http://xxx/xss/reflect/onmouseover?in=”><script>alert()</script> CODE BLUE 2016 Case 3：Sending normal request output ：INPUT tag sanitize : exclude “</script>”
- 160. MBSD <!doctype html><html> <head><title>Reflected XSS - attribute injection in tags (dq.2)</title></head><body> <H2>Update Your Preferences</H2><p> <FORM> Homepage: <input value=""> <option s onmouseover=alert (3122);//" name="in" size="40"><BR> http://xxx/xss/reflect/onmouseover?in=%22%3E%3C/option%3E%3 Coption%20s%20onmouseover=alert(3122);// CODE BLUE 2016 Case 3：Sending test request. attempted times：3
- 161. MBSD Case 3：Demo movie CODE BLUE 2016 https://www.youtube.com/watch?v=-r3C1moUVqU
- 162. Demonstration of detecting RXSS MBSD Target：webseclab CODE BLUE 2016 Case Overview /reflect/full1 output : BODY tag sanitize : none /reflect/textarea1 output : TEXTAREA tag sanitize : none /reflect/onmouseover output : attribute value of INPUT tag sanitize : exclude “</script>” /reflect/js4_dq output : SCRIPT tag sanitize : none
- 163. MBSD <!doctype html><html><head><title>JavaScript and double-quote injection in JS block (js.4)</title> </head><body> <script language="javascript"> var f = { date: "", week: "1", bad: "saivs12345", phase: "2", http://xxx/xss/reflect/js4_dq?in=saivs12345 CODE BLUE 2016 Case 4：Sending normal request output ：SCRIPT tag sanitize : None
- 164. MBSD <!doctype html><html><head><title>JavaScript and double-quote injection in JS block (js.4)</title> </head><body> <script language="javascript"> var f = { date: "", week: "1", bad: "6", skuI;alert(3122);//1VU7k", phase: "2", http://xxx/xss/reflect/js4_dq?in=6%22,%0A%20%20%20%20%20%20 %20%20%20%20%20%20skuI;alert(3122);//1VU7k CODE BLUE 2016 Case 4：Sending test request attempted times：1
- 165. MBSD Case 4：Demo movie CODE BLUE 2016 https://www.youtube.com/watch?v=Pf2lSB25C3M
- 166. Abilities of SAIVS MBSD Crawls web apps. (✔) Detects vulnerabilities. (✔) CODE BLUE 2016
- 167. MBSD CODE BLUE 2016 “Detect RXSS while crawling web apps.” Realized fully automatically. Abilities of SAIVS
- 168. MBSD Target：OWASP Broken Web Apps Google Gruyere CODE BLUE 2016 Demonstration of SAIVS
- 169. MBSD CODE BLUE 2016 Top Sign up Login New snippet Sign up complete １．Create an account in “Sign up”. ２．Log in. ３．Register Snippet. ４．Update Profile. Profile New snippet register Profile update Demonstration of SAIVS vulnerability
- 170. MBSD CODE BLUE 2016 Top Sign up Login New snippet Sign up complete Profile New snippet register Profile update １．Create an account in “Sign up”. ２．Log in. ３．Register Snippet. ４．Update Profile. Demonstration of SAIVS
- 171. MBSD CODE BLUE 2016 Top Sign up Login New snippet Sign up complete Profile New snippet register Profile update Demonstration of SAIVS １．Create an account in “Sign up”. ２．Log in. ３．Register Snippet. ４．Update Profile.
- 172. MBSD CODE BLUE 2016 Top Sign up Login New snippet Sign up complete Profile New snippet register Profile update Demonstration of SAIVS １．Create an account in “Sign up”. ２．Log in. ３．Register Snippet. ４．Update Profile.
- 173. MBSD CODE BLUE 2016 Top Sign up Login Sign up complete Profile Profile update New snippet New snippet register Demonstration of SAIVS １．Create an account in “Sign up”. ２．Log in. ３．Register Snippet. ４．Update Profile.
- 174. MBSD CODE BLUE 2016 Function name Overview New snippet register output : BODY tag sanitize : exclude SCRIPT tag Profile update output : A tag sanitize : < , > ⇒ < , > Demonstration of SAIVS
- 175. MBSD CODE BLUE 2016 Demonstration of SAIVS https://www.youtube.com/watch?v=N5d9oM0NcM0
- 176. MBSD Strengthening the page crawling capability. Responding to complex web apps. Responding to CAPTCHA. CODE BLUE 2016 Future prospects Strengthening the detecting vulnerabilities capability. Responding to complex RXSS patterns. Responding to other vulnerabilities.
- 177. • Download “.PDF” version of this document: ≫ http://www.mbsd.jp MBSD