URL

Change Log

When	What
September 10th, 2015	Donated by Adam Kiezun

Reference

Studies who have been using the data (in any form) are required to include the following reference:

@inproceedings{Kieyzun:2009:ACS:1555001.1555036,
author = {Kieyzun, Adam and Guo, Philip J. and Jayaraman, Karthick and Ernst, Michael D.},
title = {Automatic Creation of SQL Injection and Cross-site Scripting Attacks},
booktitle = {Proceedings of the 31st International Conference on Software Engineering},
series = {ICSE '09},
year = {2009},
isbn = {978-1-4244-3453-4},
pages = {199--209},
numpages = {11},
url = {http://dx.doi.org/10.1109/ICSE.2009.5070521},
doi = {10.1109/ICSE.2009.5070521},
acmid = {1555036},
publisher = {IEEE Computer Society},
address = {Washington, DC, USA},
}

About the Data

Overview of Data

Ardilla is a tool capable of analyzing PHP applications for potential SQL injection and cross-site scripting vulnerabilities. It does so by automatically creating attack vectors when evaluating the code. Ardilla was used to analyze five PHP applications using different attack modes. The resulting number of discovered vulnerabilities and false positives are reported.

Attribute Information

Program: PHP application being analyzed Mode: Type of attack being created by Ardilla Lenient: Only applies to XSS attacks. An Ardilla run mode that detects output differences in script-inducing elements or HTML elements. Strict: Only applies to XSS attachs. An Ardilla run mode that only detects output differences in script-inducing elements. Vulnerabilities: Number of verified vulnerabilities False Positives: Reported vulnerabilities that were determined to be a false positive after manual inspection

Paper Abstract

We present a technique for finding security vulnerabilities in Web applications. SQL Injection (SQLI) and cross-site scripting (XSS) attacks are widespread forms of attack in which the attacker crafts the input to the application to access or modify user data and execute malicious code. In the most serious attacks (called second-order, or persistent, XSS), an attacker can corrupt a database so as to cause subsequent users to execute malicious code.

Data Categories

Ardilla