THAPS: Automated Vulnerability Scanning of PHP Applications

Torben Jensen; Heine Pedersen; Mads Chr. Olesen; Rene Rydhof Hansen

doi:10.1007/978-3-642-34210-3_3

THAPS: Automated Vulnerability Scanning of PHP Applications

Torben Jensen, Heine Pedersen, Mads Chr. Olesen, Rene Rydhof Hansen

Department of Computer Science

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

16 Citations (Scopus)

Abstract

In this paper we describe the THAPS vulnerability scanner for PHP web applications. THAPS is based on symbolic execution of PHP with specialised support for scanning extensions and plug-ins of larger application frameworks. We further show how THAPS can integrate the results of dynamic analyses, generated by a customised web crawler, into the static analysis. This enables analysis of often used advanced dynamic features such as dynamic code load and reflection. To the best of our knowledge, THAPS is the first tool to apply this approach and the first tool with specific support for analysis of plug-ins.
In order to verify our approach, we have scanned 375 WordPress plug-ins and a commercial (monolithic) web application, resulting in 68 and 28 confirmed vulnerabilities respectively.

Original language	English
Title of host publication	Proceedings of the 17th Nordic Conference on Secure IT-Systems (NordSec 2012)
Volume	7617
Publisher	Springer
Publication date	2012
Pages	31-46
ISBN (Print)	978-3-642-34209-7
ISBN (Electronic)	978-3-642-34210-3
DOIs	https://doi.org/10.1007/978-3-642-34210-3_3
Publication status	Published - 2012
Event	17th Nordic Conference, NordSec 2012: Secure IT Systems - Karslkrona, Sweden Duration: 31 Oct 2012 → 2 Nov 2012 Conference number: 17

Conference

Conference	17th Nordic Conference, NordSec 2012
Number	17
Country/Territory	Sweden
City	Karslkrona
Period	31/10/2012 → 02/11/2012

Series	Lecture Notes in Computer Science
Volume	7617
ISSN	0302-9743

Access to Document

10.1007/978-3-642-34210-3_3

AUB Link

Search for the material in Aalborg University Library's search engine

Cite this

@inproceedings{40bfa06eb70d46e68284f949f775251e,

title = "THAPS: Automated Vulnerability Scanning of PHP Applications",

abstract = "In this paper we describe the THAPS vulnerability scanner for PHP web applications. THAPS is based on symbolic execution of PHP with specialised support for scanning extensions and plug-ins of larger application frameworks. We further show how THAPS can integrate the results of dynamic analyses, generated by a customised web crawler, into the static analysis. This enables analysis of often used advanced dynamic features such as dynamic code load and reflection. To the best of our knowledge, THAPS is the first tool to apply this approach and the first tool with specific support for analysis of plug-ins.In order to verify our approach, we have scanned 375 WordPress plug-ins and a commercial (monolithic) web application, resulting in 68 and 28 confirmed vulnerabilities respectively.",

author = "Torben Jensen and Heine Pedersen and Olesen, {Mads Chr.} and Hansen, {Rene Rydhof}",

year = "2012",

doi = "10.1007/978-3-642-34210-3_3",

language = "English",

isbn = "978-3-642-34209-7",

volume = "7617",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "31--46",

booktitle = "Proceedings of the 17th Nordic Conference on Secure IT-Systems (NordSec 2012)",

address = "Germany",

note = "17th Nordic Conference, NordSec 2012 ; Conference date: 31-10-2012 Through 02-11-2012",

}

Jensen, T, Pedersen, H, Olesen, MC & Hansen, RR 2012, THAPS: Automated Vulnerability Scanning of PHP Applications. in Proceedings of the 17th Nordic Conference on Secure IT-Systems (NordSec 2012). vol. 7617, Springer, Lecture Notes in Computer Science, vol. 7617, pp. 31-46, 17th Nordic Conference, NordSec 2012, Karslkrona, Sweden, 31/10/2012. https://doi.org/10.1007/978-3-642-34210-3_3

THAPS: Automated Vulnerability Scanning of PHP Applications. / Jensen, Torben; Pedersen, Heine; Olesen, Mads Chr. et al.
Proceedings of the 17th Nordic Conference on Secure IT-Systems (NordSec 2012). Vol. 7617 Springer, 2012. p. 31-46 (Lecture Notes in Computer Science, Vol. 7617).

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

TY - GEN

T1 - THAPS

T2 - 17th Nordic Conference, NordSec 2012

AU - Jensen, Torben

AU - Pedersen, Heine

AU - Olesen, Mads Chr.

AU - Hansen, Rene Rydhof

N1 - Conference code: 17

PY - 2012

Y1 - 2012

N2 - In this paper we describe the THAPS vulnerability scanner for PHP web applications. THAPS is based on symbolic execution of PHP with specialised support for scanning extensions and plug-ins of larger application frameworks. We further show how THAPS can integrate the results of dynamic analyses, generated by a customised web crawler, into the static analysis. This enables analysis of often used advanced dynamic features such as dynamic code load and reflection. To the best of our knowledge, THAPS is the first tool to apply this approach and the first tool with specific support for analysis of plug-ins.In order to verify our approach, we have scanned 375 WordPress plug-ins and a commercial (monolithic) web application, resulting in 68 and 28 confirmed vulnerabilities respectively.

AB - In this paper we describe the THAPS vulnerability scanner for PHP web applications. THAPS is based on symbolic execution of PHP with specialised support for scanning extensions and plug-ins of larger application frameworks. We further show how THAPS can integrate the results of dynamic analyses, generated by a customised web crawler, into the static analysis. This enables analysis of often used advanced dynamic features such as dynamic code load and reflection. To the best of our knowledge, THAPS is the first tool to apply this approach and the first tool with specific support for analysis of plug-ins.In order to verify our approach, we have scanned 375 WordPress plug-ins and a commercial (monolithic) web application, resulting in 68 and 28 confirmed vulnerabilities respectively.

UR - http://www.scopus.com/inward/record.url?scp=84868368035&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-34210-3_3

DO - 10.1007/978-3-642-34210-3_3

M3 - Article in proceeding

SN - 978-3-642-34209-7

VL - 7617

T3 - Lecture Notes in Computer Science

SP - 31

EP - 46

BT - Proceedings of the 17th Nordic Conference on Secure IT-Systems (NordSec 2012)

PB - Springer

Y2 - 31 October 2012 through 2 November 2012

ER -

THAPS: Automated Vulnerability Scanning of PHP Applications

Abstract

Conference

Access to Document

AUB Link

Other files and links

Cite this