一句话：提出基于语法的测试工具 XAVIER，自动生成 XML 注入负载以检测 Web 服务漏洞。
Web 服务在银行、购物等在线交互中至关重要，也因此成为攻击目标。攻击者通过注入恶意代码操纵数据，可能危害系统。现有防御方法包括攻击语法、符号执行或机器学习来检测漏洞，或手动嵌入恶意载荷，但这些方法可能遗漏被测服务的部分。XAVIER 提出一种基于语法的测试方法，旨在自动生成 XML 注入攻击负载，以更全面地测试 Web 服务，发现潜在漏洞。摘要未提供具体评估结果，但该方法有望提高注入攻击检测的覆盖率和效率。
Web services are essential for online interactions, supporting critical tasks like banking and shopping, but their importance also makes them prime targets for attacks. Attackers try to manipulate data injecting malicious code, potentially compromising systems. Current approaches to preventing such attacks use techniques like attack grammars, symbolic execution, or machine learning to detect vulnerabilities or manually embed malicious payloads, that can miss parts of the service under test.
DOI 原文 ·
@inproceedings{paperbot9592,
title = {XAVIER: Grammar-Based Testing for XML Injection Attacks},
author = {Paul Kalbitzer and Jose Antonio Zamudio Amaya and Andreas Zeller},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3731736}
}