Challenges in the Automated Testing of

《Challenges in the Automated Testing of》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、ChallengesintheAutomatedTestingofModernWebApplicationsNathanHamielGregoryFleischerSethLawJustinEnglerAbstractTheattacksurfaceofmodernapplicationsisamulti-facetedandfragmentedenvironment.Currentautomatedsecuritytoolshavebeenfoundlackinginmanyareaswhenlookingatthefullscopeofanapplicationassessment.

2、Mostsecurityprofessionalsfilltheseholesusingavarietyoftoolstocoverasmuchoftheattacksurfaceaspossible,includingcustomscripts,manualtesting,andsemi-automatedtesting.Thisapproachputsextremepressureonsecurityprofessionals,asthetestingeffortmaybedifficulttoduplicatebetweendifferentassessments.Thisalso

3、forcesthetestertorecreatethetestprocessforeachassessmenttoensurecompletecoveragewhenassessinganapplication’ssecurityposture.Addressingthesedeficienciesrequiresimprovedtoolsthatevolvepurelymanualtestingintosemi-automatedtestingaswellasprovidingsupportforthecontinuedneedofcustomscriptcreation.Overv

4、iewItcanbescarytothinkabouthowlittleofthemodernattacksurfacemanytoolscover.Thereisnoonebesttoolforthejob,andontopofthat,sometoolsdon’tdoagreatjobatanything.Ofteninthehandsofgeneralusersthecapabilitiesandlimitationsarenoteventhoughtofduringtesting.Point,click,done.Theattacksurfaceofmodernwebenviro

5、nmentsaswellastheirprotectionmechanismshavebecomemorecomplicatedandyetmanytoolshavenotadapted.Thereiscertainlynoshortageofvulnerabilitiesinmodernwebenvironments,butweshouldbelookingbeyondlowhangingfruitatthispoint.Inbetweenfullyautomatedscannersandmanualtestingliesasweetspotfortheidentificationof

6、vulnerabilities.Someofthejuiciestpiecesofinformationarenotfoundbyvulnerabilityscannersbutarefoundbyhumanscreatingcustomtests.Thisiswhysemi-automatedtestingspaceissoimportant.Allofthiscomplicatedblendingofprotectionmechanisms,services,andRIAtechnologiesmeansthatmovingintotheareaofsemi-automatedtes

7、tingcanbefraughtwithfailure.Wedetailhowthesefailurescanbeavoidedaswellasprovideatoolthatsolvessomeoftheseproblemsaswellasprovidesanalysisforyourowntoolsandscripts.ProblemsAutomatedTestingversusModernApplicationsAutomat