Raising the Bar for Automated Attacks against Web Applications using Software Diversity

Context A large array of free penetration testing tools is nowadays available for automated vulnerability analysis in web applications [1], many of them for free. These tools are employed both by white-hat (ethical) and black-hat hackers (attackers). In some cases, attackers and ethical testers must develop custom scripts to effectively find vulnerabilities for particular web applications. After a malicious attacker finds a vulnerability, s/he crafts a code snippet or script which is able to automatically exploit that vulnerability. Generally, the more “reusable ” the attack script is, the more profitable it is for the attacker. For instance, if the script executed in the browser of any other end-user of the same web application is able to provide an advantage to the attacker (e.g. XSS, CSRF etc.) then the attacker can re-use the same exploit several times. Similarly, if the same vulnerability discovery technique works for a wide range of applications, an attacker can automate large-scale scanning until he finds a vulnerable target. Goa