Website security analysis: variation of detection methods and decisions

Websites and web applications continue to evolve in terms of how they are developed and used. Different types of components in those websites and applications communicate with users through inputs taken from the users and outputs displayed to those users. Users, intentionally or unintentionally, may provide improper inputs. We proposed a model to investigate the behavior of websites when dealing with invalid inputs. From security perspectives, invalid inputs should be detected and rejected as early as possible. An invalid input is considered as a form of successful attack if it is processed by the website code or back-end database. Based on this assumption, we proposed a list of indicators that test invalid inputs are processed. A tool is developed to implement this model. We tested the model through evaluating several websites selected randomly. Our tool has no special credentials or access to any of the tested websites. We found many SQL injection vulnerabilities based on our proposed model. Upon the manual investigation of the web pages that showed such vulnerabilities, we found few instances of false positives. We believe that this can provide a systematic and automated approach to test websites for vulnerabilities related to improper input validation.