Automatic Generation of Tests to Exploit XML Injection Vulnerabilities in Web Applications

Sadeeq Jan, Annibale Panichella, Andrea Arcuri, Lionel Briand

Research output: Contribution to journalArticleScientificpeer-review

18 Citations (Scopus)


Modern enterprise systems can be composed of many web services (e.g., SOAP and RESTful). Users of such systems might not have direct access to those services, and rather interact with them through a single entry point which provides a GUI (e.g., a web page or a mobile app). Although the interactions with such entry point might be secure, a hacker could trick such systems to send malicious inputs to those internal web services. A typical example is XML injection targeting SOAP communications. Previous work has shown that it is possible to automatically generate such kind of attacks using search-based techniques. In this paper, we improve upon previous results by providing more efficient techniques to generate such attacks. In particular, we investigate four different algorithms and two different fitness functions. A large empirical study, involving also two industrial systems, shows that our technique is effective at automatically generating XML injection attacks.
Original languageEnglish
Article number8125155
Pages (from-to)335-362
Number of pages27
JournalIEEE Transactions on Software Engineering
Issue number4
Publication statusPublished - 2019
Externally publishedYes


  • XML
  • Simple object access protocol
  • Testing
  • Service-oriented architecture


Dive into the research topics of 'Automatic Generation of Tests to Exploit XML Injection Vulnerabilities in Web Applications'. Together they form a unique fingerprint.

Cite this