Introduction

The whole purpose of this draft is to propose an assessment model for each threat class.
We will follow the OWASP top ten list.

Threats

Threats class: A1 injection

Each web applications has a finite set of input parameters being in forms, URL parameters, … called .
All input parameters are typed: being chosen in a finite set of type called

$ \mathcal{T} =

\left \{
\begin{array}{r c l}
t_{1} & = & integer \\
t_{2} & = & string \\
\vdots & & \vdots \\
t_{k} & = & type_{k}
\end{array}
\right . \quad k \in \mathbb{N}. $

We will consider the cartesian product in the future.

Question: Does it matter if it's a form input or an URL parameter or … ?

Let's describe the processus to assess A1 threats on a web application.

Phase one: determine

It will be depend on the approach chosen.
If it's a black box testing, it will be based on URLs scanning, page content scanning, ….
If it's static code analysis, it will be based on detection of code pattern.
Each input type shall be inferred.

We might also consider the location of each input.
Question: When the location information of inputs will be useful ?
(If it's useful, it will bring in a new finite set which will contain where is the location of which might not be unique !)

Phase two: determine data pattern to inject:

It will of course not be a blind and random data building like fuzzing, data should be intelligently crafted depending on the inputs type and probably location. The building of the set of data patterns is challenging.
For now, will only know it is finite.

One way to build it is to start with an alphabet and some syntactic rules to combine each elements if the alphabet.

* Phase three: inject sensibly the data patterns in all inputs