Today's computer networks are prone to sophisticated multi-step, multi-host attacks. Common approaches of identifying vulnerabilities and analyzing the security of such networks with naive methods such as counting the number of vulnerabilities, or examining the vulnerabilities independently produces incomprehensive and limited security assessment results. On the other hand, attack graphs generated from the identified vulnerabilities at a network illustrate security risks via attack paths that are not apparent with the results of the primitive approaches. One common technique of generating attack graphs requires well established definitions and data of prerequisites and postconditions relating to the known vulnerabilities. A number of works suggest prerequisite and postcondition categorization schemes for software vulnerabilities. However, generating them in an automated way is an open issue. In this paper, we first define a model that evolves over the previous works to depict the requirements of exploiting vulnerabilities for generating attack graphs. Then we describe and compare the results of two different novel approaches (rule-based and machine learning-employed) that we propose for generating attacker privilege fields as prerequisites and postconditions from the National Vulnerability Database (NVD) in an automated way. We observe that prerequisite and postcondition privileges can be generated with overall accuracy rates of 88,8 % and 95,7 % with rule-based and machine learning-employed (Multilayer Perceptron) models respectively.

Enterprise password policies require the use of complex passwords that contain lowercase and uppercase letters, numbers and symbols. Considering this common requirement, end-users tend to create complex (!) passwords containing certain patterns which make such passwords guessable and therefore insecure. Replacement pattern is one of these pattern-types and substitutes a number or symbol for a certain letter. As an example, the letter “o” is replaced with 0 (zero) and password becomes password. Even though passw0rd contains a number and is assumed a strong password, its replacement pattern can be misused to guess it successfully and crack it easily. In our research, we performed an automated analysis of ca. 14.5 million real-life leaked passwords to identify all possible replacement patterns. We identified 43 different replacement-types at the end of the analysis. These identified replacement patterns can be utilized to improve dictionary-attacks, especially for forensic investigations. In this paper, we explain our methodology to identify replacement patterns, all possible replacement types with their examples, Top 5 replacement patterns with examples as well as the elimination of false-positive cases in detail.

Web application vulnerability scanners (WAVS) include crawler components to extract all accessible links of tested web pages in order to identify attack entry points and parameters. After extracting links, they perform different types of attacks over each extracted link and try to find out existing vulnerabilities in the tested web application for reporting. A WAVS tool that has a low-quality crawler component would generate false-negative results, since failing to discover existing links would inhibit detection of possible vulnerabilities exposed through these links. Therefore, the coverage quality of its crawler plays a very important role in the success of a WAVS tool. In this paper, we propose a novel method for analyzing and comparing coverage qualities of WAVS crawlers. We developed WIVET (Web Input Vector Extractor Teaser) as a benchmarking tool for analyzing crawler components of WAVS. WIVET evaluates WAVS crawlers based on their extraction capability of 56 target links that are generated statically or dynamically by WIVET's 21 test cases. We explain WIVET's architecture, all WIVET test cases and target links with code examples, integration of WIVET into WAVS development environments and WAVS benchmarking results in detail.

It is a common mistake of application developers to store user passwords within databases as plaintext or only as their unsalted hash values. Many real-life successful hacking attempts that enabled attackers to get unauthorized access to sensitive database entries including user passwords have been experienced in the past. Seizing password hashes, attackers perform brute-force, dictionary, or rainbow-table attacks to reveal plaintext passwords from their hashes. Dictionary attacks are very fast for cracking hashes but their success rate is not sufficient. In this paper, we propose a novel method for improving dictionary attacks. Our method exploits several password patterns that are commonly preferred by users when trying to choose a complex and strong password. In order to analyze and show success rates of our developed method, we performed cracking tests on real-life leaked password hashes using both a traditional dictionary and our pattern-based dictionary. We observed that our pattern-based method is superior for cracking password hashes.

FriendFinder as a location-based service collects location data from mobile users and distributes a particular user's location upon request. Privacy of users data especially location data needs to be guaranteed according to both user and legacy perspectives. W3C's privacy recommendation for internet platform P3P/Appel only considers the privacy relations between the users and the service providers. In this paper, we explain the shortcomings of P3P/Appel for providing privacy in FriendFinder and propose enhancements to the P3P/Appel policy languages.