<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-00985670</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-01T20:29:18+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">An automated black box approach for web vulnerability identification and attack scenario generation</title>
            <author role="aut">
              <persName>
                <forename type="first">Rim</forename>
                <surname>Akrout</surname>
              </persName>
              <idno type="halauthorid">662438-0</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Eric</forename>
                <surname>Alata</surname>
              </persName>
              <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">eric-alata</idno>
              <idno type="idhal" notation="numeric">171876</idno>
              <idno type="halauthorid" notation="string">32730-171876</idno>
              <idno type="IDREF">https://www.idref.fr/124302505</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mohamed</forename>
                <surname>Kaâniche</surname>
              </persName>
              <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">mohamed-kaaniche</idno>
              <idno type="idhal" notation="numeric">13942</idno>
              <idno type="halauthorid" notation="string">23325-13942</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
              <idno type="IDREF">https://www.idref.fr/079087221</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Vincent</forename>
                <surname>Nicomette</surname>
              </persName>
              <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">vincent-nicomette</idno>
              <idno type="idhal" notation="numeric">9967</idno>
              <idno type="halauthorid" notation="string">8756-9967</idno>
              <idno type="IDREF">https://www.idref.fr/078717639</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Eric</forename>
                <surname>Alata</surname>
              </persName>
              <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
              <email type="domain">laas.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2014-04-30 11:24:11</date>
              <date type="whenWritten">2013</date>
              <date type="whenModified">2025-10-22 18:04:08</date>
              <date type="whenReleased">2014-04-30 11:25:31</date>
              <date type="whenProduced">2014-01</date>
              <date type="whenEndEmbargoed">2014-04-30</date>
              <ref type="file" target="https://hal.science/hal-00985670v1/document">
                <date notBefore="2014-04-30"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-00985670v1/file/Jbsc.pdf" id="file-985670-1146694">
                <date notBefore="2014-04-30"/>
              </ref>
              <ref type="externalLink" target="https://journal-bcs.springeropen.com/track/pdf/10.1186/1678-4804-20-4"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="194346">
                <persName>
                  <forename>Eric</forename>
                  <surname>Alata</surname>
                </persName>
                <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
                <email type="domain">laas.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-00985670</idno>
            <idno type="halUri">https://hal.science/hal-00985670</idno>
            <idno type="halBibtex">akrout:hal-00985670</idno>
            <idno type="halRefHtml">&lt;i&gt;Journal of the Brazilian Computer Society&lt;/i&gt;, 2014, 20 (1), pp.1--16. &lt;a target="_blank" href="https://dx.doi.org/10.1186/1678-4804-20-4"&gt;&amp;#x27E8;10.1186/1678-4804-20-4&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">Journal of the Brazilian Computer Society, 2014, 20 (1), pp.1--16. &amp;#x27E8;10.1186/1678-4804-20-4&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-985670-1146694"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-TLSE2">Université Toulouse 2</idno>
            <idno type="stamp" n="UNIV-TLSE3">Université de Toulouse</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INSA-TOULOUSE">Institut National des Sciences Appliquées de Toulouse</idno>
            <idno type="stamp" n="LAAS">Laboratoire d'analyse et d'architecture des systèmes</idno>
            <idno type="stamp" n="LAAS-TSF" corresp="LAAS-RISC">Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</idno>
            <idno type="stamp" n="UT1-CAPITOLE">Université Toulouse 1 Capitole</idno>
            <idno type="stamp" n="LAAS-INFORMATIQUE-CRITIQUE" corresp="LAAS">LAAS-Informatique Critique</idno>
            <idno type="stamp" n="INSA-GROUPE">Groupe INSA</idno>
            <idno type="stamp" n="INSA-TOULOUSE-GEI" corresp="INSA-TOULOUSE">Génie Electrique et Informatique - INSA Toulouse</idno>
            <idno type="stamp" n="LAAS-RISC" corresp="LAAS">Réseaux, Informatique, Systèmes de Confiance</idno>
            <idno type="stamp" n="TOULOUSE-INP">Toulouse - INP</idno>
            <idno type="stamp" n="UNIV-UT3">Université Toulouse 3</idno>
            <idno type="stamp" n="UT3-INP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="UT3-TOULOUSEINP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="TEST7-HALCNRS">test 7 du portail hal cnrs</idno>
            <idno type="stamp" n="LAAS-TRUST" corresp="LAAS-RISC">Trustworthy systems: foundations and practices</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">An automated black box approach for web vulnerability identification and attack scenario generation</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Rim</forename>
                    <surname>Akrout</surname>
                  </persName>
                  <idno type="halauthorid">662438-0</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Eric</forename>
                    <surname>Alata</surname>
                  </persName>
                  <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">eric-alata</idno>
                  <idno type="idhal" notation="numeric">171876</idno>
                  <idno type="halauthorid" notation="string">32730-171876</idno>
                  <idno type="IDREF">https://www.idref.fr/124302505</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohamed</forename>
                    <surname>Kaâniche</surname>
                  </persName>
                  <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">mohamed-kaaniche</idno>
                  <idno type="idhal" notation="numeric">13942</idno>
                  <idno type="halauthorid" notation="string">23325-13942</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
                  <idno type="IDREF">https://www.idref.fr/079087221</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Vincent</forename>
                    <surname>Nicomette</surname>
                  </persName>
                  <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">vincent-nicomette</idno>
                  <idno type="idhal" notation="numeric">9967</idno>
                  <idno type="halauthorid" notation="string">8756-9967</idno>
                  <idno type="IDREF">https://www.idref.fr/078717639</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
              </analytic>
              <monogr>
                <idno type="localRef">Rapport LAAS n° 14077</idno>
                <idno type="halJournalId" status="VALID">1570</idno>
                <idno type="issn">0104-6500</idno>
                <title level="j">Journal of the Brazilian Computer Society</title>
                <imprint>
                  <publisher>Springer Verlag</publisher>
                  <biblScope unit="volume">20</biblScope>
                  <biblScope unit="issue">1</biblScope>
                  <biblScope unit="pp">1--16</biblScope>
                  <date type="datePub">2014-01</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1186/1678-4804-20-4</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Web application</term>
                <term xml:lang="en">Vulnerabilities</term>
                <term xml:lang="en">Attacks</term>
                <term xml:lang="en">Evaluation</term>
                <term xml:lang="en">Web scanner</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halDomain" n="info.info-wb">Computer Science [cs]/Web</classCode>
              <classCode scheme="halTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halOldTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halTreeTypology" n="ART">Journal articles</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Web applications have become increasingly vulnerable and exposed to malicious attacks that could affect essential properties of information systems such as confidentiality, integrity, or availability. To cope with these threats, it is necessary to develop efficient security protection mechanisms and assessment techniques (firewall, intrusion detection system, Web scanner, etc.). This paper presents a new methodology, based on Web page clustering techniques, that is aimed at identifying the vulnerabilities of a Web application following a black box analysis of the target application. Each identified vulnerability is actually exploited to ensure that it does not correspond to a false positive. The proposed approach can also highlight different potential attack scenarios including the exploitation of several successive vulnerabilities, taking into account explicitly the dependencies between these vulnerabilities. We have focused in particular on code injection vulnerabilities, such as SQL injections. The proposed methodology led to the development of a new Web vulnerability scanner that has been validated experimentally on several examples of vulnerable applications.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-389097" status="OLD">
          <orgName>Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</orgName>
          <orgName type="acronym">LAAS-TSF</orgName>
          <date type="end">2024-08-31</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.laas.fr/public/fr/tsf</ref>
          </desc>
          <listRelation>
            <relation active="#struct-459" type="direct"/>
            <relation active="#struct-81148" type="indirect"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="indirect"/>
            <relation active="#struct-217752" type="indirect"/>
            <relation name="UPR8001" active="#struct-441569" type="indirect"/>
            <relation active="#struct-448187" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-459" status="OLD">
          <idno type="IdRef">199278792</idno>
          <idno type="ISNI">0000 0001 2188 216X </idno>
          <idno type="RNSR">199517454Y</idno>
          <idno type="ROR">https://ror.org/03vcm6439</idno>
          <orgName>Laboratoire d'analyse et d'architecture des systèmes</orgName>
          <orgName type="acronym">LAAS</orgName>
          <date type="start">1968-01-01</date>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>7 Av du colonel Roche 31077 TOULOUSE CEDEX 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.laas.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-81148" type="direct"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="direct"/>
            <relation active="#struct-217752" type="direct"/>
            <relation name="UPR8001" active="#struct-441569" type="direct"/>
            <relation active="#struct-448187" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-81148" status="VALID">
          <idno type="IdRef">026404354</idno>
          <idno type="ISNI">0000000121902837</idno>
          <idno type="ROR">https://ror.org/0443n9e75</idno>
          <orgName>Université Toulouse Capitole</orgName>
          <orgName type="acronym">UT Capitole</orgName>
          <date type="start">1970-01-01</date>
          <desc>
            <address>
              <addrLine>2 rue du Doyen-Gabriel-Marty - 31042 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ut-capitole.fr/</ref>
          </desc>
          <listRelation>
            <relation name="443875" active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-443875" status="VALID">
          <idno type="ROR">https://ror.org/017tgbk05</idno>
          <orgName>Communauté d'universités et établissements de Toulouse</orgName>
          <orgName type="acronym">Comue de Toulouse</orgName>
          <desc>
            <address>
              <addrLine>41 Allée Jules Guesde, 31000 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-toulouse.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116255" status="VALID">
          <idno type="IdRef">026388766</idno>
          <idno type="ISNI">0000 0001 2286 8343</idno>
          <idno type="ROR">https://ror.org/01h8pf755</idno>
          <idno type="Wikidata">Q858979</idno>
          <orgName>Institut National des Sciences Appliquées - Toulouse</orgName>
          <orgName type="acronym">INSA Toulouse</orgName>
          <date type="start">1963-10-21</date>
          <desc>
            <address>
              <addrLine>135, avenue de Rangueil - 31077 Toulouse cedex 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-toulouse.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116256" status="VALID">
          <idno type="IdRef">026403994</idno>
          <idno type="ROR">https://ror.org/04ezk3x31</idno>
          <orgName>Université Toulouse - Jean Jaurès</orgName>
          <orgName type="acronym">UT2J</orgName>
          <date type="start">1971-01-01</date>
          <desc>
            <address>
              <addrLine>5 allées Antonio Machado - 31058 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse2.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-217752" status="OLD">
          <idno type="IdRef">026404672</idno>
          <idno type="ISNI">0000000121617331</idno>
          <idno type="ROR">https://ror.org/02v6kpv12</idno>
          <idno type="Wikidata">Q1273188</idno>
          <orgName>Université Toulouse III - Paul Sabatier</orgName>
          <orgName type="acronym">UT3</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>118 route de Narbonne - 31062 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse3.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-448187" status="VALID">
          <idno type="IdRef">026388820</idno>
          <idno type="ISNI">0000000121766169</idno>
          <idno type="ROR">https://ror.org/033p9g875</idno>
          <orgName>Institut National Polytechnique (Toulouse)</orgName>
          <orgName type="acronym">Toulouse INP</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.inp-toulouse.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>