|
Our proposed method uses WebAPI requests and their responses for vulnerability assessment.
The basic policy is to collect the information necessary for vulnerability assessment of the target WebAPI from the WebAPI reference, and conduct the vulnerability assessment process.
The basic flow of the vulnerability assessment is conducted in three steps.
First, obtain information from the WebAPI reference.
Next, in order to obtain information from the WebAPI response, we will check the validity of the reference and obtain the response.
Send a request using the reference information obtained in the previous step, and get a response.
Finally, the vulnerability assessment process.
In this presentation, we will explain the process based on the information obtained in the previous steps to conduct the No.1 and No.5 vulnerability assessment. |