SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications

—Testing database-backed web applications is challenging because their behaviors (e.g., control flow) are highly dependent on data returned from SQL queries. Without a database containing sufficient and realistic data, it is challenging to reach potentially vulnerable code snippets, limiting various existing dynamic-based security testing approaches. However, obtaining such a database for testing is difficult in practice as it often contains sensitive information. Sharing it can lead to data leaks and privacy issues. In this paper, we present S YNTH DB, a program analysis-based database generation technique for database-backed PHP applications. S YNTH DB leverages a concolic execution engine to identify interactions between PHP codebase and the SQL queries. It then collects and solves various constraints to reconstruct a database that can enable exploring uncovered program paths without violating database integrity. Our evaluation results show that the database generated by S YNTH DB outperforms state-of-the-arts database generation techniques in terms of code and query coverage in 17 real-world PHP applications. Specifically, S YNTH DB generated databases achieve 62.9% code and 77.1% query coverages, which are 14.0% and 24.2% more in code and query coverages than the state-of-the-art techniques. Furthermore, our security analysis results show that S YNTH DB effectively aids existing security testing tools: Burp Suite, Wfuzz, and webFuzz. Burp Suite aided by S YNTH DB detects 76.8% of vulnerabilities while other existing techniques cover 55.7% or fewer. Impressively, with S YNTH DB, Burp Suite discovers 33 previously unknown