TestREx：可重复利用漏洞的框架
TestREx: a Framework for Repeatable Exploits
摘要：
Web应用程序是许多众所周知的攻击的目标，也是发现安全漏洞的肥沃土壤。然而，攻击的成功取决于应用程序源代码中的漏洞以及应用程序部署和运行的环境。由于执行环境复杂（应用服务器、数据库和其他支持应用程序），我们需要一个可靠的框架来测试已知的漏洞是否可以在不同的设置中重现，更好地了解它们的影响，并促进发现新的漏洞。在本文中，我们提出了TestREx -一个框架，允许高度自动化，易于重复的利用测试在各种情况下，使安全测试人员可以快速，有效地执行大规模的实验与漏洞利用。它支持打包和运行应用程序及其环境，注入漏洞，监控其成功，并生成安全报告。我们还提供了一个语料库的示例应用程序，从相关的作品或我们实现。
英文摘要：
Web applications are the target of many well known exploits and also a fertile ground for the discovery of security vulnerabilities. Yet, the success of an exploit depends both on the vulnerability in the application source code and the environment in which the application is deployed and run. As execution environments are complex (application servers, databases and other supporting applications), we need to have a reliable framework to test whether known exploits can be reproduced in different settings, better understand their effects, and facilitate the discovery of new vulnerabilities. In this paper, we present TestREx - a framework that allows for highly automated, easily repeatable exploit testing in a variety of contexts, so that a security tester may quickly and efficiently perform large-scale experiments with vulnerability exploits. It supports packing and running applications with their environments, injecting exploits, monitoring their success, and generating security reports. We also provide a corpus of example applications, taken from related works or implemented by us.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
