Description: Vulnerability and Attack Injection was first proposed in [VAI5], where the methodology was presented and applied to SQL injection vulnerabilities in web applications. The method consists in injecting realistic vulnerabilities in a component exposed to the Internet and subsequently exploiting such vulnerabilities to launch attacks automatically in order to evaluate existing security mechanisms in the entire system [VAI1, VAI2]. That is, a component is specifically injected with realistic vulnerabilities to make it possible to evaluate security attributes and mechanisms in the rest of the system, through the attacks that become possible through the injected vulnerabilities. The component where the vulnerabilities are injected (target component) is not part of the target system under evaluation. The injected vulnerabilities are considered realistic because they are derived from the extensive field study on real application vulnerabilities presented in [VAI3], and are injected according to a set of representative restrictions and rules defined in [VAI4]. The whole approach is considered realistic since any application or component  exposed to the Internet) may have vulnerabilities, and even so the possible exploitation of such vulnerabilities to attack the system must be detected and handled adequately.   

The automated attack of an application is a multi-stage procedure that includes: preparation stage, vulnerability injection stage, attack load generation stage, and attack stage. 

The technique can be used for many purposes, including training and evaluating security teams, estimating the total number of vulnerabilities, and evaluating security mechanisms (e.g., IDS, firewalls, etc.) [VAI5].