Here I am again asking for some informations about attack trees usage in web application analysis.

For my master thesis I decided to study the usage of this formalism in order to reppresent attacks to a web applications. I need a lot of use cases from which to start learning common attacks which can help building a proper tree.

From where can I start?

I've already read the OWASP top 10 vulnerabilities an I'm familiar with XSS, SQLi, ecc. however I've no clue on how to combine them together in order to perform the steps needed to attack a system. I'm looking for some examples and maybe to some famous attacks from which I can understand which steps are performed and how commons vulnerabilities can being combined together. Any help is really appreciated.

1 Answer 1


As you are familiar with OWASP, you might have a look at the WebGoat project - "a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons". There are other tools and resources out there, such as DETERLab for learning about common attacks.

These should provide you with plenty of examples. The formalisms themselves are not hard to apply - I suggest using pen and paper or a whiteboard to start having a go. In my experience the best thing about attack trees is that they make you think harder about the problem, rather than being important artefacts in and of themselves.

  • Yes I already had a look to the WebGoat project, however, if I'm not wrong, it shows you single attacks and explains how to exploit them. Which is useful, yes, but starting just from single attacks and without experience is very difficult for me to combine all those exploit together in order to perform complex attacks which can be represented with attack trees. This is why I'm looking for informations \ examples about web app attacks. I'm not looking to an already built tree. As you said, the formalisms are not hard to apply. I'm looking to, lets say, "descriptions" about complex attacks.
    – Federico
    May 25, 2012 at 8:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .