Application test using attack suggestions
AssigneeEntit Software LLC
InventorsSasi Siddharth Muthurajan, Matias Madou, Prajakta Jagdale, Jeremy Brooks
Life of this patent
Estimating the term…
Abstract
Example embodiments disclosed herein relate to a security test. A crawl of an application under test (AUT) is performed to determine an attack surface using crawl sessions. One or more parameters of the attack surface are probed during the respective crawl sessions. A trace is requested from an observer for the probe of the one or more parameters. Attack suggestions are received from the observer based on the trace of the one or more parameters.
Claims18
A system comprising:
- a server hosting:
- an application under test (AUT);
- and
- an observer to monitor instructions executed by the AUT, wherein the observer is a runtime agent operating in an execution environment of the AUT;
- a computing device communicatively coupled to the AUT and the observer through a common communication channel, the computing device to:
- perform a crawl of the AUT to determine an attack surface using crawl sessions;
- probe one or more parameters of the attack surface during the respective crawl sessions;
- request a trace from the observer for the probe of the one or more parameters;
- receive attack suggestions from the observer based on the trace of the one or more parameters, the attack suggestions received from the observer including a list of security vulnerabilities of the AUT;
- receive deduplication information from the observer, wherein the deduplication information includes a line of code;
- add the deduplication information to a hash;
- and
- use the hash to determine whether to perform at least one attack on the attack surface.
A non-transitory machine-readable storage medium storing instructions that, upon execution by at least one processor of a device, cause the device to:
- perform a crawl of an application under test (AUT) executed on a second device, the crawl to determine an attack surface using a plurality of crawl sessions;
- probe one or more parameters of the attack surface;
- request a trace from an observer for the respective probes of the one or more parameters, wherein the observer is a runtime agent executed on the second device;
- receive attack suggestions from the observer based on the trace of the one or more parameters, the received attack suggestions including a list of security vulnerabilities of the AUT;
- receive deduplication information from the observer, wherein the deduplication information includes a line of code;
- add the deduplication information to a hash;
- and
- use the hash to determine whether to attack the attack surface using the received attack suggestions.
A non-transitory machine-readable storage medium storing instructions that, upon execution by at least one processor of a device, cause the device to:
- monitor, using an observer, execution of an application under test (AUT), wherein the observer is a runtime agent operating in an execution environment of the AUT;
- monitor, using the observer, a crawl session of the AUT performed by a security test engine on a second device;
- perform a path trace, using the observer, of a probe by the security test engine on the AUT during the crawl session using one or more parameters;
- determine, using the observer, attack suggestions based on the path trace of the probe;
- send the attack suggestions from the observer to the security test engine, the attack suggestions received including a list of security vulnerabilities of the AUT;
- determine, using the observer, deduplication information based on the underlying code accessed;
- and
- send the deduplication information from the observer to the security test engine, wherein the deduplication information includes a line of code, wherein the security test engine is to add the deduplication information to a hash and use the hash to determine whether to perform at least one attack using the attack suggestions.
Dependencies are inferred from the claim text.