Back to results
US 10,380,006 B2Granted
Application testing for security vulnerabilities
AssigneeInternational Business Machines Corporation
InventorsRoee Hay, Omer Tripp
Life of this patent
Estimating the term…
Abstract
In an approach for testing an application for a security vulnerability, a processor inserts an instrumentation hook in the application to be tested, wherein the instrumentation hook is executed prior to a sink operation. A processor transmits a probe input value to the application to be tested. A processor detects a modification to the probe input value at the instrumentation hook by comparing the probe input value at the instrumentation hook to a signature value and detecting that the probe input value matches the signature value. A processor removes the sink operation from testing for the security vulnerability.
Claims14
A computer system for testing an application for a security vulnerability, the computer system comprising:
- one or more computer processors, one or more readable storage media, and program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
- program instructions to insert an instrumentation hook in an application to be tested, wherein the instrumentation hook includes an instruction that indicates values of variables in the application being tested, wherein the instrumentation hook is executed prior to a sink operation, wherein the sink operation includes a security sensitive operation that includes a file system operation, and wherein the instrumentation hook is inserted in the application by editing binary code;
- program instructions to transmit a probe input value to the application to be tested, wherein the probe input value includes an element that is shared by a security vulnerability, wherein the probe input value includes data indicating that the probe input value originated from a testing technique, wherein the probe input value includes scripting language characters and structured query language characters, and wherein the probe input value is a predetermined value reserved for testing the sink operation;
- program instructions to detect a modification to the probe input value at the instrumentation hook by comparing the probe input value at the instrumentation hook to a signature value and detecting that the probe input value matches the signature value, wherein the signature value includes a data value that is to match the probe input value after the probe input value is sanitized, wherein the signature value includes a structured query language operation that is modified to not be executable, and wherein sanitizing is to validate data by removing malicious content;
- and
- program instructions to remove the sink operation from testing for the security vulnerability and to remove tests corresponding to structured query language security vulnerabilities.
3 more elements
A method for testing an application for a security vulnerability, the method comprising:
- inserting, by one or more processors, an instrumentation hook in an application to be tested, wherein the instrumentation hook includes an instruction that indicates values of variables in the application being tested, wherein the instrumentation hook is executed prior to a sink operation, wherein the sink operation includes a security sensitive operation that includes a file system operation, and wherein the instrumentation hook is inserted in the application by editing binary code;
- transmitting, by one or more processors, a probe input value to the application to be tested, wherein the probe input value includes an element that is shared by a security vulnerability, wherein the probe input value includes data indicating that the probe input value originated from a testing technique, wherein the probe input value includes scripting language characters and structured query language characters, and wherein the probe input value is a predetermined value reserved for testing the sink operation;
- detecting, by one or more processors, a modification to the probe input value at the instrumentation hook by comparing the probe input value at the instrumentation hook to a signature value and detecting that the probe input value matches the signature value, wherein the signature value includes a data value that is to match the probe input value after the probe input value is sanitized, wherein the signature value includes a structured query language operation that is modified to not be executable, and wherein sanitizing is to validate data by removing malicious content;
- and
- removing, by one or more processors, the sink operation from testing for the security vulnerability and to remove tests corresponding to structured query language security vulnerabilities.
2 more elements
A computer program product for testing an application for a security vulnerability, the computer program product comprising:
- one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
- program instructions to insert an instrumentation hook in an application to be tested, wherein the instrumentation hook includes an instruction that indicates values of variables in the application being tested, wherein the instrumentation hook is executed prior to a sink operation, wherein the sink operation includes a security sensitive operation that includes a file system operation, and wherein the instrumentation hook is inserted in the application by editing binary code;
- program instructions to transmit a probe input value to the application to be tested, wherein the probe input value includes an element that is shared by a security vulnerability, wherein the probe input value includes data indicating that the probe input value originated from a testing technique, wherein the probe input value includes scripting language characters and structured query language characters, and wherein the probe input value is a predetermined value reserved for testing the sink operation;
- program instructions to detect a modification to the probe input value at the instrumentation hook by comparing the probe input value at the instrumentation hook to a signature value and detecting that the probe input value matches the signature value, wherein the signature value includes a data value that is to match the probe input value after the probe input value is sanitized, wherein the signature value includes a structured query language operation that is modified to not be executable, and wherein sanitizing is to validate data by removing malicious content;
- and
- program instructions to remove the sink operation from testing for the security vulnerability and to remove tests corresponding to structured query language security vulnerabilities.
3 more elements
Dependencies are inferred from the claim text.