Back to results
US 10,423,793 B2Granted
Install runtime agent for security test
AssigneeEntit Software LLC
InventorsMatias Madou, Ronald J. Sechman, Sam Ng Ming Sum
Life of this patent
Estimating the term…
Abstract
Example embodiments disclosed herein relate to an approach for installing a runtime agent during a security test. A security test is initiated or performed on an application under test executing on a server. An application vulnerability associated with the application under test is determined. The application vulnerability is exploited to install the runtime agent on the server. The security test is continued using the runtime agent to receive additional information about the application under test.
Claims14
A non-transitory machine-readable storage medium storing instructions that, if executed by at least one processor of a device, cause the device to:
- initiate a security test on an application under test (AUT) to execute at a server;
- determine an application vulnerability associated with the AUT;
- determine a first framework used at the server and associated with the AUT;
- select a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
- exploit the application vulnerability to install the first runtime agent on the server, the exploiting comprising providing a script to the AUT via the application vulnerability to cause download of the first runtime agent, and unpacking the first runtime agent for the installation at the server;
- restart the AUT prior to a continuation of the security test and after the installation of the first runtime agent;
- and
- continue the security test using the first runtime agent to receive additional information about the AUT.
5 more elements
A method performed by a system comprising a hardware processor, comprising:
- initiating a security test on an application under test (AUT) executing at a server;
- determining an application vulnerability associated with the AUT during the security test;
- determining a first framework associated with the AUT and used at the server;
- selecting a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
- exploiting the application vulnerability to provide a script on the server, wherein the script causes the server to download the first runtime agent, unpack the first runtime agent, and install the first runtime agent;
- restarting the AUT prior to a continuation of the security test and after the installation of the first runtime agent;
- and
- continuing the security test using the first runtime agent executing at the server to receive additional information about the AUT.
5 more elements
A computing system comprising:
- a processor;
- and
- a non-transitory storage medium storing instructions executable on the processor to:
- perform a security test on an application under test (AUT) to execute on a server;
- determine that an application vulnerability associated with the AUT identified by the security test is capable of an injection exploit;
- determine a first framework used at the server and associated with the AUT;
- select a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
- exploit the application vulnerability to download a script to the server to cause the server to download the first runtime agent, unpack the first runtime agent, and install the first runtime agent;
- restart the AUT prior to a continuation of the security test and after the installation of the first runtime agent;
- and
- continue the security test using the first runtime agent executing at the server to receive additional information about the AUT including requested trace information about what is executing at the AUT.
8 more elements
Dependencies are inferred from the claim text.