# US 10,503,910 B2 · Security testing framework including virtualized server-side platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,503,910 B2
- Document ID: US10503910B2
- Status: Granted
- Kind: B2
- Application number: 15/615,603
- Filed: 2017-06-06
- Published: 2018-12-06
- Granted: 2019-12-10
- Earliest claimed: 2017-06-06
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Martin Johns
- Web page: https://patentgrep.com/patent/US10503910B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A web application security testing framework includes a HTTP browser engine replaying recorded sessions to identify candidate traces indicative of attack. A mutation engine changes values in the attack candidate traces to generate additional traces posed against a virtualized server-side platform. The virtualized server-side platform creates snapshots of application state for testing, avoiding permanent damage to application persistence. The virtualized server-side platform includes persistence monitoring sensors (e.g., at connectors to the database or file system) for detecting vulnerability classes including Cross-Site Request Forgery (CSRF) and SQL injection attacks. For remote command execution attack detection, a server-side vulnerability validation interface records strings passed to code generating application program interfaces (APIs). For possible Cross-Site Scripting (XSS) attacks, the mutation engine may detect HTTP responses for examination of generated web code, and the HTTP browser may be extended to include a vulnerability validation API that is automatically called by successfully injected attack payloads.

## Claims

### Claim 1

A computer-implemented method comprising:
receiving, by a server hosting a web application, a trace comprising a first value provided by a browser component;
storing the trace in an in-memory database;
creating, by the server, a snapshot of a virtualized state of the web application at a time of receiving the trace;
generating a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sensing, by the in-memory database engine at the server, a change in persistence resulting from the mutant trace; and
in response to the sensing, the server communicating the mutant trace to a test engine for identification of a security vulnerability.

### Claim 2 (depends on 1)

A method as in claim 1 wherein the sensing occurs at a file system.

### Claim 3 (depends on 1)

A method as in claim 1 wherein:
the sensing occurs at the in-memory database; and
the security vulnerability comprises a cross-site request forgery (CSRF) vulnerability.

### Claim 4 (depends on 1)

A method as in claim 1 wherein:
the sensing occurs at the in-memory database; and
the security vulnerability comprises a SQL injection vulnerability.

### Claim 5 (depends on 1)

A method as in claim 1 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API).

### Claim 6 (depends on 5)

A method as in claim 5 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.

### Claim 7 (depends on 1)

A method as in claim 1 wherein:
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.

### Claim 8 (depends on 7)

A method as in claim 7 further comprising:
generating, by the server, a response to the mutant trace; and
communicating, by the server, the response to the in-memory database engine.

### Claim 9 (depends on 7)

A method as in claim 7 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API) residing on the browser component.

### Claim 10 (depends on 1)

A method as in claim 1 wherein the in-memory database engine is further configured to perform a selection function.

### Claim 11 (depends on 1)

A method as in claim 1 wherein the in-memory database engine is further configured to perform a filtering function.

### Claim 12

A non-transitory computer readable storage medium embodying a computer program for performing a method, said method comprising:
receiving, by a server hosting a web application, a trace comprising a first value provided by a browser component;
storing the trace in an in-memory database;
creating, by the server, a snapshot of a virtualized state of the web application at a time of receiving the trace;
generating a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sensing, by the in-memory database at the server, a change in persistence in a database resulting from the mutant trace; and
communicating, by the server, in response to the sensing, the mutant trace to a test engine for identification of a security vulnerability.

### Claim 13 (depends on 12)

A non-transitory computer readable storage medium as in claim 12 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API).

### Claim 14 (depends on 13)

A non-transitory computer readable storage medium as in claim 13 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.

### Claim 15 (depends on 12)

A non-transitory computer readable storage medium as in claim 12 wherein:
the issuing comprises issuing the call to the API residing on the browser component; and
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.

### Claim 16 (depends on 12)

A non-transitory computer readable storage medium as in claim 12 wherein the security vulnerability comprises a cross-site request forgery (CSRF) or a SQL injection.

### Claim 17

A computer system comprising:
one or more processors;
a software program, executable on said computer system, the software program configured to cause a server hosting a web application to:
receive a trace comprising a first value provided by a browser component;
store the trace in an in-memory database;
create a snapshot of a virtualized state of the web application at a time of receiving the trace;
generate a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sense by the in-memory database a change in persistence resulting from the mutant trace, the change in persistence comprising injecting a payload of the mutant trace, the payload issuing a call to an application program interface (API); and
communicate, in response to the sensing, the mutant trace to a test engine for identification of a security vulnerability.

### Claim 18 (depends on 17)

A computer system as in claim 17 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.

### Claim 19 (depends on 17)

A computer system as in claim 17 wherein:
the issuing comprises issuing the call to the API residing on a browser component; and
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.

### Claim 20 (depends on 17)

A computer system as in claim 17 wherein the software program is configured to further cause the server to:
generate a response to the trace; and
communicate the response to the in-memory database engine.