Back to results
US 11,750,640 B2Granted
Systems, methods, and computer-readable media for executing a web application scan service
AssigneeDeepfactor, Inc.
InventorsScott Oberg, Rizwan Merchant, Michael Kevin Larkin
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer-readable media for performing web app scans of an application are provided. Telemetry events derived from the web app scan are intercepted by a runtime that has been instrumented in conjunction with the application. The telemetry events are collected and transmitted to a platform that analyzes the collected events and presents information based on the analysis.
Claims17
A method for executing a web application scan of an application, comprising:
- executing a telemetry interception and analysis platform (TIAP) runtime in connection with the application, wherein the application is being executed by one or more processors operating behind a firewall that prevents the TIAP runtime from receiving direct communications from a TIAP portal being executed by one or more processors operating in front of the firewall, and wherein executing the TIAP runtime comprises:
- intercepting a web service event being executed by the application, wherein the web service event comprises registration information, a universal resource identifier (URI), and authorization credentials;
- and
- transmitting the web service event to the TIAP portal;
- and
- executing the TIAP portal comprises:
- creating a web application scan in response to receiving the web service event by the TIAP portal;
- configuring the TIAP portal to be receptive to receive events obtained by the TIAP portal by accepting a new inbound connection from the TIAP runtime;
- configuring the web application scan with the registration information, the URI, and the authorization credentials;
- performing the web application scan after the web application scan has been configured and after the TIAP portal has been configured to receive events obtained by the TIAP runtime during execution of the web application scan;
- receiving events obtained by the TIAP runtime during execution of the web application scan;
- generating a scan report based on the received events obtained by the TIAP runtime during execution of the web application scan;
- ceasing the web application scan;
- and
- terminating the new inbound connection from the TIAP runtime.
12 more elements
A method for executing a web application scan of an application, comprising:
- initiating a web application scan of the application comprising:
- accepting, via a proxy service, a new inbound connection from a telemetry interception and analysis platform (TIAP) runtime that is operating in conjunction with the application, wherein the new inbound connection transitions to a bi-directional proxy connection after the new inbound connection is verified;
- accessing a web scanner and an authorization proxy to implement a plurality of scan request instances, wherein each scan request instance of the plurality of scan request instances comprises a universal resource identifier (URI) and an optional authorization credential;
- passing each scan request instance of the plurality of scan request instances to the proxy service via the bi-directional proxy connection, wherein the proxy service enables each scan request instance of the plurality of scan request instances to be applied to the application, and wherein the application provides a scan response when the scan request instance of the plurality of scan request instances is processed;
- receiving the scan response via the bi-directional proxy connection;
- and
- generating, via the web scanner, a scan report based on an analysis of scan responses.
4 more elements
A method for executing a web application scan of an application, comprising:
- executing a telemetry interception and analysis platform (TIAP) runtime that is operating in conjunction with the application, said executing further comprising:
- receiving, via a proxy, a web application scan request to scan the application;
- intercepting a scan response during execution of the web application scan request;
- establishing a transmit only connection with a TIAP portal;
- transmitting the intercepted scan response to the TIAP portal;
- discovering a universal resource indicator (URI) being accessed by the application;
- obtaining an authorization token related to the URI;
- and
- transmitting the URI and the authorization token to the TIAP portal.
6 more elements
Dependencies are inferred from the claim text.