# US 11,909,764 B1 · Man-in-the-middle interceptor for application security testing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,764 B1 - Document ID: US11909764B1 - Status: Granted - Kind: B1 - Application number: 17/365,171 - Filed: 2021-07-01 - Granted: 2024-02-20 - Earliest claimed: 2021-07-01 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Barry Curran - Web page: https://patentgrep.com/patent/US11909764B1 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments include implementing an interceptor for application security testing. The interceptor may intercept traffic, including one or more traffic items, between a scan engine and a target application. The traffic item(s) may include a request directed to the target application from a scan engine implementing application security testing or a response from the target application responsive to request(s) from the scan engine. The interceptor may determine that a particular traffic item satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application. The particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both. Responsive to determining that the particular traffic item satisfies the particular traffic trigger, the interceptor may perform the particular traffic action. ## Claims ### Claim 1 A system, comprising: one or more hardware processors with associated memory that implement an interceptor for application security testing, wherein the one or more hardware processors are configured to: intercept traffic, including one or more traffic items, between a scan engine and a target application, wherein the one or more traffic items comprise at least one of: a request from a scan engine implementing application security testing, wherein the request is directed to the target application; or a response from the target application via a target application server, wherein the response is responsive to one or more requests from the scan engine implementing the application security testing; determine that a particular traffic item of the one or more traffic items satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application, wherein the particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both; and responsive to determining that the particular traffic item satisfies the particular traffic trigger, perform the particular traffic action. ### Claim 2 (depends on 1) The system of claim 1, wherein performing the particular traffic action includes performing one or more blocking actions on the particular traffic item that originates from the scan engine. ### Claim 3 (depends on 1) The system of claim 1, wherein performing the particular traffic action includes performing one or more modifying actions on the particular traffic item that originates from the scan engine. ### Claim 4 (depends on 1) The system of claim 1, wherein performing the particular traffic action includes modifying a rate at which requests are communicated to the target application from the scan engine. ### Claim 5 (depends on 1) The system of claim 1, wherein performing the particular traffic action includes generating an interceptor response to include information instructing the scan engine to utilize a new token for subsequent requests. ### Claim 6 (depends on 1) The system of claim 1, wherein performing the particular traffic action includes generating an interceptor response to include information instructing the scan engine to exclude one or more scan requests based on an error state of the target application. ### Claim 7 (depends on 1) The system of claim 1, wherein the particular traffic trigger includes the request having a value that matches a particular request value or that is within a particular range of request values. ### Claim 8 (depends on 1) The system of claim 1, wherein the particular traffic trigger includes the response having a value that matches a particular response value or that is within a particular range of response values. ### Claim 9 (depends on 1) The system of claim 1, wherein the particular traffic trigger includes a dynamic traffic trigger, and wherein performing the particular traffic action includes performing one or more dynamic traffic actions responsive to determining that one or more responses from the target application server satisfy the dynamic traffic trigger. ### Claim 10 A method comprising: implementing, using one or more hardware processors, an interceptor for application security testing, wherein the implementing comprises: intercepting traffic, including one or more traffic items, between a scan engine and a target application, wherein the one or more traffic items comprise at least one of: a request from a scan engine implementing application security testing, wherein the request is directed to the target application; or a response from the target application via a target application server, wherein the response is responsive to one or more requests from the scan engine implementing the application security testing; determining that a particular traffic item of the one or more traffic items satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application, wherein the particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both; and responsive to determining that the particular traffic item satisfies the particular traffic trigger, performing the particular traffic action. ### Claim 11 (depends on 10) The method of claim 10, wherein performing the particular traffic action includes performing one or more blocking actions on the particular traffic item that originates from the scan engine, the one or more blocking actions including at least one of: preventing a request from the scan engine from reaching the target application server upon determining that the request has characteristics associated with damage to the target application or that the request has characteristics associated with false positive security scan results; or generating an interceptor request that prevents particular information in the request from reaching the target application server. ### Claim 12 (depends on 10) The method of claim 10, wherein performing the particular traffic action includes performing one or more modifying actions on the particular traffic item that originates from the scan engine, the one or more modifying actions including at least one of: modifying a request from the scan engine to replace a random value with an application-specific value associated with the target application; modifying header information in a request from the scan engine to avoid web application firewall (WAF) filters; modifying a request from the scan engine to include a header identifier value that identifies particular features of the request; or modifying a request from the scan engine to redirect traffic bound for the target application server to another address. ### Claim 13 (depends on 10) The method of claim 10, wherein performing the particular traffic action includes modifying a rate at which requests are communicated to the target application from the scan engine. ### Claim 14 (depends on 13) The method of claim 13, wherein modifying the rate includes increasing or decreasing the rate at which requests are communicated to the target application from the scan engine. ### Claim 15 One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that includes an interceptor for application security testing and cause the system to: intercept traffic, including one or more traffic items, between a scan engine and a target application, wherein the one or more traffic items comprise at least one of: a request from a scan engine implementing application security testing, wherein the request is directed to the target application; or a response from the target application via a target application server, wherein the response is responsive to one or more requests from the scan engine implementing the application security testing; determine that a particular traffic item of the one or more traffic items satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application, wherein the particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both; and responsive to determining that the particular traffic item satisfies the particular traffic trigger, perform the particular traffic action. ### Claim 16 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein the program instructions when executed on or across the one or more processors cause the system to generate an interceptor configuration graphical user interface (GUI) configured to receive information associated with the particular traffic trigger, the particular traffic action, or both. ### Claim 17 (depends on 16) The one or more non-transitory computer-accessible storage media of claim 16, wherein the interceptor configuration GUI is configured to receive information that identifies a particular request value or a particular range of request values to be matched in order to satisfy the particular traffic trigger. ### Claim 18 (depends on 16) The one or more non-transitory computer-accessible storage media of claim 16, wherein the interceptor configuration GUI is configured to receive information that identifies a particular response value or a particular range of response values to be matched in order to satisfy the particular traffic trigger. ### Claim 19 (depends on 16) The one or more non-transitory computer-accessible storage media of claim 16, wherein the interceptor configuration GUI is configured to receive information that identifies dynamic traffic criteria to be matched in order to satisfy the particular traffic trigger. ### Claim 20 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein performing the particular traffic action includes at least one of: performing one or more blocking actions on the particular traffic item that originates from the scan engine; performing one or more modifying actions on the particular traffic item that originates from the scan engine; modifying a rate at which requests are communicated to the target application from the scan engine; generating an interceptor response to include information instructing the scan engine to utilize a new token for subsequent requests; generating an interceptor response to include information instructing the scan engine to exclude one or more scan requests based on an error state of the target application; or performing one or more dynamic traffic actions responsive to determining that one or more responses from the target application server satisfy the particular traffic trigger that corresponds to a dynamic traffic trigger.