Method and system of runtime analysis

A system for detecting at least one security vulnerability at runtime, comprising:

• a repository storing test instructions;
• a network interface for sending at least one message to an application according to said test instructions at runtime thereof, said application being a web application or a client server application;
• a code interface for adding a test code to a code segment of said application according to said test instructions and receiving test information pertaining to at least one reaction of said application to said at least one message during an execution of said test code;
• and
• a testing unit for detecting at least one security vulnerability according to an analysis of said at least one reaction.

A method for detecting at least one security vulnerability, comprising:

• a) providing a plurality of testing session records each defining a test session for a security vulnerability assessment and a model defining a plurality of connections among said testing session records;
• b) testing an application according to one of said plurality of testing session records, said application being a web application or a client server application;
• c) performing an analysis of a reaction of said application to said test session during the execution of said application;
• d) selecting an additional of said plurality of testing session records according to said model in the light of said analysis;
• and
• e) repeating said b) and c) where said testing being held according to said additional testing session.

A method for detecting at least one security vulnerability, comprising:

• a) providing test instructions for a multitier application having a plurality of application components in a plurality of network nodes, each said application component being of a different tier;
• b) adding at least one debug operator to a code segment of each said application component according to said test instructions;
• c) invoking a data communication event between said application component components;
• d) identifying a first message sent from a first tier application component to a second tier application component and a second message received by said second tier application component;
• e) identifying a code path among said plurality of application components by a comparison between first identification information of said first message and second identification information of said second message;
• f) detecting a presence or an absence of at least one security vulnerability according to said code path.

A method for detecting at least one security vulnerability, comprising:

• providing test instructions for an application being a web application or a client server application;
• injecting at least one instruction to a code of said application which is executed on a program code execution environment according to said test instructions at runtime thereof;
• monitoring information pertaining to at least one reaction of said at least one instruction during an execution of said code;
• performing an analysis of said at least one reaction;
• and
• detecting a presence or an absence of at least one security vulnerability according to said analysis.