Method of Correlating Static and Dynamic Application Security Testing Results for a Web and Mobile Application

A method of correlating a static application security testing (SAST) finding and a dynamic application security testing (DAST) finding for an application having a file system with code files containing at least one artifact, which application has an application framework that may be classified as having either a direct framework or an indirect framework, the method comprising:

• creating an Endpoint Database using the code files, the Endpoint Database comprising at least one Endpoint Object, each Endpoint Object having at least one of a path property, one or more parameter properties, an HTTPMethod property, a filename property, a line number property, and a mobile entry point;
• identifying the application framework using characteristics unique or common to the application framework;
• classifying the application framework as direct or indirect;
• if the application framework is direct:
• extracting each artifact on the file system identified by the SAST result and the DAST result as an extracted artifact;
• extracting any nested artifacts from each extracted artifact and placing the nested artifacts into an artifact nesting database;
• parsing all HTTP parameters from the extracted artifacts to generate parameter data;
• parsing all mobile entry points from the extracted artifacts to generate mobile entry data;
• parsing the HTTP method to generate HTTPMethod data;
• extracting all path information from each extracted artifact;
• determining the Endpoint URLs;
• populating an Endpoint Object of the Endpoint Database with the extracted HTTPMethod data, parameter data, Endpoint URLs, and mobile entry data and;
• if the application is indirect:
• determining the path and filename of each artifact based on the application framework;
• identifying entity information and controller information;
• retrieving the HTTPMethods and parameters by parsing the control artifacts and entity artifacts;
• extracting entity information into entity data;
• generating at least one Endpoint Object in the Endpoint Database using the configuration, the controller information, and the entity information.
• searching the Endpoint Database for an Endpoint Object associated with SAST or DAST results based on search parameters passed by an Endpoint Query, wherein the search parameters include a SAST finding or a DAST finding;
• matching a SAST finding and a DAST finding;
• and
• merging a SAST finding and a DAST findings.