Application testing for security vulnerabilities
AssigneeInternational Business Machines Corporation
InventorsRoee Hay, Omer Tripp
Life of this patent
Estimating the term…
Abstract
In an approach for testing an application for a security vulnerability, a processor inserts an instrumentation hook in the application to be tested, wherein the instrumentation hook is executed prior to a sink operation. A processor transmits a probe input value to the application to be tested. A processor detects a modification to the probe input value at the instrumentation hook by comparing the probe input value at the instrumentation hook to a signature value and detecting that the probe input value matches the signature value. A processor removes the sink operation from testing for the security vulnerability.
Claims20
A computer system comprising:
- one or more computer processors, one or more computer readable storage media, and program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
- program instructions to, prior to a sink operation for a file system operation, insert an instrumentation hook in an application to be tested by editing binary code;
- program instructions to transmit a probe input value shared by a security vulnerability;
- program instructions to, subsequent to a sanitation process on the probe input value, detect that a modification to the probe input value matches a signature value, wherein the signature value includes a structured query language operation that is modified to not be executable;
- and
- program instructions to remove the sink operation from testing for the security vulnerability and to remove tests corresponding to structured query language security vulnerabilities.
A computer-implemented method comprising:
- prior to a sink operation for a file system operation, inserting, by one or more processors, an instrumentation hook in an application to be tested by editing binary code;
- transmit, by one or more processors, a probe input value shared by a security vulnerability;
- subsequent to a sanitation process on the probe input value, detecting, by one or more processors, that a modification to the probe input value matches a signature value, wherein the signature value includes a structured query language operation that is modified to not be executable;
- and
- removing, by one or more processors, the sink operation from testing for the security vulnerability and removing tests corresponding to structured query language security vulnerabilities.
A computer program product comprising:
- one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
- program instructions to, prior to a sink operation for a file system operation, insert an instrumentation hook in an application to be tested by editing binary code;
- program instructions to transmit a probe input value shared by a security vulnerability;
- program instructions to, subsequent to a sanitation process on the probe input value, detect that a modification to the probe input value matches a signature value, wherein the signature value includes a structured query language operation that is modified to not be executable;
- and
- program instructions to remove the sink operation from testing for the security vulnerability and to remove tests corresponding to structured query language security vulnerabilities.
Dependencies are inferred from the claim text.