Using fuzzy classification models to perform matching operations in a web application security scanner
AssigneeWhiteHat Security, Inc.
InventorsWilliam Pennington, Jeremiah Grossman, Robert Stone, Siamak Pazirandeh
Life of this patent
Estimating the term…
Abstract
A system provides for fuzzy classification in comparisons of scanner responses. A web application test suite performs tests against a web application by sending client requests from a testing computer to the server running the web application and checking how the web application responds. A thorough web application security scan might involve thousands of checks and responses. As a result, some sort of programmatic analysis is needed. One such evaluation involves comparing one response against another. Response matching that compares two HTTP responses might use fuzzy classification processes.
Claims17
A method of testing a web application, the method comprising:
- communicating a first target request to the web application, the first target request being directed at the web application and being a request to be tested;
- receiving a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
- identifying parameters from the web application while logged in as a user;
- communicating a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
- receiving a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
- comparing the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process;
- and
- determining whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
A system for testing a web application, the system comprising:
- a storage element;
- and
- a processor configured to:
- communicate a first target request to a web application, the first target request being directed at the web application and being a request to be tested;
- receive a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
- identify parameters from the web application while logged in as a user;
- communicate a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
- receive a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
- compare the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process;
- and
- determine whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
A non-transitory computer-readable medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus having stored thereon instructions configured to test a web application, comprising:
- program code for communicating a first target request to a web application, the first target request being directed at the web application and being a request to be tested;
- program code for identifying parameters from the web application while logged in as a user;
- program code for receiving a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
- program code for communicating a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
- program code for receiving a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
- program code for comparing the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process;
- and
- program code for determining whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
Dependencies are inferred from the claim text.