# US 8,789,187 B1 · Pattern tracking and capturing human insight in a web application security scanner > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,187 B1 - Document ID: US8789187B1 - Status: Granted - Kind: B1 - Application number: 11/864,787 - Filed: 2007-09-28 - Granted: 2014-07-22 - Earliest claimed: 2006-09-28 - Assignees: WhiteHat Security, Inc. - Applicants: William Pennington; Jeremiah Grossman; Robert Stone; Siamak Pazirandeh - Inventors: William Pennington; Jeremiah Grossman; Robert Stone; Siamak Pazirandeh - Web page: https://patentgrep.com/patent/US8789187B1 ## CPC - G06F 11/3672: {Test management} - G06F 11/263: Generation of test inputs, e.g. test vectors, patterns or sequences {; with adaptation of the tested hardware for testability with external testers} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus and method of managing vulnerability testing of a web application is provided for running a set of one or more scripted tests against a web application, recording results of the one or more scripted tests, providing an interface for a human evaluator to review the recorded results, and accepting from the human evaluator custom test parameters based on observations of the recorded results, wherein custom test parameters include at least one context usable by a future tester in deciding whether to run the custom test, and also includes at least one instruction for automatically running custom test steps of the custom test. ## Claims ### Claim 1 A method of managing vulnerability testing of a web application, the method comprising: running a set of one or more scripted tests against a web application using a computer processor; recording results of the one or more scripted tests; providing an interface for a human evaluator to review the recorded results; and accepting from the human evaluator custom test parameters for a custom test record, wherein the custom test record includes indications of the custom test parameters for a custom test associated with the custom test record, and wherein at least some of the custom test parameters are based on observations of the recorded results, the custom test record including at least one context related to the recorded results and usable by a future tester in deciding whether to run the custom test, and also including a pattern in the web application recognized by the human evaluator and based on observations of the recorded results; automatically running a second scripted test against the web application or another web application using a computer processor, the second scripted test including a plurality of requests for service from the web application or the other web application, wherein running the second scripted test includes communicating at least one of the requests for service to the web application or the other web application; and comparing the at least one of request for service communicated to the web application or other web application to one or more of the custom test records previously created, wherein comparing comprises at least comparing the pattern included in the custom test parameters to determine whether or not the at least one request communicated to the web application or other web application matches the pattern of one or more of the custom tests. ### Claim 2 (depends on 1) The method of claim 1, wherein the custom test parameters include an indication of which web applications to run the custom test against or which class of web applications to run the custom test against. ### Claim 3 (depends on 1) The method of claim 1, further comprising: checking previously created custom tests for relevancy; and discarding irrelevant custom tests. ### Claim 4 (depends on 1) The method of claim 1, wherein at least some of the observations used by the human evaluator to decide to generate the custom test are stored in a context of the custom test. ### Claim 5 (depends on 1) The method of claim 1, further comprising presenting the at least one context included in the custom test parameters to the future tester if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters. ### Claim 6 (depends on 1) The method of claim 1, wherein the recorded results include an expression, and the custom test parameters include the same expression as the recorded results. ### Claim 7 (depends on 1) The method of claim 1, further comprising running the custom test if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters. ### Claim 8 (depends on 1) The method of claim 1, wherein the at least one context is related to indicators of potential weaknesses of the web application. ### Claim 9 (depends on 1) The method of claim 1, further comprising accepting from the human evaluator a test script for the custom test. ### Claim 10 (depends on 1) The method of claim 1, wherein the custom test parameters further include at least one instruction for running custom test steps of the custom test. ### Claim 11 (depends on 1) The method of claim 1, wherein the pattern in the web application is recognized as leading to a potential security vulnerability that may not be readily apparent to subsequent testers. ### Claim 12 (depends on 1) The method of claim 1, wherein the custom test parameters include a plurality of patterns obtained as a result of running and recording the results of a plurality of scripted tests, and the method further comprises comparing the at least one request for service communicated to the web application or other web application to the plurality of patterns to determine whether or not the at least one request communicated to the web application or other web application matches at least one of the plurality of patterns. ### Claim 13 A computing device for managing vulnerability testing of a web application, the computing device comprising: a computer processor configured to read machine-readable instructions from a tangible, non-transitory computer-readable medium, the machine-readable instructions comprising: program code for running a set of one or more scripted tests against a web application; program code for recording results of the one or more scripted tests; program code for providing an interface for a human evaluator to review the recorded results; and program code for accepting from the human evaluator custom test parameters for a custom test record, wherein the custom test record includes indications of the custom test parameters for a custom test associated with the custom test record, and wherein at least some of the custom test parameters are based on observations of the recorded results, the custom test record including at least one context related to the recorded results and usable by a future tester in deciding whether to run the custom test, and also including a pattern in the web application recognized by the human evaluator and based on observations of the recorded results; program code for automatically running a second scripted test against the web application or another web application using a computer processor, the second scripted test including a plurality of requests for service from the web application or the other web application, wherein running the second scripted test includes communicating at least one of the requests for service to the web application or the other web application; and program code for comparing the at least one request for service communicated to the web application or other web application to one or more of the custom test records previously created, wherein comparing comprises at least comparing the pattern included in the custom test parameters to determine whether or not the at least one request communicated to the web application or other web application matches the pattern of one or more of the custom tests. ### Claim 14 (depends on 13) The computing device of claim 13, wherein the custom test parameters include an indication of which web applications to run the custom test against or which class of web applications to run the custom test against. ### Claim 15 (depends on 13) The computing device of claim 13, wherein the machine-readable instructions further comprise: program code for checking previously created custom tests for relevancy; and program code for discarding irrelevant custom tests. ### Claim 16 (depends on 13) The computing device of claim 13, wherein at least some of the observations used by the human evaluator to decide to generate the custom test are stored in a context of the custom test. ### Claim 17 (depends on 13) The computing device of claim 13, wherein the machine-readable instructions further comprise: program code for presenting the at least one context included in the custom test parameters to the future tester if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters. ### Claim 18 (depends on 13) The computing device of claim 13, wherein the recorded results include an expression, and the custom test parameters include the same expression as the recorded results. ### Claim 19 (depends on 13) The computing device of claim 13, wherein the machine-readable instructions further comprise program code for running the custom test if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters. ### Claim 20 A non-transitory computer-readable medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus having stored thereon instructions configured to manage vulnerability testing of a web application, the computer-readable medium being electronically readable, comprising: program code for running a set of one or more scripted tests against a web application; program code for recording results of the one or more scripted tests; program code for providing an interface for a human evaluator to review the recorded results; and program code for accepting from the human evaluator custom test parameters for a custom test record, wherein the custom test record includes indications of the custom test parameters for a custom test associated with the custom test record, and wherein at least some of the custom test parameters are based on observations of the recorded results the custom test record including at least one context related to the recorded results and usable by a future tester in deciding whether to run the custom test, and also including a pattern in the web application recognized by the human evaluator and based on observations of the recorded results; program code for automatically running a second scripted test against the web application or another web application using a computer processor, the second scripted test including a plurality of requests for service from the web application or the other web application, wherein running the second scripted test includes communicating at least one of the requests for service to the web application or the other web application; and program code for comparing the at least one request for service communicated to the web application or other web application to one or more of the custom test records previously created, wherein comparing comprises at least comparing the pattern included in the custom test parameters to determine whether or not the at least one request communicated to the web application or other web application matches the pattern of one or more of the custom tests. ### Claim 21 (depends on 20) The computer-readable medium of claim 20, wherein the custom test parameters include an indication of which web applications to run the custom test against or which class of web applications to run the custom test against. ### Claim 22 (depends on 20) The computer-readable medium of claim 20, further comprising: program code for checking previously created custom tests for relevancy; and program code for discarding irrelevant custom tests. ### Claim 23 (depends on 20) The computer-readable medium of claim 20, wherein at least some of the observations used by the human evaluator to decide to generate the custom test are stored in a context of the custom test. ### Claim 24 (depends on 20) The computer-readable medium of claim 20, further comprising: program code for presenting the at least one context included in the custom test parameters to the future tester if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters. ### Claim 25 (depends on 20) The computer-readable medium of claim 20, wherein the recorded results include an expression, and the custom test parameters include the same expression as the recorded results. ### Claim 26 (depends on 20) The computer-readable medium of claim 20, further comprising program code for running the custom test if it is determined that there is a match between the at least one request communicated to the web application or other web application and the pattern included in the custom test parameters.