Determining the vulnerability of computer software applications to privilege-escalation attacks

A computer program product for determining vulnerability of computer software applications to privilege-escalation attacks, the computer program product comprising:

• a non-transitory computer-readable storage medium;
• and
• computer-readable program code embodied in said computer-readable storage device, wherein said computer-readable program code is configured to:
• perform differential black-box testing of the computer software application to identify a candidate access-restricted area of instructions of a computer software application, comprising:
• control a black-box tester to perform a first test simulating interactions with the computer software application as a user who is authorized to access restricted areas of the computer software application,
• control the black-box tester to perform a second test simulating interactions with the computer software application as a user who is not authorized to the access restricted areas of the computer software application,
• compare the results of both of the tests to identify any data entry interfaces that were exposed to the authorized user but that were not exposed to the unauthorized user,
• correlate the identified data entry interfaces with the computer software application instructions underlying the identified data entry interfaces, and
• designate the correlated instructions as the candidate access-restricted area;
• statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;
• in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;
• and
• in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:
• identify a candidate access-restricted area of instructions of a computer software application;
• statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;
• in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;
• and
• in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:
• control a black-box tester to perform differential black-box testing of a computer software application to identify a candidate access-restricted area, further configured to:
• control the black-box tester to perform a first test simulating interactions with the computer software application as a user who is authorized to access restricted areas of the computer software application;
• control the black-box tester to perform a second test simulating interactions with the computer software application as a user who is not authorized to the access restricted areas of the computer software application;
• compare the results of both of the tests to identify any data entry interfaces that were exposed to the authorized user but that were not exposed to the unauthorized user;
• correlate the identified data entry interfaces with the computer software application instructions underlying the identified data entry interfaces;
• and
• designate the correlated instructions as the candidate access-restricted areas;
• statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;
• in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;
• and
• in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

A computer program product for determining vulnerability of computer software applications to privilege-escalation attacks, the computer program product comprising:

• a non-transitory computer-readable storage medium;
• and
• computer-readable program code embodied in said computer-readable storage device, wherein said computer-readable program code is configured to:
• identify a candidate access-restricted area of instructions of a computer software application;
• statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;
• in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;
• in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks;
• and
• in response to determining that the conditional instruction is dependent on the user input:
• perform a first test simulating interactions with the computer software application as a user who is authorized to access the candidate access-restricted area;
• perform a second test simulating interactions with the computer software application as a user who is not authorized to access the candidate access-restricted area;
• and
• in response to determining a success of the first test only, determine that the conditional instruction is a valid authentication test.

A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:
• identify a candidate access-restricted area of instructions of a computer software application;
• statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;
• in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;
• in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks;
• and
• in response to determining that the conditional instruction is dependent on the user input:
• perform a first test simulating interactions with the computer software application as a user who is authorized to access the candidate access-restricted area;
• perform a second test simulating interactions with the computer software application as a user who is not authorized to access the candidate access-restricted area;
• and
• in response to determining a success of the first test only, determine that the conditional instruction is a valid authentication test.