Adaptive fuzzing system for web services

A method for adaptive fuzzing testing for identifying vulnerabilities on a web site, the method comprising:

• performing a breadth first search on the web site to identify at least one page of the web site to test for a vulnerability;
• performing minimal fuzzing testing on each page of the web site that is identified during the breadth first search;
• gathering at least one heuristic for a page of the web site on which minimal fuzzing testing is performed;
• generating a vulnerability score for a page of the web site utilizing the at least one heuristic gathered for the page wherein generating the vulnerability score comprises employing a linear evaluation function or an exponential evaluation function that uses at least a value for one heuristic gathered for the page of the web site to calculate the vulnerability score for the page of the web site;
• identifying a page of the web site that has a generated vulnerability score that is not less than a predefined vulnerability threshold value wherein an identified page of the web site that has a generated vulnerability score that is not less than the predefined vulnerability threshold value comprises a potentially vulnerable page;
• performing expanded fuzzing testing on the potentially vulnerable page;
• and
• performing a depth first search on the web site to identify at least one page of the web site to test for a vulnerability subsequent to identifying the potentially vulnerable page, wherein the depth first search begins with the potentially vulnerable page.

An adaptive fuzzing system for web services, comprising:

• a breath first search component with circuitry comprising a capability to manage breadth first searching of pages of a web site to identify at least one page of the web site to test for a vulnerability;
• a minimal fuzzing component with circuitry comprising a capability to execute minimal fuzzing testing on pages of the web site;
• a depth first search component with circuitry comprising a capability to manage depth first searching of pages of the web site to identify at least one additional page of the web site to test for a vulnerability;
• an expanded fuzzing component with circuitry comprising a capability to execute expanded fuzzing testing on pages of a web site;
• a heuristic component with circuitry that comprises a capability to review pages of the web site and gather at least one heuristic on a page of the web site whose value can be utilized to determine if the page of the web site has a potential for hosting a vulnerability;
• and
• a scalability component with circuitry comprising a capability to collaborate with a second adaptive fuzzing system executing on a second computing device to test pages of the web site for vulnerabilities wherein the heuristic component further comprises a capability to generate at least one second heuristic for a page of the web site whose value can be utilized to determine if the page of the web site has the potential for hosting a vulnerability, and wherein the heuristic component further comprises a capability to generate a vulnerability score for a page of the web site using a value for at least one heuristic gathered for the page of the web site and a value for the at least one second heuristic generated for the page of the web site, wherein the vulnerability score generated for the page of the web site that is not less than a predetermined vulnerability threshold value indicated that the page of the web site has the potential for hosting a vulnerability.