Security testing of web applications with specialized payloads
AssigneeGlobalfoundries Inc.
InventorsOmer Tripp, Emmanuel Wurth
Life of this patent
Estimating the term…
Abstract
In one embodiment, a computer-implemented method for security testing of web applications with specialized payloads includes submitting a test to a web application, where the test includes a payload with a set of constraints. A response is received from the web application. One or more constraints are derived from the response. The set of constraints of the payload are updated with the derived one or more constraints. The payload is synthesized, by a computer processor, for the updated set of constraints. The test having the synthesized payload is iterated with the updated set of constraints.
Claims19
A computer-implemented method for security testing of web applications with specialized payloads, the method comprising:
- submitting to a web application a payload based on a set of constraints of the payload, the set of constraints of the payload being in form of tokens sanitizable by a server hosting the web application, the submitting being at least a portion of a vulnerability test for the web application, and the vulnerability test being a test for cross-site scripting;
- receiving a response from the web application;
- deriving one or more constraints from the response;
- updating, by a computer processor, the set of constraints of the payload with the derived one or more constraints to generate an updated set of constraints;
- synthesizing, by the computer processor, an updated payload based on the updated set of constraints, the updated payload being submittable as input to the web application for testing the web application;
- iterating the vulnerability test one or more times by submitting to the web application the updated payload based on the updated set of constraints;
- and
- determining, in response to the vulnerability test, that no vulnerability is identifiable in the web application, responsive to a failure to synthesize a new updated payload during the iterating.
A system for security testing of web applications with specialized payloads, comprising:
- a memory;
- and
- one or more processors, communicatively coupled to the memory, the one or more processors configured to:
- submit to a web application a payload based on a set of constraints, the set of constraints of the payload being in form of tokens sanitizable by a server hosting the web application, the submitting being at least a portion of a vulnerability test for the web application, and the vulnerability test being a test for cross-site scripting;
- receive a response from the web application;
- derive one or more constraints from the response;
- update the set of constraints of the payload with the derived one or more constraints to generate an updated set of constraints;
- synthesize an updated payload based on the updated set of constraints, the updated payload being submittable as input to the web application for testing the web application;
- iterate the vulnerability test one or more times by submitting to the web application the updated payload based on the updated set of constraints;
- and
- determine, in response to the vulnerability test, that no vulnerability is identifiable in the web application, responsive to a failure to synthesize a new updated payload during the iterating.
A computer program product for security testing of web applications with specialized payloads, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:
- submitting to a web application a payload based on a set of constraints of the payload, the set of constraints of the payload being in form of tokens sanitizable by a server hosting the web application, the submitting being at least a portion of a vulnerability test for the web application, and the vulnerability test being a test for cross-site scripting;
- receiving a response from the web application;
- deriving one or more constraints from the response;
- updating the set of constraints of the payload with the derived one or more constraints to generate an updated set of constraints;
- synthesizing an updated payload based on the updated set of constraints, the updated payload being submittable as input to the web application for testing the web application;
- iterating the vulnerability test one or more times by submitting to the web application the updated payload based on the updated set of constraints;
- and
- determining, in response to the vulnerability test, that no vulnerability is identifiable in the web application, responsive to a failure to synthesize a new updated payload during the iterating.
Dependencies are inferred from the claim text.