Cooperative static and dynamic analysis of web application code for finding security vulnerabilities

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for combining static source code analysis and dynamic source code analysis to analyze a website, the operations comprising:

• receiving, by a static source code analysis (SSCA) module executed on a server-side computing device, source code data based on one or more web pages of a web site;
• analyzing, by the SSCA module, the source code data using static analysis of a text of the one or more web pages of the website without executing the source code to provide initial results, the initial results comprising identifiers respectively assigned to one or more variables provided in the source code data;
• transmitting, by the SSCA module, a request to the web site through a proxy server, the request being based on the initial results, the proxy server receiving a response and transmitting a rewritten response to a dynamic source code analysis (DSCA) module executed on a client-side computing device, the DSCA module being configured to perform an examination of the source code during an execution of the source code;
• receiving, by the SSCA module, updated source code data from the DSCA module, the updated source code data being provided based on the rewritten response;
• and
• updating, by the SSCA module, the initial results based on the updated source code data.

A system, comprising:

• a client-side computing device;
• and
• a computer-readable storage device coupled to the client-side computing device and having instructions stored thereon which, when executed by the client-side computing device, cause the client-side computing device to perform operations for combining static source code analysis and dynamic source code analysis to analyze a website, the operations comprising:
• receiving, by a static source code analysis (SSCA) module executed on a server-side computing device, source code data based on one or more web pages of a web site;
• analyzing, by the SSCA module, the source code data using static analysis of a text of the one or more web pages of the website without executing the source code to provide initial results, the initial results comprising identifiers respectively assigned to one or more variables provided in the source code data;
• transmitting, by the SSCA module, a request to the website through a proxy server, the request being based on the initial results, the proxy server receiving a response and transmitting a rewritten response to a dynamic source code analysis (DSCA) module executed on a client-side computing device, the DSCA module being configured to perform an examination of the source code during an execution of the source code;
• receiving, by the SSCA module, updated source code data from the DSCA module, the updated source code data being provided based on the rewritten response;
• and
• updating, by the SSCA module, the initial results based on the updated source code data.