# US 9,882,926 B2 · Detecting stored cross-site scripting vulnerabilities in web applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,926 B2 - Document ID: US9882926B2 - Status: Granted - Kind: B2 - Application number: 15/283,701 - Filed: 2016-10-03 - Published: 2017-01-26 - Granted: 2018-01-30 - Earliest claimed: 2011-08-25 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Yair Amit; Alexander Landa; Omer Tripp - Web page: https://patentgrep.com/patent/US9882926B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 2221/033: Test or assess software - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for detecting security vulnerabilities in web applications, the system including, a black-box tester configured to provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier, and an execution engine configured to detect the identifier within the payload received during an interaction with the web application subsequent to the first interaction, and determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction. ## Claims ### Claim 1 A computer hardware testing system for detecting security vulnerability in a web application, comprising: a hardware processor configured to initiate the executable operations of: providing, to the web application and during a first interaction with the web application on a computer server, a payload including payload instruction and an identifier distinct from the payload instruction; detecting, within the payload received during an interaction with the web application subsequent to the first interaction, the identifier; and determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction. ### Claim 2 (depends on 1) The system of claim 1, wherein the hardware processor is further configured to initiate the executable operation of: reporting, upon the determining that the payload instruction did not undergo a security check prior to the execution of the payload instruction, that the web application is vulnerable to a stored cross-site scripting attacking. ### Claim 3 (depends on 2) The system of claim 2, wherein the reporting indicates an interface of the web application through which the payload was introduced. ### Claim 4 (depends on 2) The system of claim 2, wherein the reporting indicates a location within the payload at which the payload instruction is found. ### Claim 5 (depends on 1) The system of claim 1, wherein the hardware processor is further configured to initiate the executable operations of: receiving, subsequent to the first interaction, an interaction-initiating instruction from the web application during a second interaction with the web application; receiving, during a third interaction with the web application subsequent to the second interaction, the payload; and initiating the third interaction with the web application by executing the interaction-initiating instruction. ### Claim 6 (depends on 5) The system of claim 5, wherein the interaction-initiating instruction is an AJAX request. ### Claim 7 (depends on 1) The system of claim 1, wherein the determining includes determining whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator. ### Claim 8 (depends on 1) The system of claim 1, wherein the payload instruction is a predefined security-sensitive instruction. ### Claim 9 (depends on 8) The system of claim 8, wherein the security-sensitive instruction is a DOM API command. ### Claim 10 (depends on 1) The system of claim 1, wherein the payload instruction is computer-executable instructions and the identifier is a unique alphanumeric identifier. ### Claim 11 A computer program product, comprising: a computer hardware device having stored therein computer-readable program code for detecting security vulnerability in a web application, the computer-readable program code, which when executed by a computer hardware testing system, causes the computer hardware testing system to perform: providing, to the web application and during a first interaction with the web application on a computer server, a payload including payload instruction and an identifier distinct from the payload instruction; detecting, within the payload received during an interaction with the web application subsequent to the first interaction, the identifier; and determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the computer-readable program code further causes the computer hardware testing system to perform: reporting, upon the determining that the payload instruction did not undergo a security check prior to the execution of the payload instruction, that the web application is vulnerable to a stored cross-site scripting attacking. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the reporting indicates an interface of the web application through which the payload was introduced. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the reporting indicates a location within the payload at which the payload instruction is found. ### Claim 15 (depends on 11) The computer program product of claim 11, wherein the computer-readable program code further causes the computer hardware testing system to perform: receiving, subsequent to the first interaction, an interaction-initiating instruction from the web application during a second interaction with the web application; receiving, during a third interaction with the web application subsequent to the second interaction, the payload; and initiating the third interaction with the web application by executing the interaction-initiating instruction. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the interaction-initiating instruction is an AJAX request. ### Claim 17 (depends on 11) The computer program product of claim 11, wherein the determining includes determining whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein the payload instruction is a predefined security-sensitive instruction. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the security-sensitive instruction is a DOM API command. ### Claim 20 (depends on 11) The computer program product of claim 11, wherein the payload instruction is computer-executable instructions and the identifier is a unique alphanumeric identifier.