Automated detection of login sequence for web form-based authentication

• US 10,587,612 B2
• Filed: 10/27/2017
• Issued: 03/10/2020
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Veracode Incorporated (Broadcom, Inc.)
• Original Assignee: Veracode Incorporated (Broadcom, Inc.)
• Inventors: Linszner, Daniel
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/795,303
• Publication Number:
  US 20180198773A1
• Time in Patent Office: 865 Days
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system for automating login can determine if a web artifact, such as a web page, includes a login form, by identifying a password field, a user ID field, and a submit button or another element providing the functionality to submit credentials for authorization. Submission of user credentials may be emulated, and access to password protected areas can be ascertained, e.g., by identifying any element that permits signing out from the password protected area.

Claims

1. A method comprising:

searching at least one of a model underlying a web page or a web application and events underlying the web page or the web application to identify a login form, wherein searching to identify the login form comprises searching at least one of the model and the events to identify a plurality of input fields common to login forms and to identify a submit element;

determining whether a number of the plurality of input fields identified in the login form as common to login forms is at least equal to a number of credentials in a set of credentials; and

based on determining that the number of the plurality of input fields identified in the login form as common to login forms is at least equal to the number of credentials in the set of credentials, generating a login sequence based, at least in part, on one or more of the plurality of input fields, the submit element, and the set of credentials.

2. The method of claim 1, wherein searching at least one of the model and the events to identify the submit element comprises identifying at least one of an input field to submit, an element of type button for submit, an element associated with an onClick event for submit, and a link for submit.

3. The method of claim 1, wherein the model comprises a plurality of iframes associated with the web page or web application, and wherein searching at least one of the model and the events comprises searching for a password field in at least one of the plurality of iframes.

4. The method of claim 1, further comprising executing at least one click on the web page or web application to verify the login sequence.

5. The method of claim 1, further comprising generating a login script based on the login sequence, wherein the login script comprises:

one or more first commands to supply the set of credentials to the plurality of input fields; and

a submit command corresponding to the submit element.

6. The method of claim 1, further comprising verifying the login sequence based on an element of a different web page or the web application.

7. The method of claim 6, wherein verifying the login sequence comprises:

storing in memory an access handle to the different web page or the web application; and

testing if the element of the different web page or the web application comprises a sign-out element.

8. The method of claim 7, wherein the access handle comprises a Uniform Resource Locator (URL).

9. The method of claim 7, further comprising:

seeking access to the access handle and, in response, receiving a non-login artifact; and

testing whether the non-login artifact lacks any sign out elements.

10. The method of claim 9, further comprising generating a verification script comprising:

a command to seek the access handle; and

at least one command testing a lack of a sign-out element.

11. The method of claim 1, wherein the login sequence comprises inputting each of the set of credentials to a corresponding one of the plurality of input fields.

12. The method of claim 1, further comprising accessing a web artifact based on executing the login sequence.

13. The method of claim 1, further comprising, based on determining that the number of the plurality of input fields identified in the login form as common to login forms is not at least equal to the number of credentials in the set of credentials, determining that the identified login form is not valid.

14. A system comprising:

a processor and;

a machine-readable medium having program code executable by the processor to cause the system to,

search at least one of a model underlying a web page or a web application and events underlying the web page or the web application to identify a login form, wherein the program code to search to identify the login form comprises program code to search at least one of the model and the events to identify a plurality of input fields common to login forms and to identify a submit element;

determine whether a number of the plurality of input fields identified in the login form as common to login forms is at least equal to a number of credentials in a set of credentials that includes a password; and

based on a determination that the number of the plurality of input fields identified in the login form as common to login forms is at least equal to the number of credentials in the set of credentials, generate a login sequence based, at least in part, on one or more of the plurality of input fields, the submit element, and the set of credentials.

15. The system of claim 14, further comprising program code to generate a login script based on the login sequence, wherein the login script comprises:

one or more first commands to supply the set of credentials to the plurality of input fields; and

a second command corresponding to the submit element.

16. The system of claim 14, further comprising program code to verify that the login sequence is correct based on an element of a succeeding web page or an output of the web application.

17. The system of claim 14, further comprising, based on a determination that the number of the plurality of input fields identified in the login form as common to login forms is not at least equal to the number of credentials in the set of credentials, determine that the identified login form is not valid.

18. A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:

searching at least one of a model underlying a web page or a web application and events underlying the web page or the web application to identify a login form, wherein searching to identify the login form comprises searching at least one of the model and the events to identify a plurality of input fields common to login forms and to identify a submit element;

determining whether a number of the plurality of input fields identified in the login form as common to login forms is at least equal to a number of credentials in a set of credentials;

based on determining that the number of the plurality of input fields identified in the login form as common to login forms is at least equal to the number of credentials in the set of credentials, generating a login sequence based, at least in part, on one or more of the plurality of input fields, the submit element, and the set of credentials; and

verifying the login sequence.

19. The non-transitory, computer-readable medium of claim 18, wherein verifying the login sequence comprises running the login sequence in a new session for the web application or web page and determining whether a web artifact resulting from running the login sequence includes an element to terminate the new session.

20. The non-transitory, computer-readable medium of claim 19, wherein searching to identify the plurality of input fields comprises first searching to identify a password field.