System for determining web application vulnerabilities

• US 20030233581A1
• Filed: 03/20/2003
• Published: 12/18/2003
• Est. Priority Date: 03/03/2000
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Tsarfati, Tom, Raanan, Gil, Reshef, Eran, El-Hanany, Yuval
• Granted Patent: US 7,237,265 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method for detecting security vulnerabilities in a web application includes analyzing the client requests and server responses resulting therefrom in order to discover pre-defined elements of the application'"'"'s interface with external clients and the attributes of these elements. The client requests are then mutated based on a pre-defined set of mutation rules to thereby generate exploits unique to the application. The web application is attacked using the exploits and the results of the attack are evaluated for anomalous application activity.

Claims

1. A method for detecting security vulnerabilities in a web application executing on a web server or web application server, the method comprising:

actuating the application in order to discover pre-defined elements of the application'"'"'s interface with external clients;

generating client requests having unauthorized values for said elements in order to generate exploits unique to the application;

attacking the application using the exploits; and

evaluating the results of the attack.