Automated user interaction in application assessment

• US 20050132232A1
• Filed: 12/07/2004
• Published: 06/16/2005
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Sima, Caleb
• Granted Patent: US 7,647,631 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Various embodiments of systems, methods, software tools, etc. for performing an assessment of an application are provided. One embodiment comprises a method for performing an assessment of a web application. One such method comprises: recording user interactions with a web application; and playing back the user interactions to perform an assessment of the web application.

Claims

1. A method for performing an assessment of a web application, the method comprising:

recording user interactions with a web application; and

playing back the user interactions to perform an assessment of the web application.

2. The method of claim 1, wherein the recording user interactions with the web application comprises using a socket recorder to capture user interactions between a browser and the web application.

3. The method of claim 2, wherein the using a socket recorder to capture user interactions comprises employing an operating system API to monitor user interactions via the browser.

4. The method of claim 3, wherein the operating system API comprises a debugging functionality.

5. The method of claim 1, wherein the recording user interactions with the web application comprises using a network proxy to capture user interactions between a browser and the web application.

6. The method of claim 1, wherein the recording user interactions with the web application includes storing the user interactions.

7. The method of claim 1, wherein the playing back the user interactions to perform an assessment of the web application comprises performing a vulnerability assessment of the web application based on the user interactions.

8. The method of claim 1, wherein the recording user interactions with the web application comprises recording an authentication procedure used to establish an authenticated connection with the web application.

9. The method of claim 8, further comprising:

determining when the authenticated connection has been lost; and

automatically replaying the authentication procedure to re-establish connection with the web application.

10. A web application assessment system comprising:

a user interaction recorder for capturing interactions between a browser and a web application; and

a playback tool for receiving the captured interactions and automatically repeating the captured interactions for performing an assessment of the web application.

11. The web application assessment system of claim 10, wherein the user interaction recorder comprises a socket recorder.

12. The web application assessment system of claim 11, wherein the socket recorder comprises an operating system debug functionality.

13. The web application assessment system of claim 10, wherein the user interaction recorder comprises a network proxy.

14. The web application assessment system of claim 10, wherein the playback tool interfaces with an assessment agent for performing a vulnerability assessment of the web application.

15. The web application assessment system of claim 10, wherein the playback tool automatically repeats the captured interactions for performing a security assessment of the web application.

16. The web application assessment system of claim 10, wherein the user interaction recorder comprises a browser plug-in.

17. The web application assessment system of claim 10, wherein the user interaction recorder comprises an interactive user menu configured to enable a user to specify when the user interaction recorder captures interactions.

18. The web application assessment system of claim 10, further comprising a database of recorded user interactions.

19. The web application assessment system of claim 10, wherein the user interaction recorder captures an authentication procedure used to establish an authenticated connection with the web application.

20. The web application assessment system of claim 19, wherein the playback tool is configured to determine when the authenticated connection has been lost and automatically replay the authentication procedure to re-establish the authenticated connection with the web application.

21. An application assessment system comprising:

means for capturing user interactions between a user interface and an application; and

means for automatically repeating the captured interactions for performing a security assessment of the application.

22. A web application vulnerability assessment system comprising:

a recorder that interfaces with a web browser to capture interactions between the web browser and a web application being accessed by the web browser; and

a web application assessment agent for automatically repeating the captured interactions during a vulnerability assessment of the web application.

23. The web application vulnerability assessment system of claim 22, wherein the recorder comprises a browser plug-in.

24. The web application vulnerability assessment system of claim 22, wherein the recorder comprises a socket.