Technique for determining web services vulnerabilities and compliance
First Claim
1. A method for detecting vulnerabilities of an application, the method comprising:
- identifying interfaces associated with the application from a description of the interfaces;
generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
attacking the application by forwarding the mutant request to the application; and
detecting a vulnerability in the application as a result of the attack.
1 Assignment
0 Petitions
Accused Products
Abstract
A technique for testing applications for vulnerabilities that may be as a result of loosely defined criteria and restrictions associated with interfacing to the applications. Interfaces associated with an application to be tested are identified. The interfaces may include the names of services provided by the application as well as parameters that are passed to the services. One or more mutant requests containing one or more mutations are then generated based on the identified interfaces. The application is then attacked by forwarding the mutant requests to the application. Vulnerabilities of the application that were exposed as a result of the attack are then detected.
-
Citations
31 Claims
-
1. A method for detecting vulnerabilities of an application, the method comprising:
-
identifying interfaces associated with the application from a description of the interfaces;
generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
attacking the application by forwarding the mutant request to the application; and
detecting a vulnerability in the application as a result of the attack. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for detecting vulnerabilities in an application, the method comprising:
-
identifying interfaces associated with the application from one or more requests for services provided by the application;
generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
attacking the application by forwarding the mutant request to the application; and
determining results of the attack. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. An apparatus for detecting vulnerabilities in an application, the apparatus comprising:
-
a memory; and
a processor coupled to the memory, the processor configured to;
(a) identify interfaces associated with the application from a description of the interfaces, (b) generate a mutant request based on the identified interfaces wherein the request contains one or more mutations, (c) attack the application by forwarding the mutant request to the application, and (d) detect a vulnerability in the application as a result of the attack. - View Dependent Claims (20, 21, 22, 23, 24, 25, 26, 27)
-
-
28. An apparatus for detecting vulnerabilities in an application, the apparatus comprising:
-
a memory; and
a processor coupled to the memory, the processor configured to;
(a) identify interfaces associated with the application from one or more requests for services provided by the application, (b) generate a mutant request based on the identified interfaces wherein the request contains one or more mutations, (c) attack the application by forwarding the mutant request to the application, and (d) determine results of the attack.
-
-
29. An apparatus for detecting vulnerabilities in an application, the apparatus comprising:
-
means for identifying interfaces associated with the application from a description of the interfaces;
means for generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
means for attacking the application by forwarding the mutant request to the application; and
means for detecting a vulnerability in the application as a result of the attack.
-
-
30. An apparatus for detecting vulnerabilities in an application, the apparatus comprising:
-
means for identifying interfaces associated with the application from one or more requests for services provided by the application;
means for generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
means for attacking the application by forwarding the mutant request to the application; and
means for determining results of the attack.
-
-
31. A method for detecting vulnerabilities of an application, the method comprising:
-
identifying interfaces associated with the application;
generating a mutant request based on the identified interfaces wherein the request contains one or more mutations;
attacking the application by forwarding the mutant request to the application;
capturing a response from the application;
analyzing the response; and
assigning a severity level to the response.
-
Specification