CHARACTERIZATION OF WEB APPLICATION INPUTS

• US 20080120420A1
• Filed: 11/17/2006
• Published: 05/22/2008
• Est. Priority Date: 11/17/2006
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: SIMA, Caleb, Hoffman, William M., Kelly, Raymond
• Application Number:
  US11/560,984
• Publication Number:
  US 20080120420A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The inputs of a web application are detected through a technique such as crawling, and then the characteristics of the inputs are determined. The characteristics are determined by identifying how the inputs react to various probes containing varying characters and varying numbers of characters. As such, the characters allowed by the input are identified, the maximum and minimum number of characters that are accepted and the manner in which the characters are treated by the web application. Further characteristics of the inputs are determined by examining the context of the inputs, the markup language associated with the input, the size of the input, etc. The knowledge regarding the input characterizations can be applied in a variety of settings.

Claims

1. A method for characterizing the inputs of a web application, the method comprising the steps of:

identifying an input of a web application;

operationally determining the characteristics of the input;

contextually determining the characteristics of the input; and

applying the input characterization knowledge.

2. The method of claim 1, wherein the step of operationally determining the characteristics of the input of the web application comprises determining what characters are accepted by the input.

3. The method of claim 1, wherein the step of operationally determining the characteristics of the input of the web application comprises determining the number of characters that are accepted by the input.

4. The method of claim 1, wherein the step of operationally determining the characteristics of the input of the web application comprises determining the manner that the input is treated.

5. The method of claim 1, wherein the step of operationally characterizing the input further comprises:

sending a probe to the web application, the probe including one or more characters;

receiving a response from the web application; and

analyzing the response to determine if the one or more characters were accepted.

6. The method of claim 5, further comprising the step of repeating the steps until all of the characters accepted by the web application input have been identified.

7. The method of claim 1, wherein the step of contextually determining the characteristics of the input of the web application comprises examining the context of the web page in the vicinity of the input.

8. The method of claim 7, wherein the step of examining the context of the web page in the vicinity of the input comprises scraping the web page for matter associated with the input.

9. The method of claim 7, wherein the step of examining the context of the web page in the vicinity of the input comprises scraping the web page for textual content describing the input.

10. The method of claim 1, wherein the step of contextually determining the characteristics of the input of the web application comprises examining the markup language code related to the inputs.

11. The method of claim 10, wherein the step of examining the markup language code related to the input comprises the step of parsing the code for textual content describing the input.

12. The method of claim 1, further comprising the step of crawling the web application to identify the input.

13. The method of claim 12, further comprising the step of repeating the steps for each input of the web application.

14. A method for characterizing the inputs of a web application, the method comprising the steps of:

crawling the web application to identify the inputs;

for each identified input, operationally determining the characteristics of the input by;

sending a series of probes to the input;

receiving responses to the probes from the web application;

analyzing the response; and

for each identified input, contextually determining the characteristics of the input by;

examining content in the proximity of the input; and

examining the markup language code associated with the input.

15. The method of claim 14, wherein the step of sending a series of probes to the input further comprises sending probes to identify the characters accepted by the input.

16. The method of claim 14, wherein the step of sending a series of probes to the input further comprises sending probes to identify the number of characters accepted by the input.

17. A method for characterizing the inputs to a web application, the method comprising the steps of:

crawling the web application to identify the inputs;

for each identified input, characterizing the input by;

sending probes with various characters and varying numbers of characters to the input;

receiving responses to the probes from the web application;

analyzing the response;

parsing the HTML code of the web site for textual information related to the input; and

scraping the web page to identify descriptive material about the input.