BLACK-BOX TESTING OF WEB APPLICATIONS WITH CLIENT-SIDE CODE EVALUATION

• US 20130007885A1
• Filed: 06/28/2011
• Published: 01/03/2013
• Est. Priority Date: 06/28/2011
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: HAVIV, YINNON A., KALMAN, DANIEL, TRIPP, OMER, WEISMAN, OMRI, PIKUS, DMITRI
• Granted Patent: US 9,032,528 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Detecting security vulnerabilities in web applications by interacting with a web application at a computer server during its execution at the computer server, identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server, evaluating the identified client-side instructions, and identifying a security vulnerability associated with the client-side instructions.

Claims

1. A system for detecting security vulnerabilities in web applications, the system comprising:

a black-box tester configured to

interact with a web application at a computer server during its execution at the computer server, and

identify client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server; and

a client-side evaluator configured to

evaluate the client-side instructions identified by the black-box tester, and

identify a security vulnerability associated with the client-side instructions.

2. The system of claim 1 where the black-box tester is configured to identify a security vulnerability associated with the web application.

3. The system of claim 1 where the client-side evaluator is configured to perform static analysis of the client-side instructions identified by the black-box tester to identify the security vulnerability associated with the client-side instructions.

4. The system of claim 1 where the client-side evaluator is configured to perform dynamic taint analysis on the client-side instructions to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

5. The system of claim 4 where the client-side evaluator is configured to modify the client-side instructions identified by the black-box tester to store information indicating whether variables within the client-side instructions point to tainted objects, and

where the client-side evaluator is configured to perform dynamic taint analysis on the modified client-side instructions to track taint propagation within the modified client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

6. The system of claim 4 where the client-side evaluator is configured to use a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

7. The system of claim 4 and further comprising an interpreter configured to track any variable within the client-side instructions that directly points to a tainted object within the client-side instructions,

where the client-side evaluator is configured to perform dynamic taint analysis on the client-side instructions by calling the interpreter to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

8. The system of claim 7 where the interpreter is configured to track any variable that ultimately depends from any variable within the client-side instructions that directly points to a tainted object within the client-side instructions.

9. The system of claim 7 where the interpreter is configured to use a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

10. The system of claim 4 and further comprising a symbolic analyzer configured to perform symbolic analysis of the client-side instructions to determine at least one value for at least one variable within the client-side instructions that would result in a control flow target being reached within the client-side instructions during execution of the client-side instructions,

where the client-side evaluator is configured to use any value determined by the symbolic analyzer when performing the dynamic taint analysis on the client-side instructions to cause the target control flow.

11-20. -20. (canceled)

21. A computer program product for detecting security vulnerabilities in web applications, the computer program product comprising:

a computer-readable storage medium; and

computer-readable program code embodied in the computer-readable storage medium, where the computer-readable program code is configured to

interact with a web application at a computer server during its execution at the computer server,

identify client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server,

evaluate the client-side instructions, and

identify a security vulnerability associated with the client-side instructions.

22. The computer program product of claim 21 where the computer-readable program code is configured to identify a security vulnerability associated with the web application.

23. The computer program product of claim 21 where the computer-readable program code is configured to perform static analysis of the client-side instructions to identify the security vulnerability associated with the client-side instructions.

24. The computer program product of claim 21 where the computer-readable program code is configured to perform dynamic taint analysis on the client-side instructions to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

25. The computer program product of claim 24 where the computer-readable program code is configured to

modify the client-side instructions to store information indicating whether variables within the client-side instructions point to tainted objects, and

perform dynamic taint analysis on the modified client-side instructions to track taint propagation within the modified client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.