SYSTEMS AND METHODS FOR AUTOMATED DETECTION OF LOGIN SEQUENCE FOR WEB FORM-BASED AUTHENTICATION

• US 20140282975A1
• Filed: 03/14/2014
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Veracode Incorporated (Broadcom, Inc.)
• Original Assignee: Veracode Incorporated (Broadcom, Inc.)
• Inventors: Linszner, Daniel
• Granted Patent: US 9,807,085 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system for automating login can determine if a web artifact, such as a web page, includes a login form, by identifying a password field, a user ID field, and a submit button or another element providing the functionality to submit credentials for authorization. Submission of user credentials may be emulated, and access to password protected areas can be ascertained, e.g., by identifying any element that permits signing out from the password protected area.

Claims

1. A method for determining a login sequence, the method comprising:

(a) receiving in memory coupled to a processor a model of a web artifact, the model comprising at least one of;

(i) a structure of the web artifact, and (ii) one or more events associated with an element of the structure;

(b) identifying by the processor, a password field in the model, and a form associated with the password field;

(c) identifying by the processor one or more input fields in the form;

(d) ascertaining by the processor that a number of input fields in the form equals a specified number of input fields; and

(e) identifying by the processor a submit element in the form.

2. The method of claim 1, wherein the web artifact comprises at least one of a web page and a web application.

3. The method of claim 1, wherein the structure comprises a document object model (DOM) of the web artifact.

4. The method of claim 1, wherein an event from the one or more events comprises a JavaScript event.

5. The method of claim 1, wherein identifying one or more input fields comprises identifying an input field of at least one of:

(i) an unspecified type, (ii) a text type, and (iii) an email type.

6. The method of claim 1, wherein identifying the submit element comprises identifying at least one of an input field, an element of type button, an element associated with an onclick event, and a link.

7. The method of claim 1, wherein:

the web artifact comprises a webpage;

the model comprises a plurality of iframes associated with the webpage; and

identifying a password field in the model in step (b) comprises identifying a password field in at least one iframe.

8. The method of claim 1, further comprising executing by the processor at least one click on a non-login artifact to retrieve the web artifact.

9. The method of claim 1, further comprising generating a login script by outputting by the processor:

one or more first commands, each first command corresponding to a different one of the identified input fields;

a second command corresponding to the password field; and

a third command corresponding to the submit element.

10. The method of claim 9, wherein each one of the first commands and the second command comprises at least a portion of user credentials stored in the memory.

11. The method of claim 10, wherein the user credentials comprise a user name and a corresponding password.

12. The method of claim 1, further comprising:

supplying user credentials stored in the memory to the web artifact; and

verifying the web artifact using a first non-login artifact received in response to the supplied user credentials.

13. The method of claim 12, wherein verifying the authorization comprises:

storing in the memory an access handle to the first non-login artifact; and

testing if the first non-login artifact comprises a sign-out element.

14. The method of claim 13, wherein the access handle comprises a URL.

15. The method of claim 13, wherein the sign-out element comprises at least one of a field, a button, and a link, and the sign-out element is associated with a string selected from the group consisting of:

“

signout,”

“

sign out,”

“

logout,”

“

log out,”

“

my profile,”

“

your profile,”

“

edit profile,”

“

my account,”

“

your account,”

“

edit account,”

“

my settings,”

“

your settings,”

“

edit settings,” and

“

account settings.”

16. The method of claim 13, further comprising:

seeking by the processor access to the stored access handle and, in response, receiving a second non-login artifact; and

testing by the processor that the second non-login artifact lacks any sign out elements.

17. The method of claim 16, further comprising generating a verification script by outputting by the processor:

a command to seek the stored access handle; and

at least one command testing a lack of a particular sign-out element.

18. A system for determining a login sequence, comprising:

a memory comprising a model of a web artifact, the model comprising at least one of;

(i) a structure of the web artifact, and (ii) one or more events associated with an element of the structure; and

a processor coupled to the memory and configured to;

identify a password field in the model, and a form associated with the password field;

identify one or more input fields in the form;

ascertain that a number of input fields in the form equals a specified number of input fields; and

identify a submit element in the form.

19. The system of claim 18, wherein the processor is further configured to:

generate one or more first commands, each first command corresponding to a different one of the identified input fields;

generate a second command corresponding to the password field;

generate a third command corresponding to the submit element; and

output a login script comprising the one or more first commands, the second command, and the third command.

20. The system of claim 18, wherein the processor is further configured to:

supply user credentials stored in the memory to the web artifact;

verify the web artifact using a first non-login artifact received in response to the supplied user credentials; and

output a verification script if the verification is successful.