Black-box testing of web applications with client-side code evaluation

• US 8,910,291 B2
• Filed: 03/26/2012
• Issued: 12/09/2014
• Est. Priority Date: 06/28/2011
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (FIG LLC (d/b/a Fortress Investment Group LLC))
• Original Assignee: International Business Machines Corporation
• Inventors: Haviv, Yinnon A., Kalman, Daniel, Tripp, Omer, Weisman, Omri, Pikus, Dmitri
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US13/430,013
• Publication Number:
  US 20130007887A1
• Time in Patent Office: 988 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Detecting security vulnerabilities in web applications by interacting with a web application at a computer server during its execution at the computer server, identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server, evaluating the identified client-side instructions, and identifying a security vulnerability associated with the client-side instructions.

Claims

1. A method for detecting security vulnerabilities in web applications, the method comprising:

interacting with a web application at a computer server during its execution at the computer server;

identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server;

evaluating the client-side instructions, and

identifying a security vulnerability associated with the client-side instructions.

2. The method of claim 1 and further comprising identifying a security vulnerability associated with the web application.

3. The method of claim 1 where the evaluating step comprises performing static analysis of the client-side instructions to identify the security vulnerability associated with the client-side instructions.

4. The method of claim 1 where the evaluating step comprises performing dynamic taint analysis on the client-side instructions to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

5. The method of claim 4 and further comprising modifying the client-side instructions to store information indicating whether variables within the client-side instructions point to tainted objects, and

where the evaluating step comprises performing dynamic taint analysis on the modified client-side instructions to track taint propagation within the modified client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

6. The method of claim 4 where the evaluating step comprises using a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

7. The method of claim 4 where the evaluating step comprises performing dynamic taint analysis on the client-side instructions by calling an interpreter, that is configured to track any variable within the client-side instructions that directly points to a tainted object within the client-side instructions, to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

8. The method of claim 7 where the evaluating step comprises performing dynamic taint analysis where the interpreter is configured to track any variable that ultimately depends from any variable within the client-side instructions that directly points to a tainted object within the client-side instructions.

9. The method of claim 7 where the evaluating step comprises performing dynamic taint analysis where the interpreter is configured to use a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

10. The method of claim 4 and further comprising performing symbolic analysis of the client-side instructions to determine at least one value for at least one variable within the client-side instructions that would result in a control flow target being reached within the client-side instructions during execution of the client-side instructions,

where the evaluating step comprises using any value determined by the symbolic analyzer when performing the dynamic taint analysis on the client-side instructions to cause the target control flow.