Detecting vulnerabilities in web applications
First Claim
1. A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:
- determining, via one or more computing devices, one or more values associated with a web application that flow to response data associated with the web application, wherein the one or more values are modifiable by unreliable input, wherein the one or more values modifiable by the unreliable input that flow to the response data associated with the web application are determined via, at least in part, a server-side taint analysis algorithm;
determining whether there is a path reaching a statement that renders data to the response data;
marking a value of the one or more values flowing into the response data as untrusted in response to determining that there is a path reaching the statement that renders data to the response data;
generating, via the one or more computing devices, an abstract representation of the response data associated with the web application generated via, at least in part, a string analysis algorithm that approximates at least one of a string output of the response data associated with the web application with a context-free grammar and a logical formula; and
determining, via the one or more computing devices, one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, the abstract representation of the response data associated with the web application, and a taint analysis algorithm operating on the abstract representation of the response data.
2 Assignments
0 Petitions
Accused Products
Abstract
A method, computer program product, and system for detecting vulnerabilities in web applications is described. A method may comprise determining one or more values associated with a web application that flow to response data associated with the web application. The one or more values may be modifiable by unreliable input. The method may further comprise generating a representation of the response data associated with the web application. The method may additionally comprise determining one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.
10 Citations
14 Claims
-
1. A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:
-
determining, via one or more computing devices, one or more values associated with a web application that flow to response data associated with the web application, wherein the one or more values are modifiable by unreliable input, wherein the one or more values modifiable by the unreliable input that flow to the response data associated with the web application are determined via, at least in part, a server-side taint analysis algorithm; determining whether there is a path reaching a statement that renders data to the response data; marking a value of the one or more values flowing into the response data as untrusted in response to determining that there is a path reaching the statement that renders data to the response data; generating, via the one or more computing devices, an abstract representation of the response data associated with the web application generated via, at least in part, a string analysis algorithm that approximates at least one of a string output of the response data associated with the web application with a context-free grammar and a logical formula; and determining, via the one or more computing devices, one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, the abstract representation of the response data associated with the web application, and a taint analysis algorithm operating on the abstract representation of the response data. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A computing system comprising:
-
at least one processor; at least one memory architecture coupled with the at least one processor; a first software module executable by the at least one processor and the at least one memory architecture, wherein the first software module is configured to determine one or more values associated with a web application that flow to response data associated with the web application, wherein the one or more values are modifiable by unreliable input, wherein the one or more values modifiable by the unreliable input that flow to the response data associated with the web application are determined via, at least in part, a server-side taint analysis algorithm; wherein the first software module is further configured to determine whether there is a path reaching a statement that renders data to the response data, and further configured to mark a value of the one or more values flowing into the response data as untrusted in response to determining that there is a path reaching the statement that renders data to the response data; a second software module executable by the at least one processor and the at least one memory architecture, wherein the second software module is configured to generate an abstract representation of the response data associated with the web application generated via, at least in part, a string analysis algorithm that approximates at least one of a string output of the response data associated with the web application with a context-free grammar and a logical formula; and a third software module executable by the at least one processor and the at least one memory architecture, wherein the third software module is configured to determine one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, the abstract representation of the response data associated with the web application, and a taint analysis algorithm operating on the abstract representation of the response data. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
Specification