Automated security testing

Patent metadata

Field	Value
Publication number	US-9276952-B2
Application number	US-201114115648-A
Country	US
Kind code	B2
Filing date	May 31, 2011
Priority date	May 31, 2011
Publication date	Mar 1, 2016
Grant date	Mar 1, 2016

Abstract

A method of automated security testing includes recording a macro. The recorded macro is played and a web request is intercepted while playing the macro. The web request may be attacked and sent to a web server. A response from the web server based on the web request is received, and the response of the web server is processed to determine any vulnerabilities.

First claim

What is claimed is:

1. A system for automated security testing, comprising:
a processor that is adapted to execute stored instructions; and
a memory device that stores instructions, the memory device comprising processor-executable code, that when executed by the processor, is adapted to:
record a macro;
play the recorded macro while intercepting traffic from a web browser;
intercept a web request while playing the macro;
attack the web request;
send the web request to a web server;
receive a response from the web server based on the web request; and
process the response of the web server to determine any vulnerabilities.

2. The system recited in claim 1 , wherein the memory device comprises computer-executable code, that when executed by the processor, is adapted to process the response of the web server to determine any vulnerabilities by:
executing scripts in the response with the web browser;
hooking a document object model method to application code executed during the script execution; and
determining vulnerabilities based on the document object model method called during script execution as noted by the execution of the application code.

3. The system recited in claim 1 , wherein the memory device comprises computer-executable code that, when executed by the processor, is adapted to record a macro by recording a user's interactions with the web browser.

4. The system recited in claim 1 , wherein the memory device comprises computer-executable code, that when executed by the processor, is adapted to attack the web request during playback of the macro.

5. The system recited in claim 1 , wherein the memory device comprises computer-executable code, that when executed by the processor, is adapted to record a macro by:
including an element of a document object model in the macro; and
finding the element in the document object model after the document object model has been changed based on the element's location relative to the other elements in the document object model, a tag name, an element ID, an element name, or any combinations thereof.

6. A method for automated security testing, comprising:
recording a macro;
playing the recorded macro while a proxy server intercepts traffic from a web browser;
intercepting a web request while playing the macro;
attacking the web request;
sending the web request to a web server;
receiving a response from the web server based on the web request; and
processing the response of the web server to determine any vulnerabilities.

7. The method recited in claim 6 , wherein processing the response of the web server to determine any vulnerabilities comprises:
executing scripts in the response with the web browser;
hooking a document object model method to application code; and
determining vulnerabilities based on the document object model method called during script execution as noted by the execution of the application code.

8. The method recited in claim 6 , wherein attacking the web request comprises injecting malicious code into the web request.

9. The method recited in claim 6 , wherein recording a macro comprises defining an element for recording, the element being indicative of a logged out state, a logged in state, or a set of questions and answers.

10. The method recited in claim 6 , wherein recording a macro comprises recording an element of a web page using an event handler.

11. The method recited in claim 6 , wherein the web request is sent to the web server that is an original destination of the of the web request before it is intercepted.

12. The method recited in claim 6 , wherein attacking the web request includes a corresponding rule as to what constitutes a vulnerability.

13. A non-transitory, computer-readable medium, comprising code configured to direct a processor to:
record a macro;
play the recorded macro while intercepting traffic from a web browser;
intercept a web request while playing the macro;
attack the web request;
send the web request to a web server;
receive a response from the web server based on the web request; and
process the response of the web server to determine any vulnerabilities.

14. The non-transitory, computer-readable medium recited in claim 13 , comprising code configured to direct a processor to process the response of the Web server to determine any vulnerabilities by:
executing scripts in the response with the web browser;
hooking a document object model method to application code executed during the script execution; and
determining vulnerabilities based on the document object model method called during script execution as noted by the execution of the application code.

15. The non-transitory, computer-readable medium recited in claim 13 , comprising code configured to direct a processor to attack a web request by injecting malicious code into the web request.

Assignees

• Simpson Shawn Morgan
• Hamer Philip Edward
• Hewlett Packard Entpr Dev Lp

Inventors

• Simpson Shawn Morgan
• Hamer Philip Edward

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F11/36

  Prevention of errors by analysis, debugging or testing of software · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title