Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
2001-03-05
2003-06-24
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C709S241000, C709S203000, C709S219000, C709S225000, C714S037000, C714S038110, C714S039000, C714S047300
Reexamination Certificate
active
06584569
ABSTRACT:
COPYRIGHT NOTICE
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
1. Field of Invention
The invention generally relates to the art of detecting security flaws with a web site, and in particular, to detecting vulnerabilities at the application level, as opposed to the network level.
2. Background of Invention
It is often quite important to ensure that a web site or web application is secure from attack or perversion by hackers. In order to assist in this endeavor, network scanning tools exist which provide security management capabilities for network host computers or servers. One example of such a scanner is the Internet Scanner™ marketed by Internet Security Systems, Inc. of Atlanta, Ga., which product appears to be described in U.S. Pat. No. 5,892,903 to Klaus.
The shortcoming with network security products such as the Internet Scanner™ is that they only scan for vulnerabilities at the network level. The goal is to limit access to a web site to only designated protocols and services. To analogize, network-level security products can be thought of as a fence that forces access to the site only through a main gate, and network-level scanners seek to find the holes in the fence.
However, there also exists a need to ensure that a web site or web application is secure at the application level. Many web applications assume or depend that the application user is in fact executing a mobile agent of the application on the user's browser. However, a malicious user can overcome or modify the limitations or logic embedded in the mobile agent and send destructive or forged data to the web server. For example, one common type of web application is an online storefront wherein goods and services can be bought or sold over the Internet. A hacker should not be able to change the sale price of a product by manipulating the HTTP requests sent to the application program executing on a web server. A need therefore exists for an application-level scanner to identify application-level vulnerabilities. In other words, carrying on with the previous analogy, once the user is inside the gate it is important to identify ways in which the user may misbehave while on the premises.
Application level vulnerabilities have traditionally been discovered in a manner similar to looking for bugs in software—through a quality assurance or auditing process. Conventionally, this has been a completely manual process that can devour a significant amount of time. Not only does someone have to review the application line-by-line and understand the code intimately, they also have to try to imagine or anticipate potential security loopholes in the code. This is problematic in and of itself because many web developers lack the expertise and requisite knowledge to properly evaluate and correct application-level security flaws. This, coupled with the ever prevalent speed to market concern of getting new web applications on-line as fast as possible, makes human error in web development unavoidable. Worse yet, web applications are constantly changing and being upgraded while third party vendors are continually issuing patches that need to be implemented. In short, manual auditing processes to find application-level vulnerabilities are not very practical.
SUMMARY OF INVENTION
The invention seeks to provide a scanner for automatically detecting potential application-level vulnerabilities or security flaws in a web application. In the web environment, generally speaking, the application scanner analyzes the messages that flow (or would ordinarily flow) between a client browser and a server hosting the web application in order to discover the structure or elements of the application's interface with external clients. Then, based on a pre-defined set of hacking rules or techniques, the scanner mutates client requests in various ways, thereby generating exploits that will be unique for each web application. These exploits may then be used to attack the web application. The attack is monitored and the results evaluated and reported to the user.
According to one aspect of the invention a method is provided for detecting security vulnerabilities with an application implemented through a client-server architecture. The method comprises actuating the application in order to discover one or more application-level elements of the application's client-server interface; attacking the application by sending one or more client requests to the server in which the discovered elements have been mutated in accordance with pre-defined mutation rules; receiving server responses to the mutated requests and evaluating the responses in order to identify anomalous application activity.
According to another aspect of the invention a method is provided for detecting security vulnerabilities in a HTML-based web application installed on a web server or web application server. The method includes: traversing the application in order to discover and actuate links therein; analyzing messages that flow or would flow between an authorized client and the web server in order to discover elements of the application's interface with external clients and attributes of these elements; generating unauthorized client requests in which these elements are mutated; sending the mutated client requests to the server; receiving server responses to the unauthorized client requests and evaluating the results thereof.
According to another aspect of the invention, a scanner is provided for detecting security vulnerabilities in a HTML-based web application installed on a web server or web application server. The scanner includes a crawling engine, an analysis engine, and an attack engine. The crawling engine traverses through the application in an automatic, manual, or interactive way in order to discover application links. The attack engine analyzes the messages that flow or would flow between an authorized client and the web server. The analysis is carried out in order to discover elements of the application's interface with external clients and attributes of these elements. Based on this information unauthorized client requests are generated in which the application interface elements are mutated. The attack engine sends the mutated client requests to the server; receives server responses to the unauthorized client requests and evaluates the results thereof.
REFERENCES:
patent: 5166977 (1992-11-01), Ross
patent: 5237693 (1993-08-01), Kiyohara et al.
patent: 5257369 (1993-10-01), Skeen et al.
patent: 5347578 (1994-09-01), Duxbury
patent: 5392390 (1995-02-01), Crozier
patent: 5485409 (1996-01-01), Gupta et al.
patent: 5557798 (1996-09-01), Skeen et al.
patent: 5559800 (1996-09-01), Mousseau et al.
patent: 5566326 (1996-10-01), Hirsch et al.
patent: 5611048 (1997-03-01), Jacobs et al.
patent: 5623601 (1997-04-01), Vu
patent: 5659547 (1997-08-01), Scarr et al.
patent: 5673322 (1997-09-01), Pepe et al.
patent: 5699518 (1997-12-01), Held et al.
patent: 5701451 (1997-12-01), Rogers et al.
patent: 5715453 (1998-02-01), Stewart
patent: 5724355 (1998-03-01), Bruno et al.
patent: 5774695 (1998-06-01), Autrey et al.
patent: 5778189 (1998-07-01), Kimura et al.
patent: 5793966 (1998-08-01), Amstein et al.
patent: 5805823 (1998-09-01), Seitz
patent: 5812763 (1998-09-01), Teng
patent: 5828893 (1998-10-01), Wied et al.
patent: 5850388 (1998-12-01), Anderson et al.
patent: 5870544 (1999-02-01), Curtis
patent: 5870559 (1999-02-01), Leshem et al.
patent: 5881232 (1999-03-01), Cheng et al.
patent: 5892900 (1999-04-01), Ginter et al.
patent: 5892903 (1999-04-01), Klus
patent: 5908469 (1999-06-01), Botz et al.
patent: 5910987 (1999-06-01), Ginter et al.
patent: 5915019 (1999-06-01), Ginter et al.
patent: 5917912 (1999-06-01), Ginter et al.
patent: 5933498 (19
El-Hanany Yuval
Raanan Gil
Reshef Eran
Tsarfati Tom
Arani Taghi T.
Brown & Raysman Millstein Felder & Steiner LLP
Hayes Gail
Sanctum Ltd.
LandOfFree
System for determining web application vulnerabilities does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System for determining web application vulnerabilities, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System for determining web application vulnerabilities will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3148632