Automated login session extender for use in security analysis systems
View Patent ↗A web application security scanner (WASS) includes a login manager configured to perform an automated login to a web site. The automated login may be performed when the login manager detects that a login session has ended. The login manager is configured to determine credentials for the web site to allow the WASS to access the web site. The WASS may then use the credentials to continue scanning the web site. Thus, previously unscannable web pages may be accessed in the web site because of the automated login process.
1. A method for determining validity of a session state during a security scan of a web site, the method comprising:
generating a model for use in determining if a response for a session verification request indicates a session is valid or invalid, wherein the model includes a first set of comparison pages, the first set of comparison pages being determined using previous requests for the page during a valid session and a second set of comparison pages, the second set of comparison pages being determined using previous requests for the page during an invalid session;
sending the session verification request including credential information, wherein it is not known if the credential information is valid or invalid;
receiving a page for the web site in response to the request;
analyzing the page based on the model to determine a model page that yields a nearest match to the page; and
determining whether the credential information is associated with a valid or invalid session based on the model page determined.
2. The method of claim 1 , wherein analyzing the page comprises comparing the page to the first set of comparison pages and the second set of comparison pages to determine the model page in the first set or second set that yields a nearest match.
3. The method of claim 2 , further comprising:
if the nearest match is a model page in the first set, determining that the session is valid; and
if the nearest match is a model page in the second set, determining that the session is invalid.
4. The method of claim 1 , analyzing the page comprises using a fuzzy logic approach to determine the model page.
5. The method of claim 1 , wherein if the credential information is determined to be invalid, the method further comprising:
using the recorded events to determine credential information for the web site, the credential information useable to provide a valid session with the web site.
6. The method of claim 5 , wherein using the recorded events comprises:
causing an interface to send a second request for a login page of a web site;
receiving the login page in response to the second request for the login page of the web site;
causing the interface to send a third login request including login information for the web site, the third login request for logging into the web site; and
receiving a response for the third login request, the response including valid credential information, the valid credential information useable to establish a valid session with the web site.
7. The method of claim 6 , further comprising:
inserting login code into code for the login page, the login code including the recorded events and configured to cause the interface to replay one or more of the recorded events to cause the interface to send the second request to login to the web site.
8. The method of claim 7 , further comprising:
inserting response code into code for a second page for the response to the first request, the response code configured to cause the interface to send a fourth request including the credential information.
9. A system for managing session state during a security scan of a web site, the system comprising:
a web application security scanner configured to scan one or more pages for a web site; and
a login manager configured to determine if a session is valid during the scan, the login manager comprising:
a model for use in determining if a response for a session verification request indicates a session is valid or invalid, wherein the model includes a first set of comparison pages, the first set of comparison pages being determined using previous requests for the page during a valid session and a second set of comparison pages, the second set of comparison pages being determined using previous requests for the page during an invalid session;
a login checker configured to send the session verification request including credential information, wherein it is not known if the credential information is valid or invalid;
a response analyzer configured to:
receive a page for the web site in response to the request;
to analyze the page based on the model to determine a model page that yields a nearest match to the page; and
determine whether the credential information is associated with a valid or invalid session based on the model page determined;
a re-login manager configured to cause the web site to send valid credential information if the credential information is determined to be invalid.
10. The system of claim 9 , further comprising a client including an interface, wherein the re-login manager causes the interface to send a second request using a recorded sequence including login information to a server for the web site, wherein a response to the second request includes the valid credential information.
11. The system of claim 9 , wherein the web application security scanner is configured to continue the scan using the valid credential information.