Systems and methods for automating blind detection of computational vulnerabilities
View Patent ↗Methods for blind detection of computational vulnerabilities include the submission by a detecting system of potentially interpretable information to a target system; measurement of the timing characteristics of the output from the target system by the detecting system; and diagnosis of the vulnerabilities of the target system by the detecting system as based on the timing characteristics, optionally in conjunction with auxiliary data. Invented systems provide reference implementations of these methods.
1. A method of detecting a vulnerability of a target system, comprising:
submitting, by a computer system, an innocuous input to the target system, the innocuous input designed to be a non-operation;
computing by the computer system a baseline latency, the baseline latency being a time difference between submitting the innocuous input and receiving a reply from the target system;
determining by the computer system a set of two or more programming languages, wherein at least one of the set of two or more programming languages is not SQL;
constructing by the computer system an input for each programming language in the set, the input consistent with an interpreter for each corresponding programming language, the input designed to increase latency before a corresponding output from the target system;
submitting by the computer system the input for each of the set of two or more programming languages to the target system;
recording by the computer system a first time at which each input is submitted to the target system;
recording by the computer system a second time at which each output from the target system is received;
computing by the computer system a blind latency, the blind latency being a time difference between the second time and the first time; and
determining by the computer system that the target system is vulnerable if the difference between the blind latency and the baseline latency exceeds a threshold.
2. The method of claim 1 , wherein the target system is an asynchronous system.
3. The method of claim 1 , wherein the target system is a synchronous system.
4. The method of claim 1 , wherein one of the programming languages in the set of two or more programming languages is SQL, and wherein the input constructed for SQL is consistent with an SQL interpreter for a web application.
5. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to break out of a numeric data type.
6. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to break out of a string data type.
7. The method of claim 4 , wherein the input constructed for SQL alters the end of a statement block.
8. The method of claim 4 , wherein the input constructed for SQL alters the middle of a statement block and comments out the rest of the block.
9. The method of claim 4 , wherein the input constructed for SQL alters a WHERE clause.
10. The method of claim 4 , wherein the input constructed for SQL alters a statement prior to a WHERE clause.
11. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to break out of a statement in a type agnostic manner.
12. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to break out of a statement through statement termination.
13. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to evade keyword filtering through hexadecimal encoding.
14. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to evade keyword filtering through null ASCII character injection.
15. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to evade null byte filters through ASCII control character injection.
16. The method of claim 4 , wherein the input constructed for SQL is configured to cause the SQL interpreter to break out of an email data type.
17. The method of claim 4 , wherein the SQL interpreter is associated with a MySQL database.
18. The method of claim 17 , wherein the input constructed for SQL is configured to cause the SQL interpreter to use either the logical OR operator or the logical AND operator of a WHERE clause.
19. A non-transitory computer-readable medium comprising computer executable instructions stored thereon to cause one or more processors to:
identify a set of two or more programming languages, wherein at least one of the set of two or more programming languages is not SQL;
identify a set of injection points;
submit an innocuous input to the target system, the innocuous input designed to be a non-operation;
compute a baseline latency, the baseline latency being a time difference between submitting the innocuous input and receiving a reply from the target system;
construct a set of inputs, the set of inputs comprising at least one input for a plurality of injection points selected from the set of injection points and consistent with an interpreter for each corresponding programming language from the set of programming languages, each of the set of inputs designed to increase latency before a corresponding output from the target system; and
for each input from the set of inputs:
submit the each input to the target system;
record a first time at which the each input is submitted to the target system;
record a second time at which the corresponding output from the target system is received;
compute a blind latency for the each input, the blind latency being a time difference between the second time and the first time; and
determine that the interpreter corresponding to the each input is vulnerable if the difference between the blind latency of the each input and the baseline latency exceeds a threshold.
20. A system configured to detect a vulnerability of a target system, comprising:
a memory; and
one or more processors, communicatively coupled to the memory, wherein the memory stores instructions to cause the one or more processors to:
submit an innocuous input to the target system, the innocuous input designed to be a non-operation;
compute a baseline latency, the baseline latency being a time difference between submitting the innocuous input and receiving a reply from the target system;
determining a set of two or more programming languages, wherein at least one of the set of two or more programming languages is not SQL;
construct an input for each programming language in the set, the input consistent with an interpreter for each corresponding programming language, the input designed to increase latency before a corresponding output from the target system;
submit each input to the target system;
record a first time at which each input is submitted to the target system;
record a second time at which each output from the target system is received;
compute a blind latency, the blind latency being a time difference between the second time and the first time; and
determine that the target system is vulnerable if the difference between the blind latency and the baseline latency exceeds a threshold.