Detecting stored cross-site scripting vulnerabilities in web applications

1. A system for detecting security vulnerabilities in web applications, the system comprising:

a black-box tester configured to provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier; and

a hardware processor including an execution engine configured to

detect the identifier within the payload received during an interaction with the web application subsequent to the first interaction, and

determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction, wherein

the black-box tester is configured to report that the web application is vulnerable to a stored cross-site scripting attack where the execution engine detects the identifier within the payload and determines that the payload instruction did not undergo a security check prior to the execution of the payload instruction.

2. The system of claim 1 where

the black-box tester is configured to report that a vulnerability exists at an interface of the web application through which the payload was introduced.

3. A system for detecting security vulnerabilities in web applications, the system comprising:

a black-box tester configured to

provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier,

receive an interaction-initiating instruction from the web application during a second interaction with the web application subsequent to the first interaction, and

receive the payload during a third interaction with the web application subsequent to the second interaction; and

a hardware processor including an execution engine configured to

execute the interaction-initiating instruction, thereby initiating the third interaction with the web application,

detect the identifier within the payload received during the third interaction, and

determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction, wherein

the black-box tester is configured to report that the web application is vulnerable to a stored cross-site scripting attack where the execution engine detects the identifier within the payload and determines that the payload instruction did not undergo a security check prior to the execution of the payload instruction.

4. A computer program product for detecting security vulnerabilities in web applications, the computer program product comprising:

a computer-readable storage device; and

computer-readable program code embodied in the computer-readable storage device, where the computer-readable program code is configured to:

provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier;

detect the identifier within the payload received during an interaction with the web application subsequent to the first interaction; and

determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction, wherein

the computer-readable program code is further configured to report that the web application is vulnerable to a stored cross-site scripting attack where the identifier is detected within the payload and where the payload instruction did not undergo a security check prior to the execution of the payload instruction, and

the computer-readable storage device does not consist of a transitory, propagating signal.

5. The computer program product of claim 4 wherein the computer-readable program code is further configured to:

receive an interaction-initiating instruction from the web application during a second interaction with the web application subsequent to the first interaction;

receive the payload during a third interaction with the web application subsequent to the second interaction; and

execute the interaction-initiating instruction, thereby initiating the third interaction with the web application.

6. The computer program product of claim 5 wherein

the computer-readable program code is further configured to execute an AJAX request as the interaction-initiating instruction.

7. The computer program product of claim 4 wherein

the computer-readable program code is further configured to determine whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator.

8. The computer program product of claim 4 wherein

the computer-readable program code is further configured to determine whether the payload instruction underwent the security check where the payload instruction is a predefined security-sensitive instruction.

9. The computer program product of claim 8 wherein

the computer-readable program code is further configured to determine whether the security-sensitive instruction is a DOM API command.

10. The computer program product of claim 4 wherein

the computer-readable program code is further configured to report that a vulnerability exists at an interface of the web application through which the payload was introduced.

11. The computer program product of claim 4 wherein

the computer-readable program code is further configured to report that a vulnerability exists at a location within the payload at which the payload instruction is found.