Using fuzzy classification models to perform matching operations in a web application security scanner
View Patent ↗A system provides for fuzzy classification in comparisons of scanner responses. A web application test suite performs tests against a web application by sending client requests from a testing computer to the server running the web application and checking how the web application responds. A thorough web application security scan might involve thousands of checks and responses. As a result, some sort of programmatic analysis is needed. One such evaluation involves comparing one response against another. Response matching that compares two HTTP responses might use fuzzy classification processes.
1. A method of testing a web application, the method comprising:
communicating a first target request to the web application, the first target request being directed at the web application and being a request to be tested;
receiving a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
identifying parameters from the web application while logged in as a user;
communicating a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
receiving a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
comparing the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process; and
determining whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
2. The method of claim 1 , wherein comparing the first target response to the second target response comprises using a fuzzy classification process.
3. The method of claim 1 , wherein the first target request includes a multi-level path having a first number of levels, and the second target request includes a path having a second number of levels less than the first number of levels.
4. The method of claim 3 , further comprising:
communicating a third target request to the web application; and
receiving a third target response in response to the third target request,
wherein the third target request includes a path having a third number of levels that is less than the first number of levels and greater than the second number of levels.
5. The method of claim 1 , wherein the first target request and the second target requests are queries as to whether a session is valid.
6. The method of claim 5 , wherein the second target request is communicated to the web application immediately after logging in.
7. The method of claim 5 , wherein the second target request is modified before being communicated to the web application, the modified second target request is communicated to the web application, and the second target response is received in response to the modified second target request.
8. The method of claim 1 , wherein the second target request includes one or more of the identified parameters, and the first target request includes one or more modified parameters.
9. A system for testing a web application, the system comprising:
a storage element; and
a processor configured to:
communicate a first target request to a web application, the first target request being directed at the web application and being a request to be tested;
receive a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
identify parameters from the web application while logged in as a user;
communicate a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
receive a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
compare the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process; and
determine whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
10. The system of claim 9 , wherein the first target request is for a resource that should not be made available to the user, and the second target request is known to generate a response indicating that the resource is not available.
11. The system of claim 9 , wherein the processor is further configured to determine whether or not the first target response is a hypertext transport protocol (HTTP) class 400 response.
12. The system of claim 9 , wherein the processor is further configured to determine whether or not the first target response and the second target responses are HTTP class 300 responses or class 200 responses.
13. The system of claim 12 , wherein the processor is further configured to perform additional processing based on the HTTP class of the first target response and the second target response.
14. A non-transitory computer-readable medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus having stored thereon instructions configured to test a web application, comprising:
program code for communicating a first target request to a web application, the first target request being directed at the web application and being a request to be tested;
program code for identifying parameters from the web application while logged in as a user;
program code for receiving a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource;
program code for communicating a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response;
program code for receiving a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application;
program code for comparing the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process; and
program code for determining whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.
15. The non-transitory computer-readable medium of claim 14 , further comprising program code for logging in to the web application as a first user and a second user, and identifying parameters for each of the first user and the second user associated with the web application.
16. The non-transitory computer-readable medium of claim 15 , wherein the second target request is communicated while logged in as the first user and includes one or more parameters for the first user, and the first target request is communicated while logged in as the first user and includes one or more parameters for the second user.
17. The non-transitory computer-readable medium of claim 16 , further comprising program code for generating a flag if the first target response is different from the second target response, the flag indicative of a request for further processing.