Detecting stored cross-site scripting vulnerabilities in web applications

1. A method for detecting security vulnerabilities in web applications, the method comprising:

providing a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier;

detecting the identifier within the payload received during an interaction with the web application subsequent to the first interaction;

determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction; and

reporting that the web application is vulnerable to a stored cross-site scripting attack where the identifier is detected within the payload and where the payload instruction did not undergo a security check prior to the execution of the payload instruction.

2. The method of claim 1 and further comprising:

receiving an interaction-initiating instruction from the web application during a second interaction with the web application subsequent to the first interaction;

receiving the payload during a third interaction with the web application subsequent to the second interaction; and

executing the interaction-initiating instruction, thereby initiating the third interaction with the web application.

3. The method of claim 2 where

the executing step comprises executing an AJAX request.

4. The method of claim 1 where

the determining step comprises determining whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator.

5. The method of claim 1 where

the determining step comprises determining whether the payload instruction underwent the security check where the payload instruction is a predefined security-sensitive instruction.

6. The method of claim 5 where

the determining step comprises determining where the security-sensitive instruction is a DOM API command.

7. The method of claim 1 and further comprising

reporting that a vulnerability exists at an interface of the web application through which the payload was introduced.

8. The method of claim 1 and further comprising

reporting that a vulnerability exists at a location within the payload at which the payload instruction is found.

9. A method for detecting security vulnerabilities in web applications, the method comprising:

providing a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier;

receiving an interaction-initiating instruction from the web application during a second interaction with the web application subsequent to the first interaction;

receiving the payload during a third interaction with the web application subsequent to the second interaction;

executing the interaction-initiating instruction, thereby initiating the third interaction with the web application;

detecting the identifier within the payload received during the third interaction;

determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction; and

reporting that the web application is vulnerable to a stored cross-site scripting attack where the identifier is detected within the payload and where the payload instruction did not undergo a security check prior to the execution of the payload instruction.

10. The method of claim 9 where

the determining step comprises determining whether the payload instruction underwent the security check where the payload instruction is a predefined security-sensitive instruction.