Black-box testing of web applications with client-side code evaluation

1. A method for detecting security vulnerabilities in web applications, the method comprising:

interacting with a web application at a computer server during its execution at the computer server;

identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server;

evaluating the client-side instructions, and

identifying a security vulnerability associated with the client-side instructions.

2. The method of claim 1 and further comprising identifying a security vulnerability associated with the web application.

3. The method of claim 1 where the evaluating step comprises performing static analysis of the client-side instructions to identify the security vulnerability associated with the client-side instructions.

4. The method of claim 1 where the evaluating step comprises performing dynamic taint analysis on the client-side instructions to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

5. The method of claim 4 and further comprising modifying the client-side instructions to store information indicating whether variables within the client-side instructions point to tainted objects, and

where the evaluating step comprises performing dynamic taint analysis on the modified client-side instructions to track taint propagation within the modified client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

6. The method of claim 4 where the evaluating step comprises using a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

7. The method of claim 4 where the evaluating step comprises performing dynamic taint analysis on the client-side instructions by calling an interpreter, that is configured to track any variable within the client-side instructions that directly points to a tainted object within the client-side instructions, to track taint propagation within the client-side instructions, thereby identifying the security vulnerability associated with the client-side instructions.

8. The method of claim 7 where the evaluating step comprises performing dynamic taint analysis where the interpreter is configured to track any variable that ultimately depends from any variable within the client-side instructions that directly points to a tainted object within the client-side instructions.

9. The method of claim 7 where the evaluating step comprises performing dynamic taint analysis where the interpreter is configured to use a predefined security specification to determine which objects within the client-side instructions are tainted and how taint propagates from variable to variable within the client-side instructions.

10. The method of claim 4 and further comprising performing symbolic analysis of the client-side instructions to determine at least one value for at least one variable within the client-side instructions that would result in a control flow target being reached within the client-side instructions during execution of the client-side instructions,

where the evaluating step comprises using any value determined by the symbolic analyzer when performing the dynamic taint analysis on the client-side instructions to cause the target control flow.