Automated login session extender for use in security analysis systems
View Patent ↗A web application security scanner (WASS) includes a login manager configured to perform an automated login to a web site. The automated login may be performed when the login manager detects that a login session has ended. The login manager is configured to determine credentials for the web site to allow the WASS to access the web site. The WASS may then use the credentials to continue scanning the web site. Thus, previously unscannable web pages may be accessed in the web site because of the automated login process.
1. A method for managing session state during a security scan of the web site, the method comprising:
under the control of one or more computer systems configured with executable instructions,
analyzing a first page received in response to a first request for the first page of the web site that includes executable instructions to determine if a session is valid; and
when the session is not valid:
determining login information for the web site;
causing an interface to send a second request for a login page of the web site;
receiving the login page in response to the second request for the login page of the web site;
causing the interface to send a third request including the login information for the web site, the request for logging into the web site; and
receiving a response for the third request, the response including credential information, the credential information useable to establish a valid session with the web site.
2. The method of claim 1 , further comprising:
storing the credentials;
resending the first request using the credentials; and
receiving a second page in response to the request, the second page reflecting the valid session.
3. The method of claim 1 , wherein receiving the login page in response to the second request further comprises inserting login code into code for the login page, the login code configured to cause the interface to enter the login information for the login page and configured to cause the interface to send the third request.
4. The method of claim 1 , wherein analyzing the first page comprises:
determining a first set of comparison pages, the first set of comparison pages being determined using previous requests for the first page during a valid session;
determining a second set of comparison pages, the second set of comparison pages being determined using previous requests for the first page during an invalid session; and
analyzing the first page based on the first set of comparison pages and the second set of comparison pages to determine a page in the first set or second set that yields a nearest match.
5. The method of claim 4 , further comprising:
if the nearest match is a page in the first set, determining that the session is valid; and
if the nearest match is a page in the second set, determining that the session is invalid.
6. The method of claim 1 , further comprising recording a sequence of events between the interface and the web site in order to determine the login information, wherein the sequence of events are used to cause the interface to send the third request.
7. The method of claim 6 , wherein the sequence of events are recorded using client-side code being run at a client displaying the interface.