Automatic response culling for web application security scan spidering process
View Patent ↗A method of testing a web application, wherein a web application is a program that operates on a server and interacts with clients that access the program over a network, wherein further the web application accepts parameters that define results generated from the web application, the method comprising determining which web application uniform resource identifiers (URIs) are used to access various web applications on a system, determining if more than a threshold of the URIs are for a common web application, selecting a subset of less than all of the URIs for the common web application when the threshold is exceeded for that common web application, wherein the subset is selected at least in part independently of the order generated and performing a security scan on the selected subset.
1. A method of testing a web application, wherein the web application is a program that operates on a server and interacts with clients that access the program over a network, the method comprising:
identifying the web application, the web application being operable to accept parameters that define responses generated from the web application to the clients;
identifying references to the web application;
selecting a subset of less than all of the references to the web application, wherein selecting
the subset includes culling the identified references based on the parameters; and performing a security scan on the selected subset; and
wherein selecting the subset is based on a random or semi-random skipping of the references as presented in an original identified order.
2. The method of claim 1 , wherein selecting the subset further includes:
identifying requests that are directed to the web application;
identifying parameters being valid for each identified request;
determining the subset to be scanned based on the identified requests or the identified parameters; and
ignoring additional references to the web application when a number of the subset to be scanned reaches a threshold number.
3. The method of claim 1 , wherein the performing the security scan includes scanning the web application for vulnerabilities.
4. The method of claim 1 , wherein the performing the security scan on the selected subset further includes executing at least one electronic interaction with the web application.
5. The method of claim 4 , wherein the at least one electronic interaction includes sending client requests from a testing computer to the web application and evaluating web application responses.
6. The method of claim 1 , wherein the culling includes culling a variable number of references.
7. The method of claim 1 , wherein the culling includes culling the references to the web application when a number of the references is determined as being excessive.
8. The method of claim 1 , further comprising repeating the culling of the identified references until the selected subset is of a size or consistency determined to be useful for the security scanning.
9. A computing device for testing a web application, wherein the web application is a program that operates on a server and interacts with clients that access the program over a network, the computing device comprising:
a computer processor configured to read machine-readable instructions from a tangible, non-transitory computer-readable medium:
the machine-readable instructions comprising:
(a) program code for identifying the web application, the web application being operable to accept parameters that define responses generated from the web application to the clients;
(b) program code for identifying references to the web application;
(c) program code for selecting a subset of less than all of the references to the web application, wherein selecting the subset includes culling the identified references based on the parameters;
(d) program code for performing a security scan on the selected subset; and
wherein selecting the subset is based on a random or semi-random skipping of the references as presented in an original identified order.
10. The computing device of claim 9 , wherein selecting the subset further includes:
identifying requests that are directed to the web application;
identifying parameters being valid for each identified request;
determining the subset to be scanned based on the identified requests and/oror the identified parameters; and
ignoring additional references to the web application when a number of the subset to be scanned reaches a threshold number.
11. The computing device of claim 9 , wherein the performing the security scan includes scanning the web application for vulnerabilities.
12. The computing device of claim 9 , wherein the performing the security scan on the selected subset further includes executing at least one electronic interaction with the web application.
13. The computing device of claim 12 , wherein the at least one electronic interaction includes sending client requests from a testing computer to the web application and evaluating web application responses.
14. The computing device of claim 9 , wherein the culling includes culling a variable number of references.
15. The computing device of claim 9 , wherein the culling includes culling the references to the web application when a number of the references is determined as being excessive.
16. The computing device of claim 9 , further comprising repeating the culling of the identified references until the selected subset is of a size or consistency determined to be useful for the security scanning.