Optimizing test data payload selection for testing computer software applications via computer networks
View Patent ↗Testing a computer software application by configuring a first computer to execute a copy of data-checking software used by a computer software application at a second computer, processing a first copy of a test data payload using the data-checking software at the first computer, where the test data payload is configured to test for an associated security vulnerability, determining that the first copy of the test data payload is endorsed by the data-checking software at the first computer for further processing, and sending a second copy of the test data payload via a computer network to the computer software application at the second computer for processing threat.
1. A system for testing a computer software application, the system comprising a processor device and a memory coupled with the processor device, the processor device configured to implement:
a payload tester configured to provide, to a first computer, a copy of data-checking software from a second computer, the data-checking software used by a computer application at the second computer,
configure the first computer to execute the copy of data-checking software used by the computer software application at the second computer,
process a first copy of a test data payload using the data-checking software at the first computer, wherein the test data payload is configured to test for an associated security vulnerability, and
determine that the first copy of the test data payload is endorsed by the data-checking software at the first computer for further processing; and
an application tester configured to send a second copy of the test data payload via a computer network to the computer software application at the second computer for processing thereat.
2. The system according to claim 1 and further comprising an evaluator configured to identify the data-checking software used by the computer software application.
3. The system according to claim 2 wherein the data-checking software is any of a sanitizer and a validator.
4. The system according to claim 2 wherein the computer software application is instrumented to identify the data-checking software used by the computer software application.
5. The system according to claim 1 wherein the test data payload that is processed by the payload tester is stored at the first computer.
6. The system according to claim 1 wherein the test data payload includes a malicious payload designed to exploit the security vulnerability.
7. The system according to claim 1 wherein the payload tester is configured to determine that the first copy of the test data payload is configured to test for its associated security vulnerability after being processed by the data-checking software at the first computer.
8. The system according to claim 1 wherein the computer software application is a web application.
9. A computer program product for testing a computer software application, the computer program product comprising:
a non-transitory, computer-readable storage medium; and
computer-readable program code embodied in the computer-readable storage medium, wherein the computer-readable program code is configured to
provide, to a first computer, a copy of data-checking software from a second computer, the data-checking software used by a computer application at the second computer,
configure the first computer to execute the copy of data-checking software used by the computer software application at the second computer,
process a first copy of a test data payload using the data-checking software at the first computer, wherein the test data payload is configured to test for an associated security vulnerability,
determine that the first copy of the test data payload is endorsed by the data-checking software at the first computer for further processing, and
send a second copy of the test data payload via a computer network to the computer software application at the second computer for processing thereat.
10. The computer program product according to claim 9 wherein the computer-readable program code is configured to identify the data-checking software used by the computer software application.
11. The computer program product according to claim 10 wherein the data-checking software is any of a sanitizer and a validator.
12. The computer program product according to claim 10 wherein the computer software application is instrumented to identify the data-checking software used by the computer software application.
13. The computer program product according to claim 9 wherein the test data payload that is processed by the payload tester is stored at the first computer.
14. The computer program product according to claim 9 wherein the test data payload includes a malicious payload designed to exploit the security vulnerability.
15. The computer program product according to claim 9 wherein the computer-readable program code is configured to determine that the first copy of the test data payload is configured to test for its associated security vulnerability after being processed by the data-checking software at the first computer.
16. The computer program product according to claim 9 wherein the computer software application is a web application.