Detecting stored cross-site scripting vulnerabilities in web applications
View Patent ↗A system for detecting security vulnerabilities in web applications, the system including, a black-box tester configured to provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier, and an execution engine configured to detect the identifier within the payload received during an interaction with the web application subsequent to the first interaction, and determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.
1. A method for detecting security vulnerability in a web application, comprising:
providing, to the web application and during a first interaction with the web application on a computer server, a payload including payload instruction and an identifier distinct from the payload instruction;
detecting, within the payload received during an interaction with the web application subsequent to the first interaction, the identifier; and
determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.
2. The method of claim 1 , further comprising:
reporting, upon the determining that the payload instruction did not undergo a security check prior to the execution of the payload instruction, that the web application is vulnerable to a stored cross-site scripting attacking.
3. The method of claim 2 , wherein
the reporting indicates an interface of the web application through which the payload was introduced.
4. The method of claim 2 , wherein
the reporting indicates a location within the payload at which the payload instruction is found.
5. The method of claim 1 , further comprising:
receiving, subsequent to the first interaction, an interaction-initiating instruction from the web application during a second interaction with the web application;
receiving, during a third interaction with the web application subsequent to the second interaction, the payload; and
initiating the third interaction with the web application by executing the interaction-initiating instruction.
6. The method of claim 5 , wherein
the interaction-initiating instruction is an AJAX request.
7. The method of claim 1 , wherein
the determining includes determining whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator.
8. The method of claim 1 , wherein
the payload instruction is a predefined security-sensitive instruction.
9. The method of claim 8 , wherein
the security-sensitive instruction is a DOM API command.
10. The method of claim 1 , wherein
the payload instruction is computer-executable instructions and
the identifier is a unique alphanumeric identifier.