Scanning unexposed web applications for vulnerabilities
Disclosed herein are methods, systems, and processes for scanning unexposed web applications for security vulnerabilities. A web application executing on a client computing device is accessed and a determination is made that elements in a document object model (DOM) associated with the web application are completely loaded. A brute force operation is performed to identify unexposed actionable events associated with the elements in the DOM. The unexposed actionable events identified as part of performing the brute force operation are received from the client computing device, and the web application is scanned for security vulnerabilities based on the unexposed actionable events.
1. A computer-implemented method, comprising:
accessing a web application executing on a client computing device, wherein the web application loads elements of a document object model (DOM) at runtime from a virtual DOM;
determining, based on a DOM polling technique, that one or more elements in the DOM are completely loaded from the virtual DOM;
performing a brute force operation to identify at least one unexposed actionable event associated with each of the one or more elements in the DOM;
receiving, from the client computing device, the at least one unexposed actionable event identified as part of performing the brute force operation; and
scanning the web application for one or more security vulnerabilities based on the at least one unexposed actionable event.
2. The computer-implemented method of claim 1 , wherein
the web application is created using a first web application framework that utilizes the flail virtual DOM, and
the first web application framework does not expose actionable events associated with the one or more elements in the DOM of the web application by virtue of the one or more elements being generated at runtime from the virtual DOM.
3. The computer-implemented method of claim 2 , further comprising:
generating a first scanning package; and
transmitting the first scanning package that corresponds to the first web application framework to the web application.
4. The computer-implemented method of claim 3 , further comprising:
generating a second scanning package; and
transmitting the second scanning package that corresponds to another web application framework to the another web application.
5. The computer-implemented method of claim 2 , wherein
the brute force operation is based on a list of common actionable events associated with the first web application framework.
6. The computer-implemented method of claim 5 , wherein
the brute force operation identifies the at least one unexposed actionable event associated with each of the one or more elements in the DOM by skipping one or more unexposed actionable events not in the list of common actionable events associated with the first web application framework.
7. The computer-implemented method of claim 1 , wherein
scanning the web application for the one or more security vulnerabilities is based on analyzing a captured network request associated with the at least one unexposed actionable event.
8. A non-transitory computer readable storage medium comprising program instructions executable to:
access a web application executing on a client computing device, wherein the web application loads elements of a document object model (DOM) at runtime from a virtual DOM;
determine, based on a DOM polling technique, that one or more elements in the DOM are completely loaded from the virtual DOM;
perform a brute force operation to identify at least one unexposed actionable event associated with each of the one or more elements in the DOM;
receive, from the client computing device, the at least one unexposed actionable event identified as part of performing the brute force operation; and
scan the web application for one or more security vulnerabilities based on the at least one unexposed actionable event.
9. The non-transitory computer readable storage medium of claim 8 , wherein
the web application is created using a first web application framework that utilizes the Rail virtual DOM, and
the first web application framework does not expose actionable events associated with the one or more elements in the DOM of the web application by virtue of the one or more elements being generated at runtime from the virtual DOM.
10. The non-transitory computer readable storage medium of claim 9 , further comprising:
generating a first scanning package; and
transmitting the first scanning package that corresponds to the first web application framework to the web application.
11. The non-transitory computer readable storage medium of claim 10 , further comprising:
generating a second scanning package; and
transmitting the second scanning package that corresponds to another web application framework to the another web application.
12. The non-transitory computer readable storage medium of claim 9 , wherein
the brute force operation is based on a list of common actionable events associated with the first web application framework.
13. The non-transitory computer readable storage medium of claim 12 , wherein
the brute force operation identifies the at least one unexposed actionable event associated with each of the one or more elements in the DOM by skipping one or more unexposed actionable events not in the list of common actionable events associated with the first web application framework.
14. The non-transitory computer readable storage medium of claim 8 , wherein
scanning the web application for the one or more security vulnerabilities is based on analyzing a captured network request associated with the at least one unexposed actionable event.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
access a web application executing on a client computing device, wherein the web application loads elements of a document object model (DOM) at runtime from a virtual DOM;
determine, based on a DOM polling technique, that one or more elements in the DOM are completely loaded from the virtual DOM;
perform a brute force operation to identify at least one unexposed actionable event associated with each of the one or more elements in the DOM;
receive, from the client computing device, the at least one unexposed actionable event identified as part of performing the brute force operation; and
scan the web application for one or more security vulnerabilities based on the at least one unexposed actionable event.
16. The system of claim 15 , wherein
the web application is created using a first web application framework that utilizes the virtual DOM, and
the first web application framework does not expose actionable events associated with the one or more elements in the DOM of the web application by virtue of the one or more elements being generated at runtime from the virtual DOM.
17. The system of claim 16 , further comprising:
generating a first scanning package and transmitting the first scanning package that corresponds to the first web application framework to the web application; and
generating a second scanning package and transmitting the second scanning package that corresponds to another web application framework to the another web application.
18. The system of claim 16 , wherein
the brute force operation is based on a list of common actionable events associated with the first web application framework.
19. The system of claim 18 , wherein
the brute force operation identifies the at least one unexposed actionable event associated with each of the one or more elements in the DOM by skipping one or more unexposed actionable events not in the list of common actionable events associated with the first web application framework.
20. The system of claim 15 , wherein
scanning the web application for the one or more security vulnerabilities is based on analyzing a captured network request associated with the at least one unexposed actionable event.