Systems, methods, and computer-readable media for executing a web application scan service

1. A method for executing a web application scan of an application, comprising:

executing a telemetry interception and analysis platform (TIAP) runtime in connection with the application, wherein the application is being executed by one or more processors operating behind a firewall that prevents the TIAP runtime from receiving direct communications from a TIAP portal being executed by one or more processors operating in front of the firewall, and wherein executing the TIAP runtime comprises:

intercepting a web service event being executed by the application, wherein the web service event comprises registration information, a universal resource identifier (URI), and authorization credentials; and

transmitting the web service event to the TIAP portal; and

executing the TIAP portal comprises:

creating a web application scan in response to receiving the web service event by the TIAP portal;

configuring the TIAP portal to be receptive to receive events obtained by the TIAP portal by accepting a new inbound connection from the TIAP runtime;

configuring the web application scan with the registration information, the URI, and the authorization credentials;

performing the web application scan after the web application scan has been configured and after the TIAP portal has been configured to receive events obtained by the TIAP runtime during execution of the web application scan;

receiving events obtained by the TIAP runtime during execution of the web application scan;

generating a scan report based on the received events obtained by the TIAP runtime during execution of the web application scan;

ceasing the web application scan; and

terminating the new inbound connection from the TIAP runtime.

2. The method of claim 1 , wherein the web application scan uses a plug-in web application scanner.

3. The method of claim 2 , wherein the plug-in web application scanner is a Dynamic Application Security Testing (DAST) scanner.

4. The method of claim 1 , wherein the web application scan uses a subscription as a service web application scanner.

5. The method of claim 1 , wherein configuring the web application scan further comprises using an authorization proxy to include the authorization credentials with the URI.

6. The method of claim 1 , wherein executing the TIAP portal further comprises accessing a proxy service to apply the web application scan to the application, wherein the proxy service serves as a first virtual application service endpoint for handling scanning requests being implemented by the web application scan, and wherein the TIAP runtime accesses a second virtual application service endpoint for receiving scanning request transmitted by the web application scan.

7. The method of claim 1 , wherein executing the TIAP runtime further comprises:

intercepting telemetry data during execution of a scanning request transmitted by the web application scan; and

transmitting the intercepted telemetry data to the TIAP portal via the new inbound connection from the TIAP runtime.

8. A method for executing a web application scan of an application, comprising:

initiating a web application scan of the application comprising:

accepting, via a proxy service, a new inbound connection from a telemetry interception and analysis platform (TIAP) runtime that is operating in conjunction with the application, wherein the new inbound connection transitions to a bi-directional proxy connection after the new inbound connection is verified;

accessing a web scanner and an authorization proxy to implement a plurality of scan request instances, wherein each scan request instance of the plurality of scan request instances comprises a universal resource identifier (URI) and an optional authorization credential;

passing each scan request instance of the plurality of scan request instances to the proxy service via the bi-directional proxy connection, wherein the proxy service enables each scan request instance of the plurality of scan request instances to be applied to the application, and wherein the application provides a scan response when the scan request instance of the plurality of scan request instances is processed;

receiving the scan response via the bi-directional proxy connection; and

generating, via the web scanner, a scan report based on an analysis of scan responses.

9. The method of claim 8 , further comprising:

providing the web scanner with a list of URIs to be evaluated, wherein at least one URI in the list of URIs is derived from the TIAP runtime.

10. The method of claim 8 , further comprising:

providing the authorization proxy with authorization credentials, wherein at least one authorization credential of the authorization credentials is derived from the TIAP runtime.

11. The method of claim 8 , wherein the web scanner is a plug-in web scanner or a third party subscription as a service (SaaS) web scanner.

12. The method of claim 8 , wherein the web scanner and the authorization proxy operate under control of a passive scan agent.

13. The method of claim 8 , further comprising:

receiving, via an event service, a web service event being executed by the application, wherein the web service event comprises registration information, a universal resource identifier (URI), and authorization credentials.

14. The method of claim 8 , wherein the bi-directional proxy connection is established prior to said passing each scan request instance of the plurality of scan request instances to the proxy service.

15. The method of claim 8 , further comprising:

terminating the new inbound connection.

16. The method of claim 8 , further comprising:

monitoring, via the web scanner, received web scan telemetry, wherein the received web scan telemetry includes data identifying web scan requests used to provoke the application to generate data that is captured as the received web scan telemetry.

17. A method for executing a web application scan of an application, comprising:

executing a telemetry interception and analysis platform (TIAP) runtime that is operating in conjunction with the application, said executing further comprising:

receiving, via a proxy, a web application scan request to scan the application;

intercepting a scan response during execution of the web application scan request;

establishing a transmit only connection with a TIAP portal;

transmitting the intercepted scan response to the TIAP portal;

discovering a universal resource indicator (URI) being accessed by the application;

obtaining an authorization token related to the URI; and

transmitting the URI and the authorization token to the TIAP portal.