Automated login framework for application security testing

1. A computer-implemented method, comprising:

accessing a web application executing on a computing device;

injecting an automated login framework (ALF) into an onload event of a web browser associated with the web application;

accessing the ALF with a credential associated with the web application;

identifying a login page of the web application by matching one or more links or one or more buttons with a user-defined regular expression (regex) and a user-defined wordlist;

detecting a login form in the login page by executing a signature technique, a dictionary technique, and a multistep signature technique;

populating the login form using the credential;

submitting the login form for authentication; and

receiving a status with a confidence score indicating whether authentication of the credential was successful or failed.

2. The computer-implemented method of claim 1 , further comprising:

determining that one or more elements in a document object model (DOM) associated with the web application are completely loaded as part of the onload event.

3. The computer-implemented method of claim 1 , wherein

the signature technique comprises findoneTextAndOnePassFields, findPasswordAndPreceedingTextFiled, and findMultiStepOneEmailAndNoPassFields.

4. The computer-implemented method of claim 1 , wherein

the dictionary technique comprises findFieldsByClass, findFieldsByID, and findFieldsByName.

5. The computer-implemented method of claim 1 , further comprising:

scanning the web application for one or more security vulnerabilities if the authentication is successful; and

ranking the one or more security vulnerabilities for remediation based on a confidence score associated with the authentication.

6. The computer-implemented method of claim 2 , wherein

the web application is built with a framework that creates a Shadow DOM, and the Shadow DOM is a hidden presentation of the DOM that exists entirely in runtime.

7. The computer-implemented method of claim 5 , wherein

the confidence score is based on a plurality of factors comprising at least:

a login form displayed after factor,

a login form removed factor,

a login link displayed after factor,

a login link removed factor,

a logout link displayed after factor, and

a regex matching factor.

8. The computer-implemented method of claim 5 , further comprising:

determining that successful authentication of the credential increases scan coverage of a web application scanner that is used to scan the web application for the one or more security vulnerabilities.

9. The computer-implemented method of claim 8 , wherein

the successful authentication increases scan converge for a class of authentication-dependent web applications, and

the class of authentication-dependent web applications depend on the credential being successfully validated prior to being scanned by the web application scanner so that the web application scanner gains further granular access to the web application by virtue of the successful authentication.

10. A non-transitory computer readable storage medium comprising program instructions executable to:

access a web application executing on a computing device;

inject an automated login framework (ALF) into an onload event of a web browser associated with the web application;

access the ALF with a credential associated with the web application;

identify a login page of the web application by matching one or more links or one or more buttons with a user-defined regular expression (regex) and a user-defined wordlist;

detect a login form in the login page by executing a signature technique, a dictionary technique, and a multistep signature technique;

populate the login form using the credential;

submit the login form for authentication; and

receive a status with a confidence score indicating whether authentication of the credential was successful or failed.

11. The non-transitory computer readable storage medium of claim 10 , wherein

the signature technique comprises findoneTextAndOnePassFields, findPasswordAndPreceedingTextFiled, and findMultiStepOneEmailAndNoPassFields, and

the dictionary technique comprises findFieldsByClass, findFieldsByID, and findFieldsByName.

12. The non-transitory computer readable storage medium of claim 10 , further comprising:

determining that one or more elements in a document object model (DOM) associated with the web application are completely loaded as part of the onload event,

determining that successful authentication of the credential increases scan coverage of a web application scanner that is used to scan the web application for the one or more security vulnerabilities;

scanning the web application for the one or more security vulnerabilities if the authentication is successful; and

ranking the one or more security vulnerabilities for remediation based on a confidence score associated with the authentication.

13. The non-transitory computer readable storage medium of claim 12 , wherein

the web application is built with a framework that creates a Shadow DOM,

the Shadow DOM is a hidden presentation of the DOM that exists entirely in runtime,

the successful authentication increases scan converge for a class of authentication-dependent web applications, and

the class of authentication-dependent web applications depend on the credential being successfully validated prior to being scanned by the web application scanner so that the web application scanner gains further granular access to the web application by virtue of the successful authentication.

14. The non-transitory computer readable storage medium of claim 12 , wherein

the confidence score is based on a plurality of factors comprising at least:

a login form displayed after factor,

a login form removed factor,

a login link displayed after factor,

a login link removed factor,

a logout link displayed after factor, and

a regex matching factor.

15. A system comprising:

one or more processors; and

a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:

access a web application executing on a computing device;

inject an automated login framework (ALF) into an onload event of a web browser associated with the web application;

access the ALF with a credential associated with the web application;

identify a login page of the web application by matching one or more links or one or more buttons with a user-defined regular expression (regex) and a user-defined wordlist;

detect a login form in the login page by executing a signature technique, a dictionary technique, and a multistep signature technique;

populate the login form using the credential;

submit the login form for authentication; and

receive a status with a confidence score indicating whether authentication of the credential was successful or failed.

16. The system of claim 15 , wherein

the signature technique comprises findoneTextAndOnePassFields, findPasswordAndPreceedingTextFiled, and findMultiStepOneEmailAndNoPassFields, and

the dictionary technique comprises findFieldsByClass, findFieldsByID, and findFieldsByName.

17. The system of claim 15 , further comprising:

determining that one or more elements in a document object model (DOM) associated with the web application are completely loaded as part of the onload event,

determining that successful authentication of the credential increases scan coverage of a web application scanner that is used to scan the web application for the one or more security vulnerabilities;

scanning the web application for the one or more security vulnerabilities if the authentication is successful; and

ranking the one or more security vulnerabilities for remediation based on a confidence score associated with the authentication.

18. The system of claim 17 , wherein

the web application is built with a framework that creates a Shadow DOM,

the Shadow DOM is a hidden presentation of the DOM that exists entirely in runtime,

the successful authentication increases scan converge for a class of authentication-dependent web applications, and

the class of authentication-dependent web applications depend on the credential being successfully validated prior to being scanned by the web application scanner so that the web application scanner gains further granular access to the web application by virtue of the successful authentication.

19. The system of claim 17 , wherein

the confidence score is based on a plurality of factors comprising at least:

a login form displayed after factor,

a login form removed factor,

a login link displayed after factor,

a login link removed factor,

a logout link displayed after factor, and

a regex matching factor.