Security testing framework including virtualized server-side platform
A web application security testing framework includes a HTTP browser engine replaying recorded sessions to identify candidate traces indicative of attack. A mutation engine changes values in the attack candidate traces to generate additional traces posed against a virtualized server-side platform. The virtualized server-side platform creates snapshots of application state for testing, avoiding permanent damage to application persistence. The virtualized server-side platform includes persistence monitoring sensors (e.g., at connectors to the database or file system) for detecting vulnerability classes including Cross-Site Request Forgery (CSRF) and SQL injection attacks. For remote command execution attack detection, a server-side vulnerability validation interface records strings passed to code generating application program interfaces (APIs). For possible Cross-Site Scripting (XSS) attacks, the mutation engine may detect HTTP responses for examination of generated web code, and the HTTP browser may be extended to include a vulnerability validation API that is automatically called by successfully injected attack payloads.
1. A computer-implemented method comprising:
receiving, by a server hosting a web application, a trace comprising a first value provided by a browser component;
storing the trace in an in-memory database;
creating, by the server, a snapshot of a virtualized state of the web application at a time of receiving the trace;
generating a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sensing, by the in-memory database engine at the server, a change in persistence resulting from the mutant trace; and
in response to the sensing, the server communicating the mutant trace to a test engine for identification of a security vulnerability.
2. A method as in claim 1 wherein the sensing occurs at a file system.
3. A method as in claim 1 wherein:
the sensing occurs at the in-memory database; and
the security vulnerability comprises a cross-site request forgery (CSRF) vulnerability.
4. A method as in claim 1 wherein:
the sensing occurs at the in-memory database; and
the security vulnerability comprises a SQL injection vulnerability.
5. A method as in claim 1 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API).
6. A method as in claim 5 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.
7. A method as in claim 1 wherein:
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.
8. A method as in claim 7 further comprising:
generating, by the server, a response to the mutant trace; and
communicating, by the server, the response to the in-memory database engine.
9. A method as in claim 7 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API) residing on the browser component.
10. A method as in claim 1 wherein the in-memory database engine is further configured to perform a selection function.
11. A method as in claim 1 wherein the in-memory database engine is further configured to perform a filtering function.
12. A non-transitory computer readable storage medium embodying a computer program for performing a method, said method comprising:
receiving, by a server hosting a web application, a trace comprising a first value provided by a browser component;
storing the trace in an in-memory database;
creating, by the server, a snapshot of a virtualized state of the web application at a time of receiving the trace;
generating a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sensing, by the in-memory database at the server, a change in persistence in a database resulting from the mutant trace; and
communicating, by the server, in response to the sensing, the mutant trace to a test engine for identification of a security vulnerability.
13. A non-transitory computer readable storage medium as in claim 12 wherein:
the sensing comprises detecting injection of a payload of the mutant trace; and
the method further comprises issuing, by the payload, a call to an application program interface (API).
14. A non-transitory computer readable storage medium as in claim 13 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.
15. A non-transitory computer readable storage medium as in claim 12 wherein:
the issuing comprises issuing the call to the API residing on the browser component; and
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.
16. A non-transitory computer readable storage medium as in claim 12 wherein the security vulnerability comprises a cross-site request forgery (CSRF) or a SQL injection.
17. A computer system comprising:
one or more processors;
a software program, executable on said computer system, the software program configured to cause a server hosting a web application to:
receive a trace comprising a first value provided by a browser component;
store the trace in an in-memory database;
create a snapshot of a virtualized state of the web application at a time of receiving the trace;
generate a mutant trace having the first value changed to a second value by an in-memory database engine of the in-memory database;
sense by the in-memory database a change in persistence resulting from the mutant trace, the change in persistence comprising injecting a payload of the mutant trace, the payload issuing a call to an application program interface (API); and
communicate, in response to the sensing, the mutant trace to a test engine for identification of a security vulnerability.
18. A computer system as in claim 17 wherein:
the issuing comprises issuing the call to the API residing on the server; and
the security vulnerability comprises a remote command execution vulnerability.
19. A computer system as in claim 17 wherein:
the issuing comprises issuing the call to the API residing on a browser component; and
the security vulnerability comprises a cross-site scripting (XSS) vulnerability.
20. A computer system as in claim 17 wherein the software program is configured to further cause the server to:
generate a response to the trace; and
communicate the response to the in-memory database engine.