Mining attack vectors for black-box security testing
View Patent ↗Black-box security testing for a Web application includes identifying infrastructure supporting the Web application, obtaining vulnerability data for the Web application from an external data source according to the infrastructure, deriving a test payload from the vulnerability data using a processor, and determining a type of vulnerability exploited by the test payload. An existing validation operation of a testing system is selected for validating a response from the Web application to the test payload according to the type of vulnerability.
1. A computer-implemented method of updating a testing system that performs vulnerability testing on a Web application, comprising:
identifying, for the Web application to be tested, infrastructure data characterizing an infrastructure of the Web application;
submitting, to an external data source unaffiliated with the testing system or the Web application and using the identified infrastructure data, a search request that specifies the infrastructure data;
receiving, from the external data source, search results derived from the infrastructure and including vulnerability data indicating recently discovered vulnerabilities to Web applications;
deriving, from the vulnerability data, a test payload;
updating a test sequence configured to test the Web application using the test payload derived from the vulnerability data; and
testing the Web Application using the updated test sequence.
2. The method of claim 1 , wherein
the vulnerability data is obtained from a plurality of external data sources.
3. The method of claim 1 , wherein
the infrastructure data is obtained by the testing system by querying the Web application and determining the infrastructure data based upon responses to the querying.
4. The method of claim 1 , wherein
the vulnerability data includes the test payload.
5. The method of claim 1 , wherein
the vulnerability data does not include the test payload, and
the test payload is built by the testing system using the vulnerability data.
6. The method of claim 5 , wherein
parameters within a preexisting payload within the testing system are modified to build the test payload.
7. The method of claim 1 , wherein
the updating is performed without manual intervention.
8. The method of claim 1 , wherein
a type of vulnerability exploited by the test payload is derived from the vulnerability data.
9. The method of claim 8 , wherein
a preexisting validation operation within the testing system is identified based upon the type of vulnerability, and
the test sequence is updated to include the validation operation.
10. The method of claim 8 , wherein
a validation operation within the testing system is not identified for the type of vulnerability, and
the testing system outputs a notification indicating that the validation operation for the type of vulnerability is not identified.