Determining terms for security test
Example embodiments disclosed herein relate to determining terms for a security test. Terms associated with an application under test are determined. The terms are filtered with words in a dictionary to generate a filtered set or wordlist. The set or wordlist is used for input to the application under test for the security test.
1. A non-transitory machine-readable storage medium storing instructions that, when executed by at least one processor of a device, cause the device to:
tokenize a page of an application under test (AUT) to generate tokens;
distinguish between content tokens and markup tokens;
determine a set of terms from the content tokens for a security test;
generate respective hashes of the set of terms;
filter the set of terms based on a comparison of the respective hashes of the set of terms with hashes of terms in a dictionary to generate a filtered set of terms, the filtered set of terms including terms that are not in the dictionary; and
use the filtered set of terms to generate input to the AUT for the security test.
2. The non-transitory machine-readable storage medium of claim 1 , further comprising instructions that, when executed by the at least one processor, cause the device to:
generate a further token based on at least one term of the filtered set of terms; and
use the further token as an input to an authentication input field or an authorization input field of the AUT during the security test.
3. The non-transitory machine-readable storage medium of claim 2 , wherein the generating of the further token comprises modifying the at least one term to produce the further token.
4. The non-transitory machine-readable storage medium of claim 1 , further comprising instructions that, when executed by the at least one processor, cause the device to:
generate a further token based on at least one term of the filtered set of terms; and
use the further token as an input to a user identifier field or a password field of the AUT during the security test.
5. The non-transitory machine-readable storage medium of claim 1 , further comprising instructions that, when executed by the at least one processor, cause the device to:
generate a target list based on the filtered set of terms and the dictionary; and
sort the target list, wherein tokens of the target list are used as the input to the AUT.
6. The non-transitory machine-readable storage medium of claim 5 , wherein the target list further includes a set of words to be used as authentication for one or more devices.
7. The non-transitory machine-readable storage medium of claim 1 , further comprising instructions that, when executed by the at least one processor, cause the device to:
load traffic comprising the page from a database of a previous scan of the AUT.
8. The non-transitory machine-readable storage medium of claim 1 , wherein the terms of the filtered set of terms are unique with respect to the terms in the dictionary.
9. The non-transitory machine-readable storage medium of claim 1 , wherein a term in the dictionary is excluded from the filtered set of terms based on the comparison.
10. A computing device comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
tokenize a page of an application under test (AUT) to generate tokens;
distinguish between content tokens and markup tokens;
determine a set of terms from the content tokens for a security test;
generate respective hashes of the set of terms;
filter the set of terms based on a comparison of the respective hashes of the set of terms with hashes of terms in a dictionary to generate a filtered set of terms, the filtered set of terms excluding the terms in the dictionary;
use the filtered set of terms as input to the AUT during the security test.
11. The computing device of claim 10 , wherein the instructions are executable on the processor to filter out terms from the set of terms that are not unique compared to the dictionary.
12. The computing device of claim 10 , wherein the instructions are executable on the processor further to:
generate a further token based on at least one term of the filtered set of terms; and
use the further token as an input to a user identifier field or a password field of the AUT during the security test.
13. The computing device of claim 10 , wherein the instructions are executable on the processor further to:
generate a further token based on at least one term of the filtered set of terms; and
use the further token as an input to an authentication input field or an authorization input field of the AUT during the security test.
14. The computing device of claim 13 , wherein the generating of the further token comprises modifying the at least one term to produce the further token.
15. A method performed by a system comprising a hardware processor, comprising:
tokenizing a page of an application under test (AUT) to generate tokens;
distinguishing between content tokens and markup tokens;
determining a set of terms from the content tokens;
generating respective hashes of the set of terms;
filtering the set of terms based on a comparison of the respective hashes of the set of terms with hashes of terms in a dictionary database of common words to generate a filtered set of terms, the filtered set of terms including terms that are unique with respect to the terms in the dictionary database of common words; and
using the filtered set of terms as input to the AUT for a security test against at least one of authentication and authorization controls of the AUT.
16. The method of claim 15 , further comprising:
generating a further token based on at least one term of the filtered set of terms; and
using the further token as an input to a user identifier field or a password field of the AUT during the security test.