Identifying Vulnerabilities in Cathedral-Based Cross-Site Writing

Abstract

A method for checking a web-based application for security vulnerabilities, wherein the method comprises: transmitting at least one client request containing payload with a unique identifier to the web-based application; receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application; using a processor: identifying content corresponding to the payload in the DOM object via the unique identifier; generating a DOM abstraction from the DOM object, wherein the DOM abstraction includes a section of the DOM object containing the content corresponding to the payload and excluding sections of the DOM object from the DOM abstraction that do not contain content corresponding to the payload; outputting the HTML response using the DOM abstraction instead of the DOM object;When the HTML response is output, perform a static security analysis on the HTML response to monitor script code associated with the HTML to determine if at least one access to the DOM abstraction retrieves content corresponding to the payload; and if the access to the DOM abstraction retrieves content corresponding to the payload, generate a flag indicating that a vulnerability exists in the web-based application.

Description

BACKGROUND

[0001] One or more embodiments disclosed in this specification relate to the detection of vulnerabilities for Document Object Model (DOM) based cross-site scripting.

[0002] With the advent of internet-based technologies, web applications are becoming increasingly sophisticated. As these technologies become more sophisticated, they also become vulnerable to attacks by unscrupulous users accessing these web-based applications (hereinafter referred to as "web applications"). These attacks are notoriously difficult to detect, especially when a user provides malicious payload data to a web application's server, for example, in a user request. The web application can be particularly vulnerable if it uses a response form, such as an HTML response form, that is instantiated using dynamic values, such as request parameters, provided by a user.

[0003] To explain, during a cross-site scripting (XSS) attack, a user request may contain malicious payloads that include HTML containing JavaScript. TMThe webpage's code is not expected, and this HTML can be returned to the web application's DOM at runtime. Subsequent clients cannot distinguish the HTML returned in the DOM from other parts of the DOM. This HTML can alter how the web application handles subsequent user requests, and this, in turn, can change how the web application responds to those requests. For example, malicious payload can cause an unwanted response to be rendered in an HTML DOM response served by the web application to a client-side application, such as a web browser. BRIEF SUMMARY

[0004] One or more embodiments disclosed in this specification relate to vulnerabilities for DOM-based cross-site scripting.

[0005] One embodiment may include a method for checking a web-based application for security vulnerabilities. The method may involve transmitting at least one client request, containing payload data with a unique identifier, to the web-based application. The method may also involve receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application. A processor can identify content within the DOM object corresponding to the payload data using the unique identifier. Furthermore, a portion of the DOM object containing the payload data can be identified as untrusted.

[0006] Another embodiment may include a method for checking a web-based application for security vulnerabilities. The method may involve transmitting at least one client request, containing payload data with a unique identifier, to the web-based application. The method may also involve receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application. A processor can identify content corresponding to the payload data within the DOM object using the unique identifier. A DOM abstraction can be generated from the DOM object. The DOM abstraction can include a section of the DOM object containing content corresponding to the payload data, and sections of the DOM object that do not contain content corresponding to the payload data can be excluded from the DOM abstraction.The HTML response can be rendered using the DOM abstraction instead of the DOM object. When the HTML response is rendered, a static security analysis can be performed on it to monitor script code associated with the HTML. This analysis will determine if at least one access to the DOM abstraction retrieves content corresponding to the payload. If the access to the DOM abstraction does retrieve content corresponding to the payload, a flag indicating the presence of a vulnerability in the web-based application can be generated.

[0007] Another embodiment may include a computer program product for checking a web-based application for security vulnerabilities. The computer program product may include a computer-readable storage medium with computer-readable program code embodied thereon, configured to perform the various operations and / or functions disclosed in this specification.

[0008] Another embodiment may include a system containing a computer-readable storage medium with computer-readable program code embodied on it, configured to perform the various operations and / or functions described in this specification.

[0009] In another aspect, the invention relates to a system comprising: a computer-readable storage medium with computer-readable program code embodied thereon; and a processor connected to the computer-readable storage medium. In response to the execution of the computer-readable program code, the processor is configured to perform executable operations comprising: transmitting at least one client request containing payload data with a unique identifier to the web-based application; receiving an HTML response and an associated document object model (DOM) object from the web-based application; using the processor to identify content corresponding to the payload data in the DOM object via the unique identifier; and identifying a portion of the DOM object containing the payload data as untrusted.

[0010] According to embodiments, executable operations further include: generating a DOM abstraction from the DOM object, wherein the DOM abstraction contains a section of the DOM object that includes the content corresponding to the payload; and outputting the HTML response using the DOM abstraction instead of the DOM object.

[0011] According to embodiments, generating the DOM abstraction from the DOM object involves: excluding sections of the DOM object from the DOM abstraction that do not contain the content corresponding to the payload.

[0012] According to embodiments, the executable steps further include: outputting the HTML response; performing a static security analysis on the HTML response to monitor HTML-associated script code that is executed to determine whether at least one access to the DOM abstraction retrieves the content corresponding to the payload; and, if the access to the DOM abstraction retrieves the content corresponding to the payload, generating a flag indicating that a vulnerability exists in the web-based application.

[0013] According to embodiments, performing the static security analysis on the HTML response to monitor HTML-related script code, which is executed to determine whether at least one access to the DOM abstraction retrieves the content corresponding to the payload, involves: identifying a pop-up dialog containing the payload content.

[0014] According to embodiments, the executable steps further include: receiving a list containing a plurality of payload data. Transmitting at least one client request, which includes the payload data with the unique identifier, to the web-based application includes: automatically transmitting a plurality of client requests to the web-based application, each of the client requests containing corresponding payload data selected from the list containing the plurality of payload data.

[0015] According to embodiments, the user data with the unique identifier contains content that is returned by the web-based application to a DOM of a website.

[0016] In another aspect, the invention relates to a computer program product for checking a web-based application for security vulnerabilities. The computer program product features: a computer-readable storage medium containing computer-readable program code, wherein the computer-readable program code comprises: computer-readable program code configured to transmit at least one client request, containing payload data with a unique identifier, to the web-based application; Computer-readable program code configured to receive an HTML response and an associated Document Object Model (DOM) object from the web-based application; computer-readable program code configured to identify content corresponding to the payload in the DOM object via the unique identifier; and Computer-readable program code that is configured to identify a section of the DOM object containing the payload as untrusted.

[0017] According to embodiments, the computer-readable program code further includes: computer-readable program code configured to perform a static security analysis on the HTML response when the HTML response is issued, to monitor HTML-associated script code that is executed to determine whether at least one access to the DOM abstraction retrieves the content corresponding to the payload; and computer-readable program code configured to generate a flag indicating that a vulnerability exists in the web-based application when accessing the DOM abstraction to retrieve content corresponding to the payload.

[0018] According to embodiments, performing the static security analysis on the HTML response to monitor HTML-associated script code that is executed to determine whether at least one access to the DOM abstraction retrieves the content corresponding to the payload includes: identifying a pop-up dialog containing the payload content.

[0019] According to embodiments, the computer-readable program code further comprises: computer-readable program code configured to receive a list containing a variety of payload data. The transmission of at least one client request, containing the payload data with a unique identifier, to the web-based application includes: Automatic transmission of a multitude of client requests to the web-based application, each of the client requests containing corresponding payload data selected from the list of multiple payload data.

[0020] According to embodiments, the user data with the unique identifier contains content that is returned by the web-based application to a DOM of a website. BRIEF DESCRIPTION OF THE MULTIPLE DRAWING VIEWS

[0021] Fig. Figure 1 is a block diagram illustrating a system for detecting a vulnerability for DOM-based cross-site scripting according to an embodiment of the present invention.

[0022] Fig. Figure 2 is a flowchart illustrating a method for detecting a vulnerability for DOM-based cross-site scripting according to an embodiment of the present invention.

[0023] Fig. Figure 3 is a block diagram illustrating a system for detecting a vulnerability for DOM-based cross-site scripting according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] As is clear to those skilled in the art, aspects of the present invention can be embodied as a system, method, or computer program product. Accordingly, aspects of the present invention can take the form of a purely hardware embodiment, a purely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may herein be generally referred to as a “circuit,” “module,” or “system.” Furthermore, aspects of the present invention can take the form of a computer program product embodied in one or more computer-readable media comprising computer-readable program code embodied therein.

[0025] Any combination of one or more computer-readable media can be used. The computer-readable medium can be a computer-readable signaling medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or unit, or any suitable combination of the foregoing, but is not limited to these.More specific examples (a non-exhaustive list) of computer-readable storage media would include: an electrical connection with one or more wires, a portable computer disk, a hard disk drive (HDD), a solid-state drive (SSD), random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only storage device (CD-ROM), a digital versatile disc (DVD), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, computer-readable storage media can be any physical medium capable of containing or storing a program for use by or in conjunction with a system, device, or unit for executing instructions.

[0026] A computer-readable signal medium can contain a disseminated data signal with a computer-readable program code embodied therein, for example, in the baseband or as part of a carrier wave. Such a disseminated signal can take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium that is not a computer-readable storage medium and that can communicate, disseminate, or transport a program for use by or in conjunction with a system, device, or unit for command execution.

[0027] Program code embodied on a computer-readable medium can be transmitted using any suitable medium, including wireless, wired, fiber optic, RF media, or any suitable combination thereof, but not limited to these. Computer program code for performing operations for aspects of the present invention can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java. TMSmalltalk, C++, or similar languages, and traditional procedural programming languages ​​such as C or similar programming languages. The program code can run only on a user's computer, partially on a user's computer as a standalone software package, partially on a user's computer and partially on a remote computer, or only on the remote computer or server. In the last scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (e.g., via the internet using an internet service provider).

[0028] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the invention. It is clear that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a specialized computer, or another programmable data processing device to form a machine such that instructions executed via the processor of the computer or other programmable data processing device generate means for implementing the functions / actions specified in the block or blocks of the flowchart and / or block diagram.

[0029] These computer program instructions may also be stored in a computer-readable medium capable of instructing a computer, other programmable data processing device, or other unit to operate in a particular manner, such that the instructions stored in the computer-readable medium produce a manufactured item, including instructions that implement the function / action specified in the block(s) of the flow chart and / or block diagram.

[0030] Die Computerprogrammbefehle können außerdem in einen Computer, andere programmierbare Datenverarbeitungseinrichtungen oder andere Einheiten geladen werden, um eine Reihe von Operationsschritten zu bewirken, die auf dem Computer, der anderen programmierbaren Datenverarbeitungsvorrichtung oder anderen Einheiten ausgeführt werden sollen, um einen auf einem Computer implizierten Prozess zu erzeugen, so dass die Befehle, die auf dem Computer oder der anderen programmierbaren Vorrichtung ausgeführt werden, Prozesse zum Umsetzen der Funktionen / Handlungen, die in dem Block oder Blöcken des Ablaufplans und / oder Blockschaubilds spezifiziert sind, bereitstellen.

[0031] The present invention relates to a methodology that enables history tracking, which involves the use of a Document Object Model (DOM) element by JavaScript code, allowing DOM-based XSS attacks to be detected efficiently and accurately. A security scanner can selectively send multiple payloads to a web-based application (hereinafter referred to as "web application") to attempt to identify vulnerabilities in the web application. The term "payload" as used here refers to script code provided in a client request to a web application.

[0032] All user data can contain a unique identifier that could be reflected in a website DOM object if the website were vulnerable to that user data. If the web application subsequently executes client-side script code such as JavaScript... TMWhen script code is delivered to a client, the client-side script code can be executed in an isolated data processing environment known as a "sandbox." If, during the execution of the script code, there is an indication that user data has been used in a vulnerability-inducing manner, the security scanner can generate a notification that a vulnerability exists in the script code. Accordingly, web application developers can assess the vulnerability and modify the web application to implement protective measures.

[0033] Fig. 1 is a block diagram that represents a system 100 illustrated for detecting vulnerabilities in DOM-based cross-site scripting according to an embodiment of the present invention. The system 100 can a server 110 included. The server 110This can be a processing system or a suitably configured unit, e.g., via the execution of an operating system on the server to run at least one web application. 112 to host. The web application can host one or more web pages. 114 included. The server 110 It can also host one or more additional web applications (not shown). The term "web application" as used here means an application accessed via a network such as the internet or an intranet. The term "web page" as used here means a document or information resource available for access via a network such as the internet or an intranet and accessible through a client application such as a web browser.

[0034] The system can also have a client 120 included. The client 120In one embodiment, it can be a processing system or a unit that is used for data exchange with the server. 110 For example, it is connected via one or more data processing networks or via one or more input / output (I / O) ports. Therefore, the client can 120 It must be configured to run an operating system and one or more client-side applications. The client-side applications can include a security scanner. 122 and a DOM-modeling component 124 , which is described in more detail here. In another embodiment, the security scanner can 122 and the DOM-modeling component 124 on the server 110 be operated.

[0035] Regardless of where the security scanner is located 122 and the DOM-modeling component 124If these components are located in a secure environment, they can be run in a sandbox. A sandbox provides a tightly controlled group of resources for running guest programs, such as a security scanner. 122 and the DOM-modeling component 124 Ready. A sandbox can provide a workspace in memory for such execution. Within a sandbox, network access, the ability to inspect the host system, or to read input units are usually blocked or severely restricted to operations solely for performing analysis and / or testing. In this sense, the sandbox is a specific example of virtualization.

[0036] To prevent a DOM-based cross-site scripting (XSS) attack against the website 114 To simulate, the security scanner can 122 to be operated to fulfill one or more client requests 130 automatically to the web application112 to send. Every client request 130 may potentially contain multiple user data 132 included. The usage data 132 may contain code that can be read by the security scanner 122 was generated or retrieved to check for vulnerabilities in the web application 112 They may be present. For example, user data may be present. 132 Script included, such as JavaScript TM and / or ActionScript TM , which is intended to contain certain content of the user data 132 into the DOM of the website 114 to be returned within the specified time period.

[0037] If the client request 130 (and thus the user data) 132 ) through the web application 112 is processed, and when the web application 112 on the user data 132 If vulnerable, the user data can be returned to the website's DOM. 132They may contain a unique identifier that can later be recognized to detect a vulnerability in the website. 114 to enable. An example of user data 132 is: where `document.cookie` contains a unique identifier. This user data can be sent to the web application. 112 be transmitted by the client request 130 sent via the following URL: where “www.some.site” is the web application 112 is the one that is being analyzed.

[0038] The original script code in the web application 112 (e.g. on the website) 114 The default parameter cannot be expected to contain HTML markup, and therefore it can simply return the HTML to the web page's DOM at runtime. If the HTML markup is passed to the web application under other circumstances... 112 would be transmitted (e.g., not during the current security analysis) if an HTML response134 from the web application 112 A client-side application can be received. 112 , such as a web browser, output the resulting page and execute the script:

[0039] Running such a script could result in unwanted information being presented by the client-side application.

[0040] This is just one example of user data. 132 , which belong to the web application 112 can be transferred. As noted, the security scanner can 122 multiple user data 132 transferred to the web application, effectively checking the web application for multiple potential vulnerabilities. In one embodiment, one or more lists of user data can be transmitted. 132 provided to and received by the security scanner, and the security scanner 122 can further meet client requirements130 send until all user data is complete 132 to the web application 112 were transferred.

[0041] In response to the client request(s) 130 can send an HTML response 134 , the accessed website 114 corresponds to, and an associated DOM object 136 from the web application 112 to the client 120 will be transferred. If the web application 112 based on the example usage data shown above 132 If the object is vulnerable, it can be a document.location object within the DOM object. 136 contain the following string:

[0042] The client 120 can be configured appropriately to output the HTML response 134 with the DOM object to the DOM-modeling component 124 to direct. The HTML response 134 It does not need to contain the attacker's payload. The payload can instead be stored at runtime on the client. 120will be manifested when the script that generates the HTML response 134 is associated with, is executed. Continuing the example above, if a faulty script accesses the DOM using a variable `document.location`, the script itself may assume it is not harmful. However, the analysis presented here can identify such a harmful variable.

[0043] The DOM-modeling component 124 can be used to receive the HTML response 134 and to create a DOM abstraction 126 be configured so that it is generated in such a way that it matches the DOM object 136 corresponds to the DOM-modeling component. 124 In particular, the DOM object 136 scan for cases where the content of user data 132 to the web application 112 was delivered. The DOM-modeling component 124can identify these cases of payload content based on the unique identifiers provided for the payload, which are located in the relevant sections of the DOM object. 136 be reflected.

[0044] If content that corresponds to the content of the user data 132 corresponds to the DOM object 136 The DOM structure, in which the content of the user data is located, can be found. 132 is found in the DOM abstraction 126 be preserved. Furthermore, the content of the user data can be preserved. 132 in the DOM abstraction 126 This can be specified as an untrusted DOM value. The payload content can, for example, be highlighted, displayed with a specific color or font, or comments can be added to the DOM abstraction. 126 must be included to contain the user data 132to identify. One reason why the user data content is flagged as untrusted is that it contains script code (e.g., JavaScript). TM -code) this area in the DOM object can be passed to retrieve the DOM value in a potentially unprotected manner if the payload remains unidentified. Other DOM areas that do not contain untrusted DOM values ​​(e.g., no payload content) 132 (contained), can safely be ignored and therefore do not need to be included in the DOM abstraction. 126 It should be included.

[0045] Therefore, DOM abstraction can 126 only a small part of the original DOM object 136 included, which enables DOM abstraction 126 What remains is a small, easy-to-handle file.

[0046] After the DOM abstraction 126 The security scanner can detect when it was generated. 122Perform a static analysis on the HTML, using DOM abstraction. 126 instead of the DOM object 136 is used, which allows the HTML to be effectively modeled. In this context, the security scanner can be used. 122 A client-side application for outputting HTML, such as a web browser, may be included or accessed within the sandbox. When the HTML is output within the sandbox, the associated script code can be monitored to determine if there are any accesses to the DOM abstraction. 126 Retrieve one or more untrusted values. The security scanner 122 This could, for example, be a pop-up dialog containing the user data. 132 It contains, monitors, and identifies. If an untrusted value is identified, the security scanner can 122Generate a flag indicating that a vulnerability has been identified. The flag can be the unique identifier of the corresponding user data. 132 Specify that contain content corresponding to the untrusted value.

[0047] To illustrate this, continuing the example above, we can identify those accesses where an object `document.location.href` is read. Furthermore, the variable assigned to the evaluation of the following expression can be identified as having a defect:

[0048] The result of the following combination operation is therefore also flawed:

[0049] Because of the linking processes in the security-sensitive operation document.write(), the security scanner 122Generate a flag indicating that a vulnerability has been detected. It should be noted that the same behavior could be reported in a case where a complex and rare condition controls the execution of `document.write()`, since static analysis can handle the condition in a conventional manner and follow both execution branches.

[0050] At this point, it should subsequently be noted that the fact that the DOM abstraction 126 Keeping the file size small has several implications for the static analysis described above. Firstly, from a performance and scalability standpoint, the analysis benefits from only having to process a small portion of the original DOM object. 136 can model and draw conclusions from this. This analysis can be compared to a case where the DOM object 136The entire DOM is represented in the abstraction to make the analysis orders of magnitude more efficient and scalable. Secondly, the analysis can be both completely error-free and highly accurate. The error-free nature of the analysis stems from the preservation of DOM substructures that lead to potential vulnerabilities, and the improved accuracy results from the fact that the analysis does not analyze every single element of the DOM object. 136 The system must interpret the read value, thereby reducing the risk of DOM substructures being incorrectly identified as potential vulnerabilities.

[0051] Fig. 2 is a schedule that outlines a procedure 200 to illustrate the detection of vulnerabilities for DOM-based cross-site scripting according to an embodiment of the present invention. In step 202At least one client request containing payload data with a unique identifier can be transmitted to a web-based application. If a vulnerability exists in the web-based application, the content of the payload data can be returned by the web-based application to a DOM of the website.

[0052] In step 204 An HTML response and an associated Document Object Model (DOM) object can be received from the web-based application. In this step 206 Content that corresponds to the user data in the DOM object can be identified via the unique identifier. In the step 208 A DOM abstraction can be created from the DOM object. The DOM abstraction can contain one or more sections of the DOM object that contain the content corresponding to the payload, and can exclude sections of the DOM object that do not contain content corresponding to the payload.

[0053] In step 210 The HTML response can be output using the DOM abstraction instead of the DOM object. When the HTML response is output, in the next step... 212 A static security analysis can be performed on the HTML response to monitor executed script code associated with the HTML, in order to determine if at least one access to the DOM abstraction retrieves the content corresponding to the payload. If the access to the DOM abstraction retrieves the content corresponding to the payload, the next step can be performed. 214 A flag will be generated indicating that a vulnerability exists in the web-based application.

[0054] Fig. 3 is a block diagram that represents a system 300 to detect vulnerabilities for DOM-based cross-site scripting according to an embodiment of the present invention. The system can, for example, be the client 120be, who in relation to Fig. 1 was described. The system 300 can at least one processor 305 included, which is provided by a bus system 315 with storage elements 310 is connected. Therefore, the system can 300 Program code in the memory elements 310 save. The processor 305 can execute the program code that consists of the memory elements 310 via the system bus 315 is retrieved. In one aspect, for example, the system can 300 It can be implemented as a computer suitable for storing and / or executing program code. However, it should be acknowledged that the system 300 can be implemented in the form of any system that has a processor and memory capable of performing the functions described in this specification.

[0055] The storage elements 310can be one or more physical storage units, such as local storage. 320 and one or more mass storage units 325 included. A local storage 320 This refers to random-access memory or other non-persistent storage units that are generally used during the actual execution of program code. The mass storage unit(s) 325 They can be implemented as a hard disk drive (HDD), solid-state drive (SSD), or other permanent data storage unit. The system 300 It may also contain one or more cache memories (not shown) that provide temporary storage of at least part of the program code to reduce the number of times program code has to be read from the mass storage device during execution. 325 must be retrieved.

[0056] Input / output (I / O) units such as a keyboard 330, an advertisement 335 and a pointing unit (not shown) can optionally be used with the system 300 The I / O units can be connected to the system either directly or via intermediate I / O control units. 300 Be connected. Network adapter 340 can also be used with the system 300 be connected so that the system 300 It can be connected to other systems, computer systems, remote printers and / or remote storage devices via interposed private or public networks. The network adapter(s) 340 can, for example, enable the system 300 with the server 110 from Fig. 1 is connected. Modems, cable modems, and Ethernet cards are examples of different types of network adapters used in the system. 300 can be used.

[0057] As in Fig. The storage elements can be shown in 1. 110a security scanner 122 and a DOM-modeling component 124 , which were described previously. The security scanner 122 and the DOM-modeling component 124 , which are embodied in the form of executable program code, can be processed by the system 300 be operated (e.g. via the processor) 305 ) to execute the procedures, processes and functions described here.

[0058] In one embodiment, the security scanner 122 and the DOM-modeling component 124 using IBM ® Rational ® AppScan ® be implemented (where IBM, Rational and AppScan are trademarks of International Business Machines Corporation in the USA and / or other countries).

[0059] The same numbers were used to denote identical elements throughout the specification. The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this context, each block in the flowchart or block diagrams can represent a module, segment, or section of code that includes one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions specified in the block may not occur in the order shown in the figures.For example, two blocks shown sequentially may actually be executed essentially simultaneously, or the blocks may occasionally be executed in reverse order depending on the functionality involved. It is also noted that each block in the block diagrams and / or flowchart representation, and combinations of blocks in the block diagrams and / or flowchart representation, can be implemented by systems supported by special hardware that perform the specified functions or actions, or by combinations of special hardware and computer instructions.

[0060] The terminology used herein serves solely to describe certain embodiments and is not intended to limit the invention. The singular forms "a" and "the" are intended to include the plural forms unless expressly stated otherwise in the context. It is further understood that the expressions "has" and / or "have" when used in this description specify the presence of the stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0061] It is intended that the corresponding structures, materials, actions, and correspondences of all means or steps, plus functional elements, in the following claims include each structure, material, or action for performing the function in combination with other claimed elements in the specifically claimed manner. The description of the present invention has been presented for illustrative and descriptive purposes; however, it is not intended to be exhaustive or limiting for the invention as described. Many modifications and variations will be clear to a person skilled in the art without deviating from the scope and inventive concept of the invention.The embodiment was selected and described to best explain the basic ideas of the invention and its practical applications, and to enable other skilled persons to understand the invention with regard to various embodiments with numerous modifications suitable for the intended specific use.

Claims

[1] Method for checking a web-based application for security vulnerabilities, wherein the method comprises: Transmit at least one client request containing payload data with a unique identifier to the web-based application; Receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application; Using a processor, identify content that corresponds to the user data in the DOM object via the unique identifier; and Identifying a section of the DOM object containing the payload as untrusted. [2] Method according to claim 1, further comprising: Creating a DOM abstraction from the DOM object, wherein the DOM abstraction contains a section of the DOM object that includes the content corresponding to the payload; Outputting the HTML response using the DOM abstraction instead of the DOM object. [3] Method according to claim 2, wherein generating the DOM abstraction from the DOM object comprises: Excluding sections of the DOM object from the DOM abstraction that do not contain content corresponding to the payload. [4] Method according to one of claims 2 or 3, further comprising: When the HTML response is output, perform a static security analysis on the HTML response to monitor script code associated with the HTML that is executed to determine if at least one access to the DOM abstraction retrieves the content corresponding to the payload; and If the access to the DOM abstraction retrieves content that corresponds to the payload, a flag is generated indicating that a vulnerability exists in the web-based application. [5] Method according to claim 4, wherein performing the static security analysis on the HTML response to monitor script code belonging to HTML that is executed to determine whether at least one access to the DOM abstraction retrieves content corresponding to the payload: Identifying a pop-up dialog containing the content of the user data. [6] Method according to any one of claims 1 to 5, further comprising: Receiving a list containing a large amount of user data; where the transmission of at least one client request containing the payload with the unique identifier to the web-based application includes: Automatic transmission of a multitude of client requests to the web-based application, each of the client requests containing corresponding payload data selected from the list of multiple payload data. [7] Method according to any one of claims 1 to 6, wherein the user data with the unique identifier includes content which is returned by the web-based application to a DOM of a website. [8] Method for checking a web-based application for security vulnerabilities, wherein the method comprises: Transmit at least one client request containing payload data with a unique identifier to the web-based application; Receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application; Using a processor, identify content that corresponds to the user data in the DOM object via the unique identifier; Creating a DOM abstraction from the DOM object, wherein the DOM abstraction contains a section of the DOM object that includes content corresponding to the payload, and excluding sections of the DOM object from the DOM abstraction that do not contain content corresponding to the payload; Output the HTML response using the DOM abstraction instead of the DOM object; When the HTML response is output, perform a static security analysis on the HTML response to monitor script code associated with the HTML that is executed to determine if at least one access to the DOM abstraction retrieves content that matches the payload; and If the access to the DOM abstraction retrieves content that corresponds to the payload, a flag is generated indicating that a vulnerability exists in the web-based application. [9] Method according to claim 8, wherein performing the static security analysis on the HTML response to monitor script code associated with the HTML that is executed to determine whether at least one access to the DOM abstraction retrieves content that corresponds to the payload, comprises: Identifying a pop-up dialog that displays the content of the user data. [10] Method according to claim 8 or 9, further comprising: Receiving a list containing a large amount of user data; where the transmission of at least one client request containing the payload with the unique identifier to the web-based application includes: Automatic transmission of a multitude of client requests to the web-based application, each of the client requests containing corresponding payload data selected from the list of multiple payload data. [11] Method according to one of claims 8 to 10, wherein the user data with the unique identifier includes content which is returned by the web-based application to a DOM of a website. [12] System, comprising: a computer-readable storage medium containing computer-readable program code embodied on it; a processor connected to the computer-readable storage medium, wherein, in response to the execution of the computer-readable program code, the processor is configured to perform executable operations which include: Transmit at least one client request containing payload data with a unique identifier to the web-based application; Receiving an HTML response and an associated Document Object Model (DOM) object from the web-based application; Using a processor, identify content that corresponds to the user data in the DOM object via the unique identifier; and Identifying a section of the DOM object containing the payload as untrusted. [13] Computer program product for checking a web-based application for security vulnerabilities, wherein the computer program product comprises: a computer-readable storage medium containing computer-readable program code embodied therein, wherein the computer-readable program code comprises: computer-readable program code configured to transmit at least one client request, containing payload data with a unique identifier, to the web-based application; Computer-readable program code configured to receive an HTML response and an associated Document Object Model (DOM) object from the web-based application; computer-readable program code configured to identify content corresponding to the payload in the DOM object via the unique identifier; and Computer-readable program code that is configured as untrusted to identify a section of the DOM object containing the payload. [14] Computer program product according to claim 13, wherein the computer-readable program code further comprises: computer-readable program code configured to generate a DOM abstraction from the DOM object, wherein the DOM abstraction has a section of the DOM object containing the content corresponding to the payload; Computer-readable program code configured to output the HTML response using the DOM abstraction instead of the DOM object. [15] Computer program product according to claim 14, comprising generating the DOM abstraction from the DOM object: Excluding sections of the DOM object from the DOM abstraction that do not contain content corresponding to the payload.

Images